Sinque Privacy Policy — Europe

1. Who we are

For users in the European Economic Area and other international markets covered by this policy, Sinque is provided by EW2Health B.V., The Netherlands — Langegracht 70, 2312 NV, Leiden. Privacy contact: info@ew2health.com.

For the personal data processed directly to provide the Sinque service, EW2Health B.V. acts as the data controller.

When you choose to join a clinic, healthcare programme or professional group, additional data-sharing arrangements may apply. You will be asked to accept a separate data-sharing notice or agreement before your individual information is shared with those healthcare professionals.

2. Information we collect

We only collect information that is reasonably necessary to provide, operate and improve Sinque. This may include:

• name;
• email address;
• telephone number;
• login and authentication information;
• sex;
• age and date of birth;
• height;
• body weight;
• Body Mass Index (BMI);
• body composition information;
• information related to clothing during a weigh-in;
• historical weight measurements;
• frequency of measurements and application usage; and
• technical information relating to your mobile device and application session.

3. How Sinque uses weight data

Sinque is designed to interpret patterns rather than simply display individual weight measurements. When you perform a weigh-in, Sinque may:

• collect the measurement from a compatible device;
• compare it with previous measurements to identify unexpected values;
• ask for information relating to clothing;
• store the validated measurement;
• analyse a chronological sequence of weight measurements;
• calculate trends and weight trajectories; and
• generate forecasts and other information intended to help you understand your progress.

4. Why we use your information

We process personal information to:

• create and manage your Sinque account;
• authenticate your identity;
• provide the functionality of the application;
• collect and validate weight measurements;
• calculate weight trends and forecasts;
• personalise your experience;
• maintain the security and integrity of the service;
• provide technical and customer support;
• communicate important information about your account or the service;
• generate reports for healthcare professionals when you have specifically authorised this sharing;
• operate, maintain and improve our technology; and
• conduct internal research and analytics using anonymised information.

5. Legal bases

Under the GDPR, different processing activities may rely on different legal bases. Processing necessary to provide the Sinque service may rely on performance of our contract with you, while certain operational and security processing may rely on applicable legal obligations or legitimate interests. Health data requires an additional basis under Article 9 GDPR; where appropriate for the direct-to-consumer Sinque service, EW2Health relies on your explicit consent to process this information.

Where processing is based on consent, you may withdraw your consent at any time. Withdrawal does not affect processing that lawfully occurred before withdrawal. Some core Sinque functions may no longer be available if we cannot process the health information required to provide them.

6. Healthcare professionals and groups

Your use of Sinque does not automatically give a clinic or healthcare professional access to your individual data. If you choose to join a clinic, healthcare programme or professional group, Sinque will identify the relevant group and ask you to accept a separate data-sharing arrangement.

Only after you provide the required authorisation may relevant individual information be made available to authorised professionals, such as the clinic, physicians, and nutritionists or other authorised healthcare professionals involved in your programme.

Those professionals may use the information to personalise your care, identify changes in your progress, generate alerts, identify possible disengagement and communicate with you. The precise responsibilities of EW2Health and the healthcare provider may depend on the specific programme and contractual arrangement.

7. Employers and insurers

EW2Health does not provide employers or insurers with individual-level health information through its management reporting. Employers or insurers may receive aggregated information about groups of participants.

As a privacy safeguard, reporting is designed to include groups of more than ten individuals. Where the characteristics or statistical distribution of a group could make an individual reasonably identifiable, Sinque may increase the population included in the analysis or suppress the relevant information. The purpose is to provide population-level information while reducing the risk that an employer, insurer or other recipient could identify a specific participant.

8. Artificial intelligence

Sinque may use artificial intelligence and automated technologies to support parts of the service. The calculations used to analyse weight sequences, trends and forecasts are performed using EW2Health's own technology.

Sinque may use OpenAI technology to assist with the linguistic formulation of certain messages. Before limited information is sent for this purpose, EW2Health is designed to remove direct identifiers and limit the information provided to what is necessary to generate the relevant language. OpenAI is not responsible for Sinque's weight calculations, trend calculations or clinical analytics.

User data and conversations are not intentionally used by EW2Health to train third-party general-purpose AI models. Sinque does not use a third-party generative AI model to make autonomous medical diagnoses or decisions producing legal or similarly significant effects for the user. Healthcare decisions remain with the user and, where applicable, the relevant healthcare professional.

9. Research, analytics and algorithm development

EW2Health may use anonymised information for internal research, statistical analysis, analytics and improvement of its algorithms.

Information is intended to be anonymised before it is used for these secondary purposes so that it can no longer reasonably be linked to an identifiable individual. Information that can still reasonably be linked or re-linked to an individual remains personal data and continues to be protected under applicable data protection law.

10. Who can access your information

Access to identifiable personal information within EW2Health is limited to authorised personnel who require access for legitimate operational purposes. This may include authorised members of EW2Health's clinical team; information technology and security teams; customer and technical support teams; and other personnel who require access to operate or protect the service. Access is intended to follow the principle of least necessary access.

11. Service providers

EW2Health uses third-party technology providers to operate Sinque. These may include providers of cloud infrastructure (including AWS), Firebase services, authentication services, email and communication services, and artificial intelligence services (including OpenAI).

These providers may only receive the information reasonably necessary to perform their contracted functions and are subject to applicable contractual and data protection requirements.

12. Where information is stored and international transfers

Sinque uses infrastructure located in the European Union, including Sweden, and in Brazil. Personal data may therefore be transferred or processed between these locations.

Brazil has been formally recognised by the European Commission as providing an adequate level of protection for personal data under Article 45 GDPR. This allows covered transfers of personal data from the European Union to Brazil without additional transfer authorisation under the GDPR. Where information is transferred to any other country or provider not covered by an adequacy decision, EW2Health will use an appropriate transfer mechanism where required by law.

13. How long we keep your information

We currently retain personal information while your Sinque account remains active and may retain relevant information for up to ten years thereafter, subject to applicable legal, regulatory, contractual and data-protection requirements. This retention period may vary according to the category of information and the reason for processing it.

Where you validly request deletion, personal information will be deleted or anonymised unless EW2Health is legally entitled or required to retain specific information. Deleted information may remain temporarily in secure backup systems for up to 30 days before the relevant backup cycle is completed.

14. Your privacy rights

Subject to the conditions and exceptions established by applicable law, you may have the right to:

• obtain information about how we process your data;
• access your personal data;
• correct inaccurate information;
• request deletion of your personal data;
• request restriction of certain processing;
• receive certain information in a portable format;
• object to certain processing;
• withdraw consent where processing is based on consent; and
• lodge a complaint with the competent data protection authority.

15. Account deletion and data export

You may request deletion of your Sinque account and personal information. You may also request an export of personal information associated with your account, subject to applicable technical and legal limitations. Deletion of your information may make it impossible for us to continue providing some or all Sinque services. You may exercise your rights by contacting info@ew2health.com; we may need to verify your identity before completing certain requests.

16. Security

EW2Health uses technical and organisational measures intended to protect personal information against unauthorised access, disclosure, alteration, destruction or loss. Because health information is particularly sensitive, EW2Health applies additional access and governance controls to its processing.

No electronic system can guarantee absolute security, but we continuously work to maintain safeguards appropriate to the nature of the information and risks associated with the service.

17. Data protection impact and accountability

Sinque processes health information and uses longitudinal analytics and predictive technology. EW2Health evaluates the privacy risks associated with these activities and may perform Data Protection Impact Assessments where required or appropriate.

The European Data Protection Board specifically identifies health data, prediction or scoring and innovative technologies among factors relevant when assessing whether processing is likely to result in high risk.

18. Adults only

Sinque is intended exclusively for individuals aged 18 years or older. We do not knowingly provide the service to children through this version of Sinque.

19. Changes to this Privacy Policy

We may update this Privacy Policy when the Sinque service, our technology or applicable legal requirements change. Where changes materially affect how we use your personal information, we will provide appropriate notice through the application, by email or through another reasonable communication method.