Data Privacy | Trigo

Trigo Tech AS takes your privacy very seriously and treats all your personal data with great care. This document sets out Trigo Tech AS policy regarding privacy and security. It is recommended that you read this policy carefully. Throughout this agreement references to “you” or “your” applies to the end user of the Trigo application.

Trigo Tech AS is a company with limited liability established and existing under the laws of Norway.

Trigo Tech AS has developed a platform used to provide tools for you to manage your health and wellness by your healthcare provider or sporting organisation to support you to achieve your objectives. This will include gathering information from you, and/or providing information to you, the end user. Trigo Tech AS is responsible for content added by Trigo Tech AS but does not screen content posted by your healthcare provider or sporting organisations, nor does it select or screen specific exercise routines that are provided to you by your healthcare provider or sporting organisation.

Trigo Tech AS is subject to and compliant with Regulation (EU) 679/2016 (GDPR). In the UK Trigo Tech AS is subject to and compliant with the UK Data Protection Act 2018 when controlling or processing data in the course of business.

Trigo Tech AS is registered with the UK Data Supervisory Authority in accordance with The UK Data Protection (Charges & Information) Regulations 2018 with a registered number ZB307715.

Where you are located and where your health provider or sporting organisation is registered impacts data protection and privacy laws, which may apply to the control or processing of your data.

Trigo Tech AS processes your personal data for the purpose of supported self-care regarding your health and wellness. Including the creation of exercise routines for you to perform, assessments of health and fitness, provision of contextual information to support positive health outcomes. Trigo supports healthcare professionals, employers, insurance companies and sporting organisations to help you achieve your health, wellness and performance objectives by maintaining an efficient platform and content to support high quality care. Trigo Tech AS may use your personal data for the following purposes:

      To allow the healthcare provider or sporting organisation to use Trigo, including the management of your exercise routines and the management of your compliance.

      To allow you to use Trigo, including access to exercise routines provided by your healthcare provider or sporting organisation and to monitor compliance and provide information to you, to your healthcare provider or to your sporting organisation.

      To provide health and wellness assessments with contextual advice and information by Trigo or your independent healthcare professional or sporting organisation.

      To process payments by Trigo, your healthcare provider or sporting organisation.

      To communicate with you about Trigo and/or other services of Trigo Tech AS;

      To configure Trigo for your use.

      For protection of your data and with your consent, to generate anonymous statistical data.

If your healthcare provider or sporting organisation has introduced you to Trigo, Trigo Tech AS will store and process personal data on behalf of the healthcare provider or sporting organisation, a client of Trigo Tech AS. Under these circumstances, Trigo Tech AS has additional data processing agreements in-place in order to provide the service to you, the end user.

For a full list of data processors and the purpose of the processing, please refer to appendix 2 of this privacy policy. For this processing, the healthcare provider or sporting organisation will act as the “data controller” within the meaning of Regulation (EU) 279/2016 (GDPR) and UK Data Protection Act 2018. As Data Controller, information regarding the way they might process your personal data and the terms of their privacy policies is the responsibility of your healthcare provider or sporting organisation.

If you registered directly with Trigo and your registration was not activated by your healthcare provider or sporting organisation, Trigo Tech AS will be the “data controller” for your personal data and will also process your personal data for its own purposes and is responsible for the lawful processing of this personal data.

If Trigo Tech AS introduces you to your healthcare provider or sporting organisation, then Trigo Tech AS will be joint data controller with your healthcare provider or sporting organisation who will be data controller for the professional services they provide to you. You may under any circumstance object to your data to being processed however this may prevent Trigo Tech AS services being provided to you. You may communicate your preferences by contacting Trigo Tech AS.

Processing activities and legal bases for processing are explained in Appendix 1 and Appendix 2 of this Privacy Policy and you may contact Trigo Tech AS for information about the processing of your personal data via post@trigo.no.

If your enquiry requires the response from your healthcare provider or sporting organisation in their role as data controller, then Trigo Tech AS will inform you of this fact and ask your healthcare provider or sporting organisation to respond.

Your healthcare provider or sporting organisation is data controller for the professional services they offer; you may contact your healthcare provider or sporting organisation for information regarding their processing of your personal data.

To access Trigo as an end user it is necessary to create a personal account. For this we ask you for certain information about yourself. Your name, date of birth and and country of residence are mandatory, we also require either your email address or your phone number, which act as your username. This is necessary to provide the service. Optionally you may add your sex, and image.

If you are receiving the Trigo service through a third party such as your employer or other closed group, then certain other information may be mandatory for the purposes of identification and management information, for example this might be such employee number, policy number or similar. This information is necessary to provide the service. You may be asked for this information within the application or by another actor such as your healthcare provider or sporting organisation or employer.

Trigo Tech AS also processes information for the operation and quality of the service, specifically your location, IP address, unique device ID, and any chat dialogue and video appointment sessions that you choose to undertake via your Trigo app. You may use your device settings to disable location services.

Some of the data we collect is classified as sensitive, such as data about your ethnicity and your health. This data is collected only for the purpose of the service provided, and by agreeing to use Trigo and inputting your data into Trigo applications, you consent to us processing this data. We store your sensitive data in encrypted form and user-level access is restricted to yourself, a TrigoPro user that enters your data (eg following a healthcheck) and any TrigoPro user that you specifically consent to. If you do not consent, then you must not use Trigo.

You may request and view all terms of use and privacy documents and you will be asked for your consent prior to adding your personal data.

You may manage access to your sensitive data in your Trigo app and you may withdraw your consent and request your personal data is removed at any time.

The personal information contained in your account is stored in encrypted form and is not visible to unauthorized parties.

Where your healthcare provider or sporting organisation is data controller, only they can see your account information. Trigo personnel will only be able to view your personal information if you give consent via a support request or the data controller (your healthcare provider or sporting organisation) instructs Trigo by raising a support request, this will mean Trigo must view your personal data to service this request. Under these circumstances, Trigo will be able to see your name, email address, sex, telephone number, IP address, browser and mobile device type, and details regarding your Trigo routines. Trigo will not be able to view chat content or video consultations. This consent will be said to expire a maximum of 6 months after the instruction has been received.

Additionally, with your specific consent, Trigo may assign personnel from a contracted provider of professional services to support you further, for example, this may include a coach, physiotherapist or similar professional service provider. Under these circumstances the coach or physiotherapist will be able to access your personal data to deliver their service, specifically: name, email address, sex, telephone number, details regarding your Trigo routines and in-app chat and video where they are participants. Your chat and video history is not stored or recorded nor shared with any other party aside from those who were participating in the conversation at the time.

When using Trigo via an internet browser, cookies are saved on your computer. Cookies are small pieces of information (in the form of text) that a server sends to your browser (such as Internet Explorer or Firefox) with the intention that the browser sends this information back to the server the next time a user makes use of the Service. Cookies cannot damage your computer or the files saved on it. Cookies do not identify a natural person.

When you use the Service, first party cookies are saved on your computer. First party cookies are made by or for Trigo Tech AS and are stored on your computer by Trigo Tech AS and only Trigo Tech AS has access to these cookies. Such cookies are used by Trigo Tech AS, for example, to remember your login information.

You can configure your browser so that you do not receive any cookies the next time you use the Service. However, it is then possible that you will no longer be able to make full use of the Trigo Tech AS website or the portal log in services offered online.  You may read about cookies here: https://www.allaboutcookies.org.

With your consent, Trigo Tech AS may anonymise your information and share it with authorised third parties, for example to analyse anonymously the usage of the software so we can add new features and make improvements and for example to use anonymous data for research purposes The information that might be shared includes app usage behaviour to improve the usability of the application; routine and activity completion data in order that we can improve app content and relevance; progress reporting data including sleep, pain and completion trackers in anonymised or pseudonymised form.

If the App is made available to you by an organisation such as your employer, your sports club, your insurer, or similar closed group, we will provide anonymised, aggregated usage and user data, to the organisation. This information will not be personally identifiable to any specific individual.

Trigo Tech AS will only provide your personal data to third parties other than as set out in this Privacy Policy in the following cases:

      if it is legally obliged to do so on account of national or international laws, case law and/or regulations.

      if Trigo Tech AS considers it is necessary in defence of its own rights; or

      if you have given permission to do so.

Under certain circumstances, Trigo may ask you for consent to share your personal data with another party, for example to allow a family member or another healthcare provider or sports coach to view your account or support you with your usage of the service: Trigo Tech AS will only do this with your consent or the consent of your responsible adult and you may review and revoke access at any time. The information may include your name and email address plus information about your routine and completion progress; no chats or video call data will be shared with any party who did not participate in the original conversation.

Trigo Tech AS will not sell, rent or lease your personal information to third parties.

Trigo Tech AS stores your personal data within the EEA to avoid data transfers to countries which may not provide adequate protections in law to your personal data. Trigo Tech AS personal data is stored on Amazon Web Services, which has declared compliance beyond the requirements of the Schrems II safeguards, you can read the document here: https://d1.awsstatic.com/legal/aws-gdpr/AWS_GDPR_DPA.pdf

Trigo Tech AS may request your permission to use your location data, based upon the functions of your mobile device. Your consent will be obtained through your device before this data is collected and the data will be used to provide the service, specifically to match you to a suitable healthcare provider or to adjust time-based functions for your time zone. You can manage app permission in location services from the settings on your mobile device. Trigo app does not track your location. To read more about location services on your device and how to control them please refer to the following: Apple: https://support.apple.com/en-gb/HT203033;Google: https://support.google.com/accounts/answer/3467281?hl=en

Because some of the personal data processed, Trigo Tech AS has incorporated an appropriate level of security.

To protect the confidentiality and integrity of your personal data, we:

      Have internal policies that keep your data private and confidential.

      Encrypt all communications between Trigo Tech AS and our users (http: via SSL, email via TLS).

      Encrypt all patient health information in our database (“at-rest”).

      Limit information access inside our company to the absolute minimum necessary.

      Use an electronically and physically secured data centre.

      Use a firewall which blocks access by attackers and unauthorized users.

      Automatically logoff healthcare provider or sporting organisations after a certain period of inactivity.

      Require users to choose strong passwords

      Use a world-class CDN (content distribution network) which filters out possible attackers

      Use enterprise grade development and testing systems.

      Use enterprise grade server management technologies.

These are in accordance with Trigo internal policies: Internal Security; Secure Development Standard; Access Controls.

Trigo Tech AS will retain your personal data for as long as your Account is active or as needed to provide the Service to you. Trigo Tech AS will not retain your personal data if you ask that your personal data are deleted or if your withdraw your consent, unless the retention of the personal data is necessary to comply with a legal obligation or in order to establish, exercise or defend a legal claim.

Your personal data will be retained by Trigo Tech AS for a maximum period of five years of inactivity (i.e. you do not access the Trigo app for a period of five years). If your account is or has been assigned to a Trigo Pro professional then you will be deemed to have received provided professional advice, whereby the retention period will be 7 years of inactivity. Trigo will notify you of our intention to delete your personal data and you will be given the option to login to the app and reset the retention period.

If you have been assigned to a healthcare professional by Trigo, then your professional will be joint data controller and will be responsible for maintaining their own records of the service they provide to you, Trigo will not have access to this record.

Where your health provider, employer or sporting organisation terminates the Trigo Tech AS service, any stored personal data will be deleted unless otherwise requested by you, in accordance with the terms of the Trigo Tech AS Data Retention Policy. You have the right to demand erasure of the personal data held by Trigo and you may do this by deleting your account via the profile area in your Trigo app or by contacting post@trigo.no.

Your healthcare provider is data controller for the service they provide to you, the retention of your personal information will be subject to the legal obligation of your healthcare provider.

You may contact Trigo Tech AS for information about the processing of your personal data. If your enquiry requires the response from your healthcare provider or sporting organisation in their role as data controller, then Trigo Tech AS will inform you of this fact and ask your healthcare provider or sporting organisation to respond. You can send your request to post@trigo.no and Trigo Tech AS will respond to your request within 4 weeks in accordance with the requirements of the Data Subject Access Request clauses within Regulation (EU) 679/2016 (GDPR) and UK Data Protection Act 2018 . If Trigo Tech AS is for any reason unable to satisfy your request it will inform you as soon as reasonably possible.

      Where Trigo Tech AS is data controller as defined in section 4 Trigo will respond directly.

      Where Trigo Tech AS is not the data controller or is joint data controller, but your request requires information from your healthcare provider, then Trigo will inform you of this fact and liaise with your healthcare provider to meet your requirements.

Note that you may contact your healthcare provider or sporting organisation directly if you prefer.

Your right to erasure only applies in certain circumstances. Relevant exceptions include processing data that is for medical diagnosis, the provision of health or social care or the management of health or social care systems or services. Your healthcare provider is data controller for the services they provide and so they will determine the retention period for the records they keep, these are not recorded or stored by Trigo Tech AS. For more information, please refer to Article 17 of GDPR and/or UK GDPR.

Should you have a complaint about the way in which your data is controlled or processed you should first contact the Data Controller as defined in sections 3 and 4 of this document. If you feel that this does not resolve your concerns about the way in which your data is controlled or processed, then you have the right to complain to the national supervisory authority of your country.

Trigo Tech AS applies Norwegian law due to incorporation, for your reference the full list of European supervisory bodies can be found here https://edpb.europa.eu/about-edpb/board/members_en

If you are a resident of the UK the supervisory body for the UK Data Protection Act 2018 is Information Commissioner’s Office,https://ico.org.uk/global/contact-us

Trigo Tech AS may update this privacy policy from time-to-time to reflect legal requirements or operating circumstances or market and customer feedback. Changes will be communicated to you via electronic means (email, website, application) and you are encouraged to review the policy periodically.

Trigo Tech AS, c/o, Øvre Kråkenes 17, 5152 Bønes, Bergen, Norway Reg No. 820889452

Appendex-1
Appendex-2

‍The following notifications refer specifically to the Trigo public website found at https://www.trigo.no Specifically, we offer the optional facility to use links that we have placed on our website to allow you to share/like/comment our content, via the end user’s own social media accounts.

Appendex-3