Purposes and processing of personal data — Carewell Pool

We process your Personal Data primarily to provide you with our Services. Personal Data is collected and recorded so that you can register with Carewell and use our Services — for example to book a mission, including the e-mail and SMS reminder service. We may also process your personal data for the purposes of our legitimate interests related to the provision of our Services, as described in this document. Finally, certain purposes, such as marketing communications, rely on your consent, which you can withdraw at any time.

This document provides detailed information on the categories of data we collect and the purposes for which we process them.

Categories of personal data we process

Basic data

• Last name
• First name

Personal contact details

• Phone number (optional)
• E-mail address

Connection and usage data

Data relating to your activity and use of our Services, including:

• dates and times when the Services are used,
• session identifier,
• IP addresses,
• the device used for browsing,
• the content of requests.

Cookies

Cookies, trackers, browsing data and audience measurement. For details, see our cookie policy.

Payment information

Data relating to your billing address and payment method, such as:

• bank details,
• credit-card, debit-card or other payment-card information.

Purposes and legal basis

We process your Personal Data on one of the three following legal bases.

1. To provide you with our Services (performance of contract)

• Creating and managing your institution user account
• Providing the Services (booking missions, e-mail/SMS reminders)
• Service communications (notifications, support)
• Billing and collection

2. For the purposes of our legitimate interests

• Service security and fraud prevention
• Audience measurement and Service improvement

3. On the basis of your consent

• Marketing communications
• Any other purpose for which your consent is expressly requested

Recipients of the data

To provide the Service, certain data is shared with sub-processors. The full list, their role and country of hosting are published on our Sub-processors — Carewell Pool page.

Retention period

In general, personal data is retained for a period proportionate to the purposes pursued by its processing and not exceeding what is necessary to achieve those purposes. At the end of the applicable retention periods, the data is archived and then deleted or anonymised in accordance with applicable legal obligations or overriding interests justifying extended retention.

The retention periods applicable to each category of data are set out in the privacy policy. As an indication, data related to the user account is retained for the entire duration of the contractual relationship, then archived in accordance with applicable legal and regulatory obligations, in particular in accounting, tax and evidentiary matters.

Exercising data subjects’ rights

For Carewell Pool, Carewell acts as a processor on behalf of your institution, which is the controller of your Personal Data. We only process your data on the documented instructions of your institution.

To exercise your rights (access, rectification, erasure, restriction, portability, objection), we invite you to address your request directly to your institution, which is responsible for responding to it.

If you address such a request directly to Carewell, we are not authorised to act on it of our own initiative: acting solely on the documented instructions of your institution, we will forward your request to it so that it can respond.

For any data-protection question, you may also contact our Data Protection Officer.