LenusCare eHealth ApS ("LenusCare" or "we") respect your privacy and are committed to protecting it through the provision of our services and our compliance with this Privacy Policy. The Privacy Policy tells you: 

1. Who is responsible for the processing of personal information
2. How we collect information about you
3. The information we collect about you and how we use it
4. To whom do we disclose your information
5. For how long do we store your information
6. Your rights and choices related to information we collect about you
7. Our data security measures to protect your personal information
8. Changes to our Privacy Policy

The phrase “information about you” or “personal information” in this policy has the same meaning as “personal data” according to the EU General Data Protection Regulation (“GDPR)”, and means data we may use to identify you or that relates to you in other ways. 

We have tried to make this Privacy Policy easy for you to read and understand. If you have questions or need additional information about how we process information about you, you may contact us as set out in Section 1 below.

‍

‍

1. Who is responsible for the processing of your personal information and our contact information

This Privacy notice covers the activities which LenusCare performs as a data controller. 

For the personal information Lenus eHealth collects about you as part of coaching services you receive, we refer to the Lenus privacy notice (link).

For the data processed by the medical provider as part of your medical journey, LenusCare is operating as a data processor solely under the instructions of the medical provider, and we refer to the medical providers privacy notice for more information. 

‍

The contact information of LenusCare eHealth ApS, is: 

Rued Langgaards Vej 8, 2300

Copenhagen, DK

If you have any privacy related questions, you may always reach out to us at email: privacy@lenus.io. 

If you would like to complain to an official authority about LenusCare’s processing of personal data, you may lodge a complaint with the Danish Data Protection Authority (‘Datatilsynet’), who may be contacted at https://www.datatilsynet.dk/kontakt/ring-til-os. However, we always hope you will contact us first with any concerns you may have. 

‍

‍

2. How we collect information about you

This Privacy Policy covers the information about you that we may collect from you as a data controller. Below in section 3, you can find more information on our use of information about you in the following situations: 

1. When you as a client sign-on to LenusCare services (Weight-loss program)
2. when you communicate with our Support Team or other employees

This Privacy Policy does not apply to information about you collected by:

• the medical provider in the course of your medical weight loss program. This is between you and the medical provider and LenusCare only facilitates this as a data processor with limited access to the data. 
• the coach our Lenus as part of the coaching service

‍

‍

3. The information we collect about you and how we use it

The information we collect about you depends on your relationship with us and how you interact with us. We do not use algorithms or profiling to make any decision that would significantly affect you.

‍

A. When you as a client sign-on to LenusCare services (Weight-loss program)

We may, as independent data controllers, process the following information for us to be able to provide you with the services requested in the LenusCare App: 

• Contact information: When you sign on to the LenusCare App, we will collect your full name, gender, age, phone number and email, as well as your interest in a certain service. 
• Transactional and Banking Information: Details of the invoicing for your LenusCare Subscription.  
  This we may do as it is necessary to perform the contract (cf. GDPR Art. 6,(1),(b)).  We do not process information about your eligibility for the services requested, as this is assessed by the medical provider independently.

• Survey Input: Your responses to surveys that we or your coach might ask you to complete to provide you with a better service in the future based on your consent (cf. GDPR Art. 6,(1),(a)). In rare situations, these surveys may also include your health information, and in this case we will further process this data based on your explicit consent (cf. GDPR Art. 9,(2),(a). You are always able to recall the consent  regarding the collected survey input by contacting us, but please be aware that this will not affect the lawfulness of processing based on consent before its withdrawal, meaning that we will in most cases not be able to extract your input in the aggregated result of the survey. 

‍

B. When you communicate with our Support Team

When you communicate with our Support Team or other employees, we will process information about your use of our service and your inquiries or questions to be able to solve your problem or further assist you. We may also receive your correspondence with your coach, if the coach needs our assistance to provide you with a better service.

We may do so to provide you with customer support services and to train our support staff. This is necessary to pursue our and your legitimate interest in making sure you get the help you need from us on an ongoing basis (cf. GDPR Art. 6,(1),(f)).

‍

‍

4. To whom do we disclose Your Information

We may disclose personal information that we collect or you provide as described in this privacy policy to:

• subsidiaries and affiliates of the Lenus company group, including our entities in the US and the UK. 
• contractors, service providers, and other third parties, which we may use to support our business and who are bound by contractual obligations to keep personal information confidential and use it only for the purposes for which we disclose it to them. Currently our sole data processor providing our infrastructure is Lenus eHealth ApS, and they use the following sub-processors LINK(Hyperlink to list of data processors).
• a buyer or other successor in the event of a merger, divestiture, restructuring, reorganization, dissolution, or other sale or transfer of some or all of the Lenus company group’s’ assets, whether as a going concern or as part of bankruptcy, liquidation, or similar proceeding, in which personal information held by LenusCare about the Website and Service users is among the assets transferred.
• Medical practitioners, with whom we have established a collaboration for our Lenus Care Program. We will only disclose your contact information for them to initiate the contact with you. 
• To the extent these are located outside of EU/EEA, the processing will be based upon the adequacy decisions of the EU Commission in accordance with GDPR Art. 45, including certifications under the EU-US Data Privacy Framework, and otherwise the EU Commission’s Standard Contractual Clauses along with suitable safeguards.

If you want additional information about our transfer of personal data outside the EU and EEA, including a copy of the relevant security measures, etc., you can make a request for such additional information by contacting us (see section 1 above). 

We may under certain circumstances also disclose information about you to third parties:

• to comply with any court order, law, or legal process, including to respond to any government or regulatory request.
• to enforce or apply our terms of use and other agreements, including for billing and debt collection purposes.
• if we believe disclosure is necessary or appropriate to protect the rights, property, or safety of LenusCare or others. This might include exchanging information with other companies and organizations for the purposes of fraud protection and credit risk reduction.

‍

‍

5. For how long do we store your information

LenusCare is committed to only process your information in a period necessary to achieve the purposes for which the personal information was originally collected. Due to this, we have defined retention periods, which ensures we don’t store or process personal data for longer than necessary. Your personal information will be deleted or fully anonymised as follows: 

• Communications with you: (such as email inquiries) will be deleted 5 years after the end of the financial year where your last inquiry has been handled/concluded. If your communication pertains to an order, personal data will generally also be deleted 5 years after the end of the financial year in which the order was placed. In specific situations, we may defer from our general retention periods (in case of e.g. complaints, objections or other specific situations).
• Client information: We will delete or anonymize your information after 3 years of inactivity on the platform, while any health information or body images will be deleted after 6 months of inactivity due to their sensitivity. However, financial information we will maintain for 5 years due to our book-keeping and legal obligations.

‍

‍

6. Your rights and choices related to the information we collect about you

LenusCare eHealth ApS is established in the EU, and is thus subject to the GDPR, under which you as a data subject have granted rights which you may exercise in relation to your personal data. 

- In this regard, you also have the right to receive, upon request, further information that is helpful for you, and which you may deem necessary to exercise these rights. You may request such additional information at the contact information listed in section 1 above.

‍

Right to withdraw your consent given

Whenever our use and processing of your personal information is based upon a consent given by you, you always have the right to withdraw this consent for further processing. This will not impact or render the processing performed until that moment illegal, but no further processing will take place. 

‍

The Right to Request Access, Correction or Erasure of your Personal Information

You can review and change your personal information yourself by logging into the Service and visiting your account profile page.

You may also send us an email at privacy@lenus.io to request access to, request correction of incorrect data, or erasure of any personal information that you have provided to us. 

Please be aware that in many situations we cannot delete your personal information except by also deleting your user account.

‍

The right to Data Portability 

You may request from LenusCare that we provide certain personal data in a commonly used electronic format or transfer it to another data controller. Please be aware that in regard to data portability for coaching services and your data as a coach client, this will be done in collaboration with your coach, and may be subject to a joint evaluation on whether you fulfill the requirements of the GDPR. 

‍

‍

7. Data Security Measures to protect your personal data 

We take the security of your personal data very seriously. We implement a range of technical and organizational measures designed to protect your information from unauthorized access, use, alteration, disclosure, or destruction. These measures aim to ensure the confidentiality, integrity, and availability of your data.

Our security practices include:

• Encryption and Pseudonymization: We will encrypt or pseudonymize your data where appropriate to protect it. Encryption transforms data into an unreadable format, while pseudonymization replaces identifying information with pseudonyms.
• Access Controls: We restrict access to your personal data to authorized personnel only who need it to perform their job duties. This includes measures such as access restrictions and logging of access.
• Data Backup: We maintain regular backups of our systems and data to help prevent data loss.
• Confidentiality Agreements: We have confidentiality agreements in place with our employees and any third-party service providers who have access to your personal data.
• Monitoring: We continuously monitor our systems for potential security breaches.
• Secure Transmission: We protect data transmitted between you and our website and mobile/desktop apps using TLS encryption.

While LenusCare implements the necessary and appropriate security measures, it's important to acknowledge that no security system is foolproof. Security risks can never be completely eliminated, and some residual risks are unavoidable.

We want to emphasize that we can only secure the areas within our control. You also play a vital role in protecting your information. We recommend the following:

• Keep your login credentials confidential: Protect your usernames, passwords, and PIN codes and do not share them with others.
• Keep your devices secure: Ensure your devices (computers, phones, etc.) are free from viruses and malware.
• Be cautious in public areas: Be careful about disclosing personal information in public areas of our website, such as message boards.

‍

‍

8. Changes to Our Privacy Policy

LenusCare will post any changes we make to this Privacy Policy on this page. If we make material changes to how we treat your information, we will notify you by email to the primary email address specified in your account and/or through a notice on the Website home page. The date the privacy policy was last revised is identified at the top of the page. 

‍