Cuico Health app privacy policy
How the Cuico Health app for iPhone and Android handles your data: what it collects, why, who it is shared with and how to delete your account.
Last updated:
1. Who processes your data
Cuico Health is an app for patients of hospitals and clinics that work with Cuico. You can only use it if your hospital or clinic has registered you.
- Your hospital or clinic is the data controller for your health data: it decides how it is used as part of your medical care.
- CUICO HEALTH, S.L. (C/ Aldabe, 14, piso 5, 01012 Vitoria-Gasteiz, Álava, Spain; info@cuico.eu) provides the platform and processes your data on behalf of your hospital, only to provide you with the service.
Each hospital's data is kept separate from every other hospital's.
2. What data we process and why
| Data | Where it comes from | What for |
|---|---|---|
| Name, email address, date of birth and clinical data from your record | Your hospital | To identify you and show you your information |
| Email and password, or access code | You, when you sign in | To sign in |
| Measurements you log (blood pressure, glucose, weight, mood…) | You | So your care team can follow your progress |
| Apple Health / Health Connect data (see section 3) | Your phone, if you allow it | Same |
| Data from your watch or ring (Garmin, Oura, Whoop, Fitbit) | The manufacturer, if you connect your account | Same |
| Medication, questionnaire answers, care plan tasks and their photos | You | To follow the care plan your team has given you |
| Messages, photos and documents you send | You | To communicate with your care team |
We do not use your data for advertising, we do not sell it, we do not build commercial profiles and we do not use it to train artificial intelligence models. The app does not collect your location or your contacts and contains no analytics, advertising or tracking tools.
3. Apple Health and Health Connect
If you allow it, the app reads from Apple Health (iPhone) or Health Connect (Android): heart rate (including resting heart rate and heart rate variability), steps, distance, blood pressure, oxygen saturation, body and skin temperature, glucose, weight, height, sleep, respiratory rate, exercise and energy burned. The app does not write to Apple Health or Health Connect.
This data is sent to the Cuico platform only so that your care team can see it as part of your follow-up. It is not used for advertising, it is not sold or shared with third parties for other purposes, and it is not used for anything other than your care. Syncing may happen in the background. You can withdraw permission at any time from the Health or Health Connect settings; data already sent stays in your record until it is deleted as described in section 6.
The use of information received from Health Connect will adhere to the Health Connect Permissions policy, including the Limited Use requirements.
4. Legal basis
The processing of health data is based on the provision of healthcare by your hospital (Art. 9(2)(h) GDPR). Reading Apple Health / Health Connect and connecting wearables are based on your consent, which you can withdraw at any time.
5. Who it is shared with
- Your care team, within your hospital.
- Service providers CUICO uses to deliver the service, under a data processing agreement and only for that purpose: Google Cloud (servers in the European Union, Belgium region) and the provider that sends sign-in emails.
- Wearable manufacturers only if you connect your account, and only to bring your data into Cuico.
6. How long it is kept and how to delete your account
Your data is kept while you are being followed by your hospital and, after that, for as long as the law requires your hospital to keep clinical records.
To delete your account and your data, email info@cuico.eu from the address you use to sign in to the app (or stating your hospital, if you sign in with a code), with the subject "Delete my account". We pass the request on to your hospital, which decides on your medical record, and confirm to you what has been deleted within 30 days at most. Your access to the app and the data you have provided through it are deleted, except for any data your hospital is legally required to keep.
7. Security
Communications are encrypted (HTTPS). What the app stores on your phone to work offline is encrypted (AES-256) and is excluded from phone backups. Your credentials are stored in the system's secure storage (Keychain on iPhone, encrypted storage on Android).
8. Your rights
You can request access to, rectification, erasure, objection to processing, restriction of processing and portability of your data from your hospital or from CUICO (info@cuico.eu), which will pass it on to your hospital. If you are not satisfied with the answer, you can file a complaint with the Spanish Data Protection Agency (www.aepd.es).
9. Minors
The app is intended for adult patients. If your hospital registers a minor, it does so with the authorisation of their legal representatives.
10. Changes
If we change this policy, we will tell you in the app before the change takes effect.