TERMS AND CONDITIONS

1. INTRODUCTION

Welcome to [Your Company Name] ("we," "our," "us"). We are committed to protecting your privacy and ensuring that your personal data is handled in a safe and responsible manner. This Privacy Policy outlines how we collect, use, and protect your personal data in accordance with the Swiss Federal Data Protection Act (FADP) and the General Data Protection Regulation (GDPR).

2. DATA CONTROLLER

The data controller responsible for the processing of your personal data is:

SkyLab AG
Route de la Corniche 6, Biopôle, 1066 Epalinges, Switzerland 
Email: office@skylaboratory.ch 
Telephone: +41442174747

3. DATA COLLECTION

We collect the following personal data through our mobile application: 

Contact Information: Your name, phone number, and email address.
Face Image: Photographs or images of your face.
Usage Data: Information on how you use the application, including app interactions and device information.

4. PURPOSE OF DATA PROCESSING

We process your personal data for the following purposes: 

To provide and improve our services.
To communicate with you regarding your account or transactions with us.
To personalize your experience and provide content tailored to your interests.
To ensure the security and functionality of our application.
To comply with legal obligations and protect our legal rights.

5. LEGAL BASIS FOR DATA PROCESSING

We process your personal data based on the following legal grounds: 

Consent: By using our application, you consent to the processing of your personal data as described in this Privacy Policy (Art. 6(1)(a) GDPR).
Legitimate Interests: Processing is necessary for our legitimate interests, provided that such interests are not overridden by your fundamental rights and freedoms (Art. 6(1)(f) GDPR).
Legal Obligation: Processing is necessary for compliance with a legal obligation to which we are subject (Art. 6(1)(c) GDPR).

6. DATA SHARING AND DISCLOSURE

We do not share your personal data with third parties except in the following circumstances: 

With your explicit consent.
With service providers who perform services on our behalf and are contractually obligated to protect your data. This includes our collaboration with Haut.AI, an Estonian company that processes facial data of our clients.
To comply with legal obligations or respond to lawful requests from public authorities.
To protect our rights, privacy, safety, or property, and/or that of our users.

7. DATA PROCESSOR: HAUT.AI

We collaborate with Haut.AI, which serves as our data processor. Haut.AI processes facial data on our behalf and in accordance with our instructions. Haut.AI is HIPAA and GDPR compliant, providing all necessary safeguards to ensure the confidentiality, integrity, and availability of protected health information (PHI) for any data stored in the cloud or downloaded to a mobile device. We have ensured that Haut.AI is contractually obligated to protect your data and comply with applicable data protection laws.

8. DATA TRANSFER

If your personal data is transferred outside Switzerland or the European Economic Area (EEA), we ensure that it is protected by appropriate safeguards, such as the EU Standard Contractual Clauses or other legally acceptable mechanisms.

9. DATA RETENTION

We retain your personal data only for as long as necessary to fulfill the purposes for which it was collected or to comply with legal, regulatory, or internal policy requirements. Specifically: 

Contact Information: Retained for as long as you have an active account with us and for a period thereafter as required by applicable laws and regulations.
Face Image: Retained for as long as necessary to provide our services or until you request deletion of your data.
Usage Data: Retained for analytical purposes and to improve our services. Typically, this data is anonymized or aggregated.

After the expiration of the retention period, your data will be securely deleted or anonymized so that it can no longer be associated with you. If data anonymization is not possible, we will securely destroy your data in accordance with our data retention and destruction policies.

10. YOUR RIGHTS

You have the following rights concerning your personal data: 

Access: You can request access to the personal data we hold about you.
Correction: You can request correction of inaccurate or incomplete data.
Deletion: You can request deletion of your personal data, subject to certain conditions.
Objection: You can object to the processing of your personal data in certain circumstances.
Restriction: You can request restriction of the processing of your personal data.
Data Portability: You can request a copy of your personal data in a structured, commonly used, and machine-readable format.
Withdraw Consent: You can withdraw your consent at any time, without affecting the lawfulness of processing based on consent before its withdrawal.
Lodge a Complaint: You have the right to lodge a complaint with a supervisory authority, particularly in the EU Member State of your habitual residence, place of work, or place of the alleged infringement.

To exercise these rights, please contact us at [Contact Information].

11. DATA SECURITY

We implement appropriate technical and organizational measures to protect your personal data against unauthorized access, loss, or destruction. These measures include: 

Access Controls: Restricting access to personal data to authorized personnel only, and ensuring that these personnel are subject to strict confidentiality obligations.
Encryption: Using encryption protocols to protect personal data during transmission and storage.
Secure Storage: Storing personal data in secure facilities and on secure servers.
Regular Audits: Conducting regular audits and assessments of our data security practices and systems to ensure compliance with industry standards and regulatory requirements.
Training: Providing regular training to our employees on data protection and privacy best practices.
Incident Response: Implementing an incident response plan to promptly address and mitigate any data breaches or security incidents.
Data Minimization: Collecting and processing only the personal data that is necessary for the specified purposes.
Anonymization and Pseudonymization: Where feasible, anonymizing or pseudonymizing personal data to protect the identity of data subjects.
Physical Security: Ensuring that physical access to our facilities and servers is restricted and monitored.
Monitoring: Continuously monitoring our systems for potential vulnerabilities and threats.

While we take significant steps to protect your personal data, please be aware that no security measures are completely infallible. We cannot guarantee the absolute security of your data, but we strive to implement best practices and industry standards to ensure a high level of protection.