Privacy Policy

Your Participation in the PROTEIN pilot “Group A” entails the processing of your personal data.

In order to develop the PROTEIN system, we need to test the PROTEIN application in context and with real users: these are users in their normal everyday life, and/or as clients of physical or electronic food stores, and/or as clients of physical or online restaurants (the so-called GROUP A Users), as well as persons following a professional supervisor (e.g. athletes) or patients who follow a medical practitioner (Group B and C). In this pilot, the project would like to evaluate usability, performance, and compliance of the system with the requirements gathered in earlier phases of technology development.

You belong to the Group A users.

For the PROTEIN system to work, the system processes personal data. By using the Protein app, you will be asked to provide personal information (via smartphone or web interface or sensors). This information include data about gender, age range, height, weight, chronic conditions, physical activity summaries, sleep summaries, calories burnt etc. (see below for a full list). This information will be processed by the PROTEIN system, or code, and will provide you with personalized eating or activity advice.

Your consent to the processing of your personal data

Through participation in this research pilot, and by completing the consent form and using the PROTEIN app, you accept to transmit to us personal information, including sensitive information relating to your eating habits and health status, and you consent to the processing of this information. The personal information described below covers the different types of information that will be requested when using the PROTEIN app. Some fields are optional.

We have a responsibility towards your data and your privacy.

Before you decide whether to consent to the processing of your personal data, we ask you to read this document carefully.

Take your time and read through; should you have any questions, or should you want to know more, do not hesitate to contact the PROTEIN project through the links provided at the end of this document.

Legal Framework

We are acutely aware of the responsibility towards your data and your privacy. Any processing of your personal data in PROTEIN abides strictly by the European General Data Protection Regulation 679/2016 (GDPR) and its national implementations in the following countries: Germany, UK, Belgium, Portugal, Spain, and Italy.

This means; minimization of the data that we collect to what is necessary, separation between research participant and data relating to him or her via pseudonymization, contextual assessment of the actual risks to the rights and freedoms of users, and consequently, set up of the appropriate technical and organizational measures.

Types of personal information that we collect

We have minimized the types of personal data that we collect to what is required, adequate and relevant to our research purpose, refraining from collecting data simply because “it could be useful.” The types of data that we collect are necessary. Without the following types of personal data, the purpose of the research could not be attained.

The table below describes the categories and types of personal information that system starts collecting when you download, register, and start using the PROTEIN app. The table also details the mode or ‘source’ of collection. In some situations, our pilot participants will be required to trial a smart belt or a digital scale. In this case, the data are collected and transmitted to the protein app from these external sensors.

Take note of the distinction between GROUP A, B, and C users, as the types of data collected differ

In addition to the personal information above, we will automatically collect a series of “meta data” to acquire information about your use of the system. This includes, but is not limited to; time duration for which individual app screens are being used, items (e.g., a button) selected by the user in a screen, date and time the user launches the app, date and time the user closes the app, when the user opens a notification, number of times the application crashed, reasons for an app crash.

Pseudonymization of personal information that we collect about you

Pseudonymisation is a technique that consists of replacing one attribute, typically the name in a record, with another, a code or number; where the code or number is used to link individual-level data to data subjects’/ research participants’ identities. In PROTEIN we apply this technique.

After you download the application, you will be asked to create a username and a password. Your username is a valid email address (the system will send to your email account a link to be clicked for authentication purpose). Importantly, the system will then generate a user-ID.

Any data that you will provide will be linked not to you but to your user-ID. This means that it will be impossible for us, as well as for anyone who might illegally break into our database, to identify you through your data. User credentials will be stored securely in a separate database.

The use of the personal information that we collect about you

The PROTEIN system leverages on automated decision-making mechanisms, such as profiling and artificial intelligence, to propose advice on personalized meals and physical activities. The advice provided by the system is based on parameters, criteria, options (e.g., for meals, for activities) stemming from scientific cooperation between PROTEIN project partners during the first year of the project. Specifically, between, on one hand, computer scientists, and, on the other, medical researchers, health professionals, in nutrition, chronic disease prevention and management.

The data linked to your pseudonym will be sent to the PROTEIN database in an encrypted form. After the pilot ends, project partners, including technological partners and experts in nutrition and health, will assess the results of the pilot. This is necessary to attain the purpose of the pilot, which is to: evaluate usability, performance, and compliance of the system with the requirements gathered in earlier phases of technology development. To do this, researchers will conduct processing activities on the pseudonymized data collected. The outcome of this processing will be “research data” that can be used to test and assess the system’ robustness as well as its reliability in terms of advice offered.

Under no circumstances will PROTEIN researchers seek to link the data collected to your identity, as doing so would be a violation of the purpose of the binding principle. Under no circumstances, by the same token, will research partners share the original data and the research data with any third party, without informing you and asking for your explicit consent.

Storage and safety of data collected

Any personal information collected via PROTEIN is stored in servers located in EU countries. The databases where your data is stored are under the control of project partners. The partners have adopted a PROTEIN Data Exchange and Data Security Protocol which describes the technical and organizational measures that ensures the safety of this information, including physical, electronic, and managerial procedures to help prevent unauthorized access, maintain data security, and correctly use the information we collect. Any data collected will be always protected by a pseudonym.

Data breach notification policy

Despite our efforts, no security system is impenetrable. In case of a data breach, we will, at the latest within 72 hours, inform the Project Coordinator and the national Data Protection authority. We will notify you about any potential harm, including any attempted or successful unauthorized use or disclosure of the data, as well as about any risks and any measures adopted to deal with any incident.

Duration of the pilot, Retention, and deletion of personal information that we collect

The duration of the PROTEIN Pilots Phase I will be six months.

At the end of the pilot, the PROTEIN app will stop working. We will suspend the use of the app to allow project partners to assess the results of the pilot and identify any problems or propose improvements. The system will therefore stop collecting any further data about you and stop providing you any services. We will welcome you at the next phase of pilots.

In general, the data collected during this pilot phase will be stored by us through the whole duration of the project, until 31 May 2022. After that date, your data will be deleted or irreversibly anonymized, in respect of national provisions on data retention in research. User data being ‘irreversibly anonymized’ means that any personally identifiable information (i.e. any information that could lead to the identification of the user, e.g. the user email) is permanently deleted, leaving only data that cannot lead to the identification of the user. Before anonymizing the research data, we will recontact you and ask for your consent.

Withdrawal from the pilot and deletion of personal data

Participation in PROTEIN’s project pilots is voluntary.

This means that you can withdraw from the pilot any time. To do so, you just need to navigate to the PROTEIN application settings, select ‘Withdraw from the PROTEIN Pilot’ and follow the instructions there. Upon your withdrawal, we will delete your personal userID and all data assigned to your userID. Any new collection of data relating to you will cease immediately. You have the option to let PROTEIN keep the data about you that has been collected so far, in anonymized form, for research purposes.

Your rights as a data subject

During your participation in the project you have a number of rights as a data subject which you can exercise at any time. In particular, you have the:

• ✓ Right to be informed: You have the right to be informed about the collection and use of your personal information, including the purpose for which we are processing this information, the period that we will retain it and with whom we will share it.
• ✓ Right of access: You have the right to ask from us to confirm whether we are processing personal information concerning you. Where that is the case, you can access your personal information that we are processing and relevant supplementary information.
• ✓ Right to rectification: You have the right to request from us modifications to your personal information in case you believe that it is not up to date, complete or accurate.
• ✓ Right to erasure (“right to be forgotten”): You have the right to ask us to erase your personal information that we are processing.
• ✓ Right to restrict processing: You have the right to request from us to restrict the processing of your personal information, with a view to limiting the way that we use this information.
• ✓ Right to data portability: You have the right to ask for your personal information to be provided back to you in a machine-readable format.
• ✓ Right to object: You have the right to object to us processing your personal information at any time for reasons related to your particular situation.
• ✓ Right to lodge a complaint: Please keep in mind that you also have the right to lodge a complaint to a supervisory authority (e.g. the Data Protection Authority within your region or country) should you think that your rights have been violated.

To exercise your rights or if you have any questions about this information sheet, please contact the PROTEIN project through any of the channels mentioned here: https://protein-h2020.eu/contact/.

To lodge a complaint, contact your national Data Protection Authority online: https://edpb.europa.eu/about-edpb/board/members_en.