App Privacy Policy Data

Protection or Privacy Policy

Through this data protection notice, the Organisme Autònom de Salut Pública de la Diputació de Girona (Dipsalut) aims to provide agile and rapid access to the main information regarding the data processing carried out via the App used to manage your participation in the GiroStudi project, and to the rights you can exercise to effectively control your personal data.

Who is the data controller?

The data controller is the Organisme Autònom de Salut Pública de la Diputació de Girona (hereinafter, Dipsalut), with NIF (Tax ID) no. Q1700565C, and registered address at carrer Pic de Peguera, 15-La Creueta de Girona (17003). You can contact the controller at the following email address: info@dipsalut.cat

How can you contact the data protection officer?

The data protection officer is the person responsible for ensuring that Dipsalut complies correctly with data protection regulations. You can contact the data protection officer at the following email address: dpd@dipsalut.cat

What is the legal basis for processing your personal data?

The processing of your personal data is based on your explicit consent, which you can withdraw at any time.

What is the purpose of the processing?

The purpose of the personal data processing carried out through the App is to manage the Girostudi research project, which consists of a cohort (a group of people who are followed and studied over a period of time) in the field of public and social health. The main objective is to have information that allows for expanding the existing knowledge about the factors influencing the health and well-being of the population in the Girona region, and thereby develop more effective actions and policies to improve the quality of life in the province; as well as having data with territorial representation that allows showing inequalities across different social stratifiers.

To which recipients will your personal data be communicated?

In accordance with section 2.d) of the 17th additional provision of Organic Law 3/2018, recipients of the data may include, in pseudonymized form and for health research purposes (with prior approval from a research ethics committee), other research groups such as those from the Institut de Recerca Biomèdica de Girona (IDIBGI), Consejo Superior de Investigaciones Científicas (CSIC), Institut Català de Recerca de l’Aigua (ICRA), Institut Català de la Salut (ICS), Institut d’Assistència Sanitària (IAS), Institut de Recerca en Atenció Primària Jordi Gol (IDIAPJordiGol), or the Fundació Hospital de Puigcerdà.

Furthermore, if you have consented to be contacted by a research group interested in your participation in another research project where you would need to provide personal information, your identifying and contact details will be communicated to them for them to inform you and obtain your consent.

Likewise, if you have authorized the analysis of biological samples, the medical professionals responsible for your healthcare will be able to access the results through the shared clinical history (HC3).

On the other hand, data may be communicated to third parties anonymously.

No international data transfers are foreseen.

What profiles and automated individual decisions are made?

With the data collected within the GiroStudi project, an automated profile will be created to determine health status, well-being, living conditions, and environment, which has no consequences for you.

However, if the information derived from the research could be relevant and applicable to your health or that of your family members, you will be informed of this circumstance so that you can communicate it to your doctor and/or family members.

Likewise, in the case of biological sample analysis (if you have authorized their collection), the results will be published in your shared clinical history (HC3), so that the medical professionals responsible for your healthcare will have access to them.

In these cases, profiling may have consequences for your health or that of your family members and, in particular, for the healthcare that may be required.

How long will we keep the personal data?

The GiroStudi project will become a longitudinal study, so the intention is to keep it active over time. Therefore, it is expected to last for several decades.

Your data (including biological samples, if you have authorized their collection) will be kept for the duration of the GiroStudi project or other Dipsalut projects that, in accordance with section 2.c of the 17th additional provision of the LOPDGDD, are similar with purposes or research areas related to the area in which the initial study (GiroStudi) is scientifically integrated.

However, if you decide not to continue with the GiroStudi project, the data will be retained unless you request its deletion.

What are the rights of the data subjects?

Everyone has the right to obtain information about whether we are processing their personal data. If data is being processed, individuals have the right to access the data being processed.

Individuals also have the right to request the rectification of inaccurate or incomplete data, as well as to request its erasure (right to be forgotten) in certain cases, such as when it is no longer necessary for the purposes for which it was collected.

They may also request the restriction of data processing in certain circumstances. If this right applies, the stored personal data is marked in order to limit its future processing. Thus, the restriction of processing means that, at the request of the data subject, their personal data is no longer processed.

Data subjects can exercise their right to data portability, and in certain circumstances, they can also object to the processing of their personal data.

Finally, all individuals have the right not to be subject to decisions based solely on automated processing of their data.

You can find more complete information on these rights on the website of the Catalan Data Protection Authority.

Before whom and how can rights be exercised?

You can exercise the rights mentioned in the previous section before the data controller (Dipsalut), by means of a written request on paper or through electronic means.

This request must be resolved and notified within one month of its receipt, even if your personal data is not processed. This period may be extended by 2 more months (therefore, up to a maximum of 3 months), taking into account the complexity and number of requests received. In the latter case, Dipsalut must inform you of the extension within the first month.

What can be done if rights are not addressed or are violated?

You can file a prior complaint with the data protection officer, which must be resolved within a maximum period of 2 months from its receipt.

Alternatively, you can file a complaint with the Catalan Data Protection Authority.