Privacy and Data Protection Policy

1. Who we are

CaregIVR – Cardiovascular Health Promotion: The Impact of Immersive Virtual Reality is a European research project dedicated to cardiovascular health promotion through the use of Immersive Virtual Reality technologies.

The project is developed by a European consortium coordinated by the Atlântica School of Health (ESSATLA), part of Atlântica, whose founding entity is EIA – Ensino, Investigação e Administração, S.A.

The official project website is available at https://caregivr.eu/.

2. Data Controller

For the purposes of managing the CaregIVR website and the services made available through it, the entity responsible for the processing of personal data is:

EIA – Ensino, Investigação e Administração, S.A.
Founding entity of Atlântica – Instituto Universitário and the Atlântica School of Health (ESSATLA)
Fábrica da Pólvora de Barcarena
2730-036 Barcarena
Portugal

Data Protection Officer:
rgpd@uatlantica.pt

EIA – Ensino, Investigação e Administração, S.A. is committed to protecting the confidentiality and security of personal data processed within the scope of CaregIVR and adopts appropriate technical and organisational measures to protect such data and comply with applicable data protection legislation.

3. Personal data processed through the website

Public content on the CaregIVR website may be accessed without creating an account or identifying the visitor.

Registration is required only to access and participate in certain community features, namely the forums and chatroom.

When an account is created and used, the following data may be processed, where provided by the user through the forms available on the website:

• name or username;
• email address;
• information included in the user profile;
• information voluntarily provided through registration fields;
• content published in the forums, chatroom or other community areas;
• IP address;
• technical information regarding the browser and device used.

These data are processed only to the extent necessary to enable the available features, manage user accounts, ensure community security, moderate content and prevent misuse or spam.

4. Purposes of data collection and processing

Personal data processed through the CaregIVR website may be used for the following purposes:

• creation and management of user accounts;
• user authentication;
• provision and management of the forums, chatroom and other community features;
• content moderation and maintenance of a safe and respectful environment;
• prevention and detection of spam, fraud, misuse or unauthorised access;
• responding to user requests;
• password recovery or reset;
• website administration, maintenance and technical security;
• obtaining statistical information regarding use of the website and its resources, where applicable;
• compliance with legal obligations to which the Data Controller is subject.

Data collected through CaregIVR are not used for medical diagnosis, individual clinical advice or automated clinical decision-making.

5. Community, forums and chatroom

When a user publishes content in the forums, uses the chatroom or participates in other community areas, the submitted content and associated metadata may be retained.

The IP address and technical information regarding the browser used may also be processed for security, moderation and spam or abuse detection purposes.

Content published by the user in areas visible to other members of the community may be accessed by other users who have access to those areas.

Users should therefore avoid publishing in the forums or chatroom personal or sensitive information that they do not wish to make accessible to third parties.

6. User profiles and Gravatar

If the website uses the Gravatar service, an anonymised string created from the user’s email address, also known as a hash, may be sent to that service to determine whether a profile image is associated with it.

The Gravatar privacy policy is available at:https://automattic.com/privacy/

Where an image is associated with the user profile, it may be displayed alongside the user’s activity within the community areas.

7. Media content

Where image uploads are permitted through user profiles or community features, users are advised not to upload files containing embedded location data, particularly EXIF GPS information.

Where such data remain embedded in an image, other users with access to the file may be able to download it and view the location information contained within it.

8. Cookies

The CaregIVR website uses cookies required for its operation and for the features made available to users.

When the login page is accessed, a temporary cookie may be created to determine whether the browser accepts cookies. This cookie contains no personal data and is deleted when the browser is closed.

When a user logs in, cookies may be created to store information required for authentication and certain website usage or display preferences.

Login cookies normally remain active for two days. If the user selects “Remember Me”, the session may remain active for a longer period.

When the user logs out, authentication-related cookies are removed in accordance with the platform’s operation.

The forums, chatroom and other community components may use additional cookies whenever required for authentication, security, preference storage or the proper functioning of those services.

9. Embedded content from other websites

CaregIVR pages may include content provided by external websites or services, including videos, images, documents, maps or other embedded content.

From a technical perspective, interacting with such content may be equivalent to visiting the external website or service that provides it.

Those services may, in accordance with their own privacy policies, collect user data, use cookies, employ additional third-party tracking mechanisms or record interactions with embedded content.

This may occur in particular where the user has an account and is logged in to the relevant external service.

10. Data sharing and disclosure

Personal data processed within CaregIVR may be disclosed to service providers of EIA – Ensino, Investigação e Administração, S.A. where this is necessary for the operation, hosting, maintenance, security or administration of the website.

External services may also be used in connection with:

• hosting and technical maintenance;
• authentication;
• security;
• spam prevention and detection;
• email delivery;
• password recovery;
• operation of community tools;
• technical or statistical analysis of website operation.

Data may also be disclosed to judicial, administrative, tax, regulatory or other competent authorities where required by law.

If a password reset is requested, certain technical information, including the IP address used to make the request, may be included in or used as part of the account recovery process.

11. Data retention

EIA – Ensino, Investigação e Administração, S.A. will retain personal data for the period necessary for the purposes for which they were collected and processed, without prejudice to retention periods imposed by legal obligations.

Data associated with user accounts will be retained while the account remains active or for as long as necessary for community management.

Content published in the forums and associated metadata may be retained for longer periods in order to preserve the continuity of discussions, the coherence of existing topics and their moderation.

Messages and other information generated through the chatroom may be retained for the period necessary for the operation, moderation and security of that service.

Where there is no longer a lawful basis for retaining data, the data will be deleted or anonymised, unless a legal obligation requires their continued retention.

12. Rights of data subjects

Under applicable legislation, data subjects may, depending on the circumstances and within the limits laid down by law, request:

• access to their personal data;
• rectification of inaccurate or outdated data;
• erasure of their data;
• restriction of processing;
• objection to processing;
• data portability, where applicable;
• information concerning the processing of their data;
• withdrawal of consent where processing is based on consent;
• the exercise of applicable rights relating to automated individual decision-making, where such decision-making exists.

Withdrawal of consent does not affect the lawfulness of processing carried out on the basis of consent before its withdrawal.

The exercise of these rights does not affect data whose retention is required for compliance with legal obligations, website security or other legally permitted purposes.

Requests relating to personal data protection may be addressed to the Data Protection Officer at: rgpd@uatlantica.pt

Data subjects may also lodge a complaint with the competent supervisory authority.

13. Personal data breaches

EIA – Ensino, Investigação e Administração, S.A. adopts measures designed to prevent unauthorised access, loss, alteration, disclosure or misuse of personal data.

If a personal data breach occurs, the measures required under applicable legislation will be taken, including, where required, notification to the competent supervisory authority and affected data subjects.

14. Security and confidentiality

EIA – Ensino, Investigação e Administração, S.A. is committed to protecting the confidentiality and security of personal data processed through CaregIVR.

For this purpose, technical and organisational measures are adopted to ensure that personal data are processed lawfully, fairly, transparently and only for the purposes for which they were collected.

Measures are also adopted to ensure the accuracy, integrity, availability and confidentiality of the data and to restrict access to duly authorised persons and entities.

Employees, collaborators and service providers who, in the course of their duties, may have access to personal data are subject to the applicable confidentiality obligations.

15. Where data may be sent

Data associated with registration, authentication, forum posts and other activities carried out on the website may be processed through automated security, authentication or spam detection systems.

The use of embedded content or external services may also involve the transmission of certain technical data to the respective providers, in accordance with their privacy policies.

16. Data protection contacts

For any question regarding this Privacy and Data Protection Policy or the processing of personal data through CaregIVR, please contact:

Data Controller
EIA – Ensino, Investigação e Administração, S.A.
Fábrica da Pólvora de Barcarena
2730-036 Barcarena
Portugal

Data Protection Officer
Email: rgpd@uatlantica.pt

Except where otherwise indicated, the content of this website is licensed under the Creative Commons Attribution 4.0 International Licence (CC BY 4.0).