Glucostratus Oy ("Glucostratus") welcomes you to the Balance remote monitoring system ("Balance").

Glucostratus is pleased to offer you a software application which lets you save and display results related to your health that you have measured with self-measurement devices like your blood glucose meter as well as other health-related data. The goal is to help you follow your self-testing values and ultimately further assist your personal treatment by providing the results you have saved to Balance with your consent to your healthcare professionals.

1. Accepting the Privacy Policy

The use of Balance requires the collection and handling of your personal data. For this reason, we will openly explain in this privacy policy how we handle your personal data and the reasons for collection followed by your specific approval for these purposes of use.

If you wish to use Balance you need to confirm that you accept the privacy policy and give a voluntary and explicit consent to the handling of your personal data set forth in this document. If you do not accept the privacy policy, you will be directed away from the software and you will not be able to use Balance.

If you are underage under the laws of your country, you need to have consent from your guardian to allow the use of Balance. The guardian should supervise the use of the software.

2. The terms for data collection in Balance

2.1 Protecting your privacy

Glucostratus commits to protecting your privacy as a user of Balance and will comply with the Finnish and EU legislation set for the handling of personal data and privacy. Glucostratus handles the data collected by the software as described in this privacy policy.

2.2 General information on the register

The name of the personal data register is the "Balance user database" ("User database"). The register is governed as the data controller by Glucostratus Oy with its registered offices at Kuortaneenkatu 2, FI-00510 Helsinki, Finland.

2.3 The content of the user database

The personal data collected to the user database includes data the user has entered to Balance software or uploaded from a third-party self-testing device or product that Glucostratus has approved. Personal data related to your health can also be saved to the user database by a healthcare professional or by personnel of a healthcare provider with your approval.

Depending on your needs as a user, the user database may include the following personal data among others ("Customer Data"):

Also, the following data about you, your treatment, your health and your use of Balance and other Glucostratus products can be collected to the database ("Status Information"):

2.4 Protection of the user database

Glucostratus follows good practices in data management and obeys the protection requirements of the privacy act and guarantees that your privacy as a user will not be breached in any situation when handling the information collected.

Glucostratus and the possible partners of Glucostratus who participate in the data handling will take the necessary actions to protect the data from unauthorized access, accidental or illegal deletion, altering, sharing, moving or other illegal handling of the data. The user database is stored on a data system that can only be accessed by such employees of Glucostratus or its partners who are, due to their professional roles, required to handle the data (such as the user's own healthcare personnel). The data system has been protected by access rights controls and passwords that are only in the possession of persons who are authorized to handle the user database.

2.5 Disclosing and transferring data

Glucostratus does not disclose the personal data to third parties in any other cases than those mentioned in this privacy policy. Affiliates that are a part of the same group of companies or subcontractors handling the data as requested by the owner of the user database are not considered as third parties. Glucostratus makes sure that these companies and subcontractors conform to the Finnish legislation and EU area legislature set out for data collection and handling and that these parties will handle the personal data according to Glucostratus' instructions and in line with this privacy policy.

Personal data can be disclosed to third parties such as to Glucostratus' customer organizations, healthcare providers and other parties only with your explicit approval. Glucostratus makes sure that these entities conform to the Finnish legislation and EU area legislature set out for data collection and handling and that these parties will handle the personal data according to Glucostratus' instructions and in line with this privacy policy.

Your Customer Data can, however, be shared with a third party if Glucostratus will after careful consideration see it necessary and justified.

If you are using Balance as a part of the treatment plan agreed with a partner organization of Glucostratus (e.g. a diabetes clinic or other healthcare organization), you need to also agree that your personal data can be handled. Glucostratus can disclose all the data that Balance collects to your healthcare professionals if you have given a separate permission on this to Glucostratus or to the healthcare professionals.

The personal data will not be disclosed or moved to outside the borders of the European Union or European Economic Area without a justification set forth in the law.

2.6 Purposes of Use for the User Database

Glucostratus collects and handles your personal data for the following purposes:

Only non-identifiable Status Information will be used by Glucostratus and/or its distributors for the purposes specified in items d), e) and f). Glucostratus or Glucostratus' distributors will not use your Customer Data or identifiable Status Information for these specific purposes or for the purpose specified in item 7 without your express consent.

Under no circumstances is it Glucostratus' aim to conduct research, which interferes with the sanctity of human life or physical integrity, or to study the reason or progress of the sickness of any specific individual. If Glucostratus or a cooperation partner of Glucostratus later considers it appropriate and important to use the information collected by the Balance User Database for medical research purposes, Glucostratus or the partner of Glucostratus may contact you to enquire after your interest and consent to take part in such research. Such projects shall at all times be based on specific research plans and their contents shall be explained in an appropriate manner prior to asking for consents.

2.7 Permission to handle the personal data

By accepting this privacy policy, you give Glucostratus the permission to handle your personal data as set out in section 2.3 in this document.

The data that Glucostratus collects can also become of use for other purposes still unknown at the time of the acceptance of these terms. By accepting this privacy policy, you will give your permission to Glucostratus and its distributors to use the permanently anonymized Status Information for such purposes still unknown.

2.8 Your rights

You have the right to check the personal data that has been stored in the user database and ask for correction of any inaccurate data. Due to the nature of Balance, the personal data collected by the software is in principle accessible at any time to the user through the user interface.

You have also the right to withdraw the given permission to the handling of your personal data. It is paramount to understand that withdrawing the permission will prevent the use of Balance as it is not possible to offer the Balance software without the access to personal data.

2.9 Use of cookies

Balance does not collect or store personal data using cookies.

3. Mobile app permissions

Self-measurement data can be registered in the GS Balance app manually or captured wirelessly via a Bluetooth or NFC connection from supported devices, such as blood glucose meters, spirometers, peak flow meters and blood pressure meters. For doing so the app requires permissions to scan for Bluetooth devices and use Bluetooth.

For scanning for Bluetooth devices in the Android version additional Location permissions are needed because Bluetooth could potentially be used to determine the device location. The GS Balance app does not, however, gather nor use Location information.

4. Other terms

This privacy policy is governed by the laws of Finland.

5. Additional information and contact details

Matters related to section 2.8 concerning checking your personal data and withdrawing your permission for handling your personal data and any other questions relating to privacy and use of personal data should be addressed to the email address support@glucostratus.com or to the postal address Privacy, c/o Glucostratus Oy, Kuortaneenkatu 2, FI-00510 Helsinki, Finland.

LB-44 rev. 3.0