The EU General Data Protection Regulation, or GDPR (Regulation (EU) 2016 / 679) is the latest update to data protection laws covering the 28 nations of the European Union.

Until 25 May 2018, EU data privacy legislation had a limited impact on Medical Joyworks. However, Article 3 of the new regulation expands its territorial scope to include us, a United States LLC with establishment in Delaware, and with no offices in the European Union.

Consequently, with this legislation having come into effect on said date, we take this opportunity to share with you some of its key aspects, how we are ensuring our compliance with it, and how it all relates to you.

The information presented below is lengthy, but important. Therefore, we kindly ask that you find a comfy chair, get a large cup of freshly brewed coffee, and take a few minutes to carefully read what we are about to share here.

Sincerely,

The Medical Joyworks team

The GDPR was enacted by the European Union and is intended to enhance the protection of natural persons with regards to the processing of their personal data. The GDPR does this by replacing the Union’s existing Data Protection Directive 95/46/EC and harmonizing the different data privacy laws in effect across the EU’s Member States.

The term processing is worth noting here. Under the GDPR, processing means:

Personal data is another important term, defined by the GDPR as:

You will want to keep these two terms in mind as you continue to read further!

The GDPR protects you, if you are:

• a natural person, and
• a national or resident of the European Economic Area (EU Member States, plus Norway and Switzerland), and
• are accessing any European or non-european business.

Under Article 13 of this legislation, we (the data “controller” or “processor”) are obliged to provide you (the “data subject”) with concise, transparent, intelligible and easily accessible information on:

• the legal basis by which we can process your personal data;
• who exactly is collecting your personal data;
• which personal data are being collected and further processed;
• why your personal data are being collected and further processed;
• how your personal data are being collected and further processed;
• your personal data privacy rights under this legislation; and
• how you can exercise your personal data privacy rights.

The GDPR’s Article 6 grants Medical Joyworks the legal right to process personal data, so long as one or more of the following 6 conditions are met:

Explained in our own words:

• you have given consent to the processing of your personal data for one or more specific purposes;
• processing is necessary for performing a contract to which you are a party or, in order to take steps at your request prior to entering into a contract;
• processing is necessary for complying with a legal obligation which we might have;
• processing is necessary in order to protect your vital interests, or those of another natural person;
• processing is necessary for performing a task carried out in the public interest, or in the exercise of any official authority vested in us;
• processing is necessary for the purposes of the legitimate interests pursued by us or by a third party, except where these interests are in conflict with your interests or fundamental rights and freedoms which require protection of personal data, in particular where you are a child.

This means that the legal basis by which Medical Joyworks can process your personal data comes down to these specific reasons:

• we have asked, and will continue to always to ask, for your consent to process your personal data for one or more specific reasons, at the moment when you enter into any relationship with us and at the moment when the data is collected, or within a reasonable period of time;
• at times, we believe that the processing of your personal data is necessary for complying with several legal obligations to which we are subject; and
• we believe that the processing of your personal data is necessary because we have a legitimate interest in:
  • personalizing your experience whenever you use our products and services;
  • authenticating you for the purposes of you using certain social media/user community features within our products and services;
  • improving our existing products and services to better match your needs;
  • developing new products and services that match your needs; and
  • marketing new and existing products and services to you;
• to the best of our knowledge, the above-stated legitimate interests are not overridden by your own fundamental rights and freedoms.

The GDPR makes clear in Article 4 what a personal data controller and a processor are:

There may be times when the controller and the processor are the same entity.

For our purposes here, your personal data is collected by Medical Joyworks and, where necessary, by essential third parties. These include:

• Apple Inc.
• Facebook Inc.
• Google LLC
• MoPub Inc.

The privacy policies across all our products and services have been clear and consistent on this matter since the Company’s founding in 2011; and, if anything, the GDPR only strengthens our commitment toward this level of clarity.

The personal data we are collecting and further processing is limited to what is outlined in our privacy policies:

• your name,
• your email,
• your profession,
• your specialty,
• your place of work,
• your favorite cases or scenarios, and
• your game play scores.

We also store Facebook and Google Plus public profiles when you choose to authenticate yourself for the purposes of posting comments in our Properties (whenever the feature exists and is available), or for saving your personal data. In this instance, your previous gaming results (when applicable) are stored as well.

Any comments you post on our websites and apps are also collected. These identify your name, your profession, and your specialty, but no other personal details.

We also store a record of your visits in our server logs. These server logs typically include:

• your web request,
• IP address,
• browser type,
• browser language, and
• the date and time of your request.

As stated in our privacy policies, we collect and further process anonymized information, data with no personally identifiable information which can be used to trace its source so that the people whom it describes can remain anonymous.

Under the GDPR’s Article 11, such data is not subject to the same treatment as is personal data, particularly with regards to any desire you might have for accessing it, rectifying it or erasing it.

That said, the anonymized data we collect and further process is limited to the following:

• data on how you perform on our downloaded gaming app products; and
• your mobile device’s metadata, including:
  • device type,
  • device operating system,
  • device’s total RAM (where applicable),
  • Medical Joyworks product version installed on the device,
  • Stack trace (in case of crash),
  • MoPub-specific identifier or device IP address (where applicable),
  • iOS identifier for Advertising (where applicable), and
  • Android Advertising ID (where applicable).

We also generate an anonymous mobile device token to send to your mobile device push notifications when any new content is released via a downloaded gaming app product. This mobile token is created and managed by your mobile device’s operating system; and processed by a specialist third party provider.

Furthermore,

We are also very candid in stating that we do not release this user data to any third parties, for any reason, unless we are required to by law.

Whenever you install any of our downloaded mobile products and services, or visit any of our web products and services, you are first asked to review and accept the terms of service we spell out for their use. The terms of service list detailed explanations regarding the personal and anonymized data we may collect and process, when this is done, and how.

Personal data is collected any time you decide to complete a registration survey we make available through our products and services. Anonymized data is collected any time you use our products and services.

Access to all data is done solely via the automated processes and systems we have created and procured from third parties; and control over these processes and systems is restricted to Medical Joyworks team members and third parties tasked with designing, maintaining and upgrading them. Said team members, and their supervisors, are accountable for any work performed on the automated processes, as well as the purposes for which said data may be used.

Below is an outline detailing all of the parties involved in the collection and processing of personal and anonymous data as part of the processing activities essential to the running of our Properties:

Whenever a third party is supplying a system essential for processing personal data and anonymous data, we receive contractual assurances from them stating that they comply with any necessary operational and legal requirements as stipulated EU, US and other pertinent local and international laws.

We do not release any of your personally identifiable data to any third parties, for any reason unless we believe that we are required to by law.

While our websites and apps are free of charge, our services are supported by advertising; and for this, we only disclose anonymized information.

This is something we clearly state this in the privacy policies of all our products and services:

Chapter III of the GDPR (spanning Articles 12 through 23) provides a detailed listing of all your personal data privacy rights.

We present you a detailed outline below:

• You have the right to receive transparent information from us, in order to exercise your rights.
• We are obliged to act without delay (and within one month) upon receiving a request for information from you. Please note, this one month period can be extended by a further two months where necessary, depending on the complexity and number of requests we receive from users like you. When this happens, though, we are obliged to inform you of the extension and the reasons for it.
• We are obliged to inform you without delay (and also within one month) of the reasons for not taking any action, if we do not take action on your request for information.
• You have the right to lodge a complaint with the supervisory authority in your country if you are not satisfied with our response in relation to your request for information.
• We are obliged to provide you with information regarding your request, free of charge. However, if your request is unfounded or excessive, or repetitive, we are within our right to charge you a reasonable fee for administrative costs; or simply refuse to act on your request.
• We are obliged to prove that your request for information is unfounded or excessive, or repetitive, should we believe it to be the case.

• At the time when we collect your personal data, we are obliged to provide you the following information:
  • our identity and contact details and, where applicable, those of our representative;
  • the contact details of our data protection officer, where applicable;
  • the purposes of the processing for which your personal data are intended as well as the legal basis for the processing;
  • where the processing is based on legitimate interests, the legitimate interests pursued by us, or by any third party collecting your personal data on our behalf;
  • the recipients or categories of recipients of your personal data, if any;
  • where applicable, the fact that we intend to transfer your personal data to a third country or international organisation, and the existence or absence of an adequacy decision by the European Commission for this activity;
  • the period for which your personal data will be stored or, if that is not possible, tźhe criteria used to determine said period;
  • the existence of your right to request to us:
    • access to your personal data,
    • rectification or erasure of your personal data,
    • a restriction of processing concerning your personal data,
    • to object to processing your personal data,
    • portability of your personal data;
  • the existence of your right to withdraw consent for collecting and further processing your personal data at any time;
  • the existence of your right to lodge a complaint with a supervisory authority;
  • whether the provision of personal data is a statutory or contractual requirement, or is a requirement necessary to enter into a contract, as well as whether you are obliged to provide your personal data and of the possible consequences of failure to provide such data; and
  • the existence of automated decision-making mechanisms, including profiling; and, if so, meaningful information about the logic involved, and the significance and the envisaged consequences of said automated processing for you.
• We are obliged to provide you with information on any intention to further process your personal data for a purpose other than that for which your personal data were obtained, as well as any relevant further information (as previously described), all prior to our our further processing of your personal data.

• When your personal data are not collected from you, we are obliged to provide you with the information listed in Article 13, as well as the following information:
  • the categories of personal data not obtained from you;
  • the recipients or categories of recipients of your personal data not obtained from you, if any; and
  • from which source your personal data originate and, if applicable, whether it came from publicly accessible sources.
• Additionally, we are obliged to provide you all of the above-listed information:
  • within a reasonable period after obtaining your personal data, but at the latest within one month, having regard to the specific circumstances in which your personal data are processed;
  • even if your personal data are to be used for communicating to you, at the latest at the time of our first communication to you; and
  • if we envisage the disclosure of your personal data to another recipient, at the latest when your personal data are first disclosed.

• You have the right to obtain from us confirmation as to whether or not your personal data are being processed; and, where that is the case, access to the following information:
  • our purposes of the processing;
  • the categories of personal data concerned;
  • the recipients or categories of recipient to whom we have or will be disclosing your personal data, in particular recipients in third countries or international organisations;
  • where possible, the envisaged period for which we will store your personal data, or, if not possible, our criteria used to determine that period;
  • the existence of your right to request from us:
    • rectification or erasure of your personal data,
    • a restriction of processing concerning your personal data,
    • to object to processing your personal data;
  • the existence of your right to lodge a complaint with a supervisory authority;
  • where the personal data are not collected from you, any available information as to their source; and
  • the existence of automated decision-making mechanisms, including profiling and, if so, meaningful information about the logic involved, and the significance and the envisaged consequences of said automated processing for you.
• You have the right to be informed of the appropriate safeguards we take whenever we transfer your personal data to a third country or to an international organization.
• We are obliged to provide you with a copy of your personal data that is undergoing processing, free of charge. However, if you require further copies we have the right charge a reasonable fee based on administrative costs.

• You have the right to obtain from us, without undue delay, the rectification of any inaccurate personal data by providing a supplementary statement.
• You have the right to have incomplete personal data completed by providing a supplementary statement, provided that you take into account our purposes of the processing of your personal data.

• You have the right to obtain from us, without undue delay, the erasure of personal data when one of the following applies:
  • your personal data are no longer necessary in relation to the purposes for which we collected them or otherwise processed them;
  • you withdraw consent on which our processing is based, and where there is no other legal ground for our processing;
  • you object to our processing, and there are no overriding legitimate grounds for our processing, or you object to our processing pursuant to your right to object; or
  • your personal data have to be erased for compliance with a legal obligation in Union or Member State law to which we are subject.
• If we have made your personal data public, and are obliged to erase your personal data upon your request, we are obliged to take reasonable steps, including technical measures, to inform other controllers which are processing your personal data that you have requested the erasure by such controllers of any links to, or copy or replication of, those personal data.

• You have the right to obtain a restriction of processing of your personal data when one of the following applies:
  • you disagree and contest the accuracy of your personal data, during a period of time necessary for us to verify the accuracy of your personal data;
  • our processing is unlawful in some way, and you oppose the erasure of your personal data and request the restriction of their use instead;
  • we no longer need your personal data for the purposes of the processing, but they are required by you for the establishment, exercise or defense of a legal claim; or
  • you have objected to processing pursuant to your right to object, and are pending the verification whether our legitimate grounds override yours.
• When processing of your personal data has been restricted, we are obliged to only process your personal data:
  • with your consent; or
  • for the establishment, exercise or defense of legal claims; or
  • for the protection of the rights of another natural or legal person.
• When lifting a restriction of processing of your personal data, we are obliged to inform you before said restriction is lifted.

• We are obliged to communicate any rectification or erasure of your personal data or restriction of processing carried out to each recipient to whom your personal data have been disclosed, unless this proves impossible or involves disproportionate effort.
• We are obliged to inform you about those recipients, should you request it.

• You have the right to receive your personal data, which you have provided to us, in a structured, commonly used and machine-readable format.
• You have the right to transmit your personal data to another controller without hindrance from us where:
  • the processing is based on your consent, as provided under the legal basis by which we can process your personal data; and
  • the processing is carried out by automated means.
• You have the right to have your personal data transmitted directly from one controller to another, where technically feasible.
• You have the right to exercise your right to data portability without it affecting your to right to erasure (or “right to be forgotten”).

• You have the right to object, on grounds relating to your particular situation, at any time, to processing of your personal data which is based on the legal bases by which we can process your personal data, including profiling based said legal basis. Here, we are obliged to no longer process your personal data unless we demonstrate compelling legitimate grounds for the processing which override your interests, rights and freedoms or for the establishment, exercise or defence of legal claims.
• You have the right to object at any time to the processing of your personal data for direct marketing purposes, which includes profiling to the extent that it is related to such direct marketing.
• We are obliged to no longer process your personal data for marketing purposes when you object to it.
• We are obliged to explicitly bring to your attention your right to object, including your right to object to the processing of your personal data for direct marketing purposes, in a clearly presented way, and separate from any other information, at latest by the time of our first communication with you.
• You have the right to object, when your personal data are processed for scientific or historical purposes, or statistical purposes.

• You have the right to not be subject to a decision based solely on automated processing, including profiling, which produces legal effects concerning you, or which significantly affects you. The above-mentioned right does not apply when:
  • the decision is necessary for entering into, or performance of, a contract between you and us, or
  • it is authorized by European Union or Member State law to which we may be subject; or
  • it is based on your explicit consent.
• When the above-mentioned right does not apply, we are obliged to implement:
  • suitable measures to safeguard your rights and freedoms and legitimate interests;
  • your right to obtain human intervention on our part; and
  • your right to express your point of view and to contest the decision.

Please be advised, Article 23 of your rights states that European Union or Member State law to which we are subject may restrict the scope of your rights and our obligations provided for in Articles 12 through 22.

Should any such restriction occur, we will do our best to notify you accordingly.

Your rights are our priority, and we strive to ensure them at all times.

There are many ways by which you can exercise your rights, depending on the personal data we may collecting and further processing.

For mobile Properties, you can manage your data options by:

• Opting in/out through your mobile device’s own device/app settings
• Choosing to not use our mobile Properties

For web Properties, you can manage your data options by:

• Opt-in/out by declining any request to use cookies, manually configuring your browser’s cookie settings, or by installing browser appropriate add-ons (such as the Google Analytics opt-out browser add on, available at https://support.google.com/analytics/answer/181881?hl=en
• Choosing to not use our web Properties

However, and as stated in the Privacy Policy of our products and services: