Medical Joyworks takes considerable care of respecting the personal data privacy of all our users, irrespective of race, nationality, ethnic origin, sex, age, sexual orientation, political affiliation, religious beliefs, or any other means of categorization. For this reason, we have decided to adopt the European Union General Data Protection Regulation, or GDPR (Regulation (EU) 2016/679) for all of our users, globally.

The GDPR was enacted by the European Union and is intended to enhance the protection of natural persons with regards to the processing of their personal data. The GDPR does this by replacing the Union’s existing Data Protection Directive 95/46/EC and harmonizing the different data privacy laws in effect across the EU’s Member States.

Under the GDPR, processing means: ANY OPERATION OR SET OF OPERATIONS WHICH IS PERFORMED ON PERSONAL DATA OR ON SETS OF PERSONAL DATA, WHETHER OR NOT BY AUTOMATED MEANS, SUCH AS COLLECTION, RECORDING, ORGANIZATION, STRUCTURING, STORAGE, ADAPTATION OR ALTERATION, RETRIEVAL, CONSULTATION, USE, DISCLOSURE BY TRANSMISSION, DISSEMINATION OR OTHERWISE MAKING AVAILABLE, ALIGNMENT OR COMBINATION, RESTRICTION, ERASURE OR DESTRUCTION.

Consent

Any and all personal data we collect and further process from you will be done solely with your consent.

Consent means giving us permission to process your personal data specifically for the purposes identified. Consent is required for Medical Joyworks, LLC to process your personal data, but it must be explicitly given.

You may withdraw consent at any time by writing to us at: privacy@medicaljoyworks.com, or opt to not consent whenever requested by us through our Properties (the websites or applications owned by Medical Joyworks).

• when you begin using any of our Properties for the first time,
• when the purpose for collecting and further processing your personal data has changed from its original intent in any way, or
• when the means by which we are collecting and further processing your personal data have changed from its original approach.

Personal data we collect directly from you

• your name,
• your email,
• your specialty,
• your profession,
• your place of work,
• your favorite cases or scenarios, and
• your game play scores.

We also store Facebook and Google Plus public profiles when you choose to authenticate yourself for the purposes of posting comments in our Properties (whenever the feature exists and is available), or for saving your personal data. In this instance, your previous gaming results (when applicable) are stored as well.

Any comments you post on our Properties are also collected. These identify your name, your profession, and your specialty, but no other personal details.

• your web request,
• IP address,
• browser type,
• browser language, and
• the date and time of your request.

Personal data we may receive about you from Third Parties during a product or a service provision event

In addition to the information you provide us with, we may also receive information about you from our clients. This typically occurs when the client has a contractual relationship with you, be it for employment or educational purposes.

Some of our products and services may involve you as an institutional administrator providing details of other people. If you do provide details of other people to us, you should first inform them that you will be disclosing their information to us and ensure you have their informed consent to allow you to disclose their information to us.

In the event that we have contacted you as a result of a request to provide feedback as service provision, we can confirm that the data you provide will be used according to this Privacy Policy.

• when we have asked for your consent to process your personal data for one or more specific reasons, at the moment when you enter into any relationship with us and at the moment when the data is collected, or within a reasonable period of time;
• when we believe that the processing of your personal data is necessary for complying with several legal obligations to which we are subject; and
• when we believe that the processing of your personal data is necessary because we have a legitimate interests in:
  • personalizing your experience whenever you use our products and services;
  • authenticating you for the purposes of you using certain social media/user community features within our products and services;
  • improving our existing products and services to better match with your needs;
  • developing new products and services that match your needs; and
  • marketing new and existing products and services to you;
• when, to the best of our knowledge, the previously-stated legitimate interests are not overridden by your own fundamental rights and freedoms as stipulated by EU law.

Email

With your consent, Medical Joyworks collects your email for the sole purpose of informing you:

• when there are important updates to the Properties;
• when Medical Joyworks releases other Properties, products or services which might be relevant to you; and
• any other important information related to Medical Joyworks or its Properties.

Medical Joyworks agrees not to spam you or disclose your email address to third parties without your consent.

Specialty, Profession and Place of Work

Medical Joyworks’s Properties are free services supported by advertising. Therefore, with your consent, Medical Joyworks anonymizes your specialty, profession, and place of work, and discloses and/or transmits these anonymized data to our advertising platform partners.

By anonymization of data, we mean an internal process by which user data is collected in a way that no personally identifiable information can be used to trace its source so that the people whom it describes can remain anonymous.

With your consent, Medical Joyworks also uses your specialty, profession, and place of work for analysis, to better determine what products, services and features we can offer you now and in the future.

Medical Joyworks agrees to always anonymize and not to disclose and/or transmit personally identifiable information, such as your name or email, to third parties without your consent.

Favorite cases or scenarios, and game play scores

With your consent, Medical Joyworks uses your favorite cases or scenarios, and game play scores so that you do not lose your progress when using our Properties over time.

Medical Joyworks agrees to not disclose your favorite cases or scenarios, and game play scores, to third parties without your consent.

Social Media Login

With your consent, Medical Joyworks may require you to log in to the Properties via Social Media Logins such as but not limited to Facebook or Google Plus for purposes of posting comments and/or authenticating your identity.

Medical Joyworks agrees not to disclose your Facebook, Google Plus, or other Social Media Login information to third parties without your consent.

Comments

You may choose to post comments on our Properties, wherever the feature allowing for posting of comments exists. When this is the case, you will have to consent that the comments you post on the Properties will be transmitted to Medical Joyworks’s servers and distributed to other users on the Properties.

With your consent, your comments will identify your name, your profession, and your specialty, but no other personal details.

Records of visits

With your consent, we store this data to improve our services, identify and diagnose configuration or other issues with our server setup, and to maintain the security of our systems against malign attacks.

Performance data

With your consent, anonymized performance data is collected and further processed to perform tasks essential to the running of our Properties, such as:

• to improve our mobile and web products’s technology and overall performance;
• see the number of visitors, measure usage and popularity across our web sites;
• serve ads and calculate the number of ad impressions we display across our mobile products;
• identify means by which we can improve the overall user experience; and
• send push notifications to our mobile products informing you of new in-app content releases.

With your consent, we also generate an anonymous mobile device token to send to your mobile device push notifications when any new content is released via a downloaded gaming app product. This mobile token is created and managed by your mobile device’s operating system; and processed by a specialist third party provider.

Medical Joyworks will not collect or transmit any other personal information from the devices you use to access the Properties without your consent.

Notwithstanding the foregoing, you agree that Medical Joyworks may disclose your information, including, but not limited to, your name, email, or Facebook or Google Plus information, to a third party if Medical Joyworks believes in good faith that the law or legal process requires it, to protect the rights or property of Medical Joyworks or others, or as otherwise described in the Privacy Policy.

Other uses we may give to your personal data

• to process your registration to our services;
• to fulfil any orders you make for our products and/or services;
• to provide you with customised questionnaires and applications;
• to process questionnaires and create reports;
• to carry out our obligations arising from any contracts entered into between you and us;
• to research and improve our services;
• to support our:
  • security,
  • administration,
  • testing of our systems,
  • billing processes,
  • accounting,
  • credit card checks,
  • maintaining our systems,
  • providing customer service,
  • enforcing and/or defending our legal rights and developing our products;
• to deal with your requests and enquiries whether directed at us or our service-delivery contractors;
• to track activity on our Properties;
• to comply with legal, statutory and/or regulatory obligations; and
• to administer our Properties which may involve sharing information with our network providers.

Collection and processing of personal data

Your personal data is collected by Medical Joyworks and, where necessary, by essential third parties. Moreover, only we further process your personal data.

Collection and processing of anonymized data

Medical Joyworks uses multiple third parties to collect, analyze, and use anonymized data on how you perform on its Properties.

• data on how you perform on our downloaded gaming app products; and
• your mobile device’s metadata, including:
  • device type,
  • device operating system,
  • device’s total RAM (where applicable),
  • Medical Joyworks product version installed on the device,
  • stack trace (in case of a crash),
  • MoPub-specific identifier or device IP address (where applicable),
  • iOS identifier for Advertising (where applicable), and
  • Android Advertising ID (where applicable).

Cookies

We use strictly necessary and optional cookies on our Properties.

Cookies are software applications which are placed onto the hard drive of your computer by websites. The aim of a cookie is to track a user's navigation of the Property and store the information onto the user's hard drive. This information should make your website visits more productive by storing and using information on your website preferences and habits. Whilst cookies do not identify users personally, they do identify each user's computer.

Your browser software and mobile device operating system can choose whether or not to accept cookies and most browser software and mobile devices are initially set up to accept them. You should read the information that came with your browser software and mobile device to see how you can set up your browser to notify you when cookies are used. This will give you an opportunity to either accept or refuse the cookies.

Further information on cookies and how you can refuse them is provided by the Interactive Advertising Bureau on its website located at www.allaboutcookies.org. Please note that you may not be able to use all the features of our Properties if strictly necessary cookies are disabled.

Data Protection

We will process any personal data that you may submit to us through our Properties in a secure way, and will do our best to ensure that any third party or subcontractor we may engage to provide the services requested by you acts in such manner.

We may from time to time process your personal data using third parties located in countries outside of the European Economic Area, and some of these do not have strict data protection laws. When we do use third parties, these parties are bound by the terms of Medical Joyworks, LLC’s Privacy Policy. We are committed to ensuring the safety and security of your data and will use our best endeavours to ensure your data is handled in accordance with this Privacy Policy.

Data Security

We will endeavour to take all reasonable steps to protect your information. However, we cannot guarantee the security of any information you disclose online. You accept the inherent security risks of providing information and dealing online over the internet and you will not hold us responsible for any breach of security unless due to our negligence or wilful default.

You are not permitted to create a link to our Properties without our prior written consent. Once we receive your information, it will be stored on our secure servers where data is regularly backed-up and encrypted.

Our Properties contain links to third parties such as our partners, clients, other websites/networks and external web services (such as Facebook and YouTube). If you go to these websites/networks or use these external services, please be aware that such usage will be governed by the third parties’ own privacy policies. We cannot prevent such third parties collecting information on you. We are not liable for any of these third parties’ activities.

Collection and further processing summary

Below is an outline detailing all of parties involved in the collection and processing of personal and anonymous data as part of the processing activities essential to the running of our Properties

The information you provide and our processed versions of it are kept for as long as is required for the specific purpose it was collected for.

Information will be deleted if we consider it is no longer appropriate to keep it, or if you choose to exercise any of your personal data rights as outlined in the following section.

The GDPR provides a detailed listing of all your personal data privacy rights, which you may exercise at any time throughout the use our Properties.

We present you a detailed outline below:

Your right to transparent information, communication and the modalities by which you can exercise your rights

• You have the right to receive transparent information from us, in order to exercise your rights.
• We are obliged to act without delay (and within one month) upon receiving a request for information from you. Please note, this one month period can be extended by a further two months where necessary, depending on the complexity and number of requests we receive from users like you. When this happens, though, we are obliged to inform you of the extension and the reasons for it.
• We are obliged to inform you without delay (and also within one month) of the reasons for not taking any action, if we do not take action on your request for information.
• You have the right to lodge a complaint with the supervisory authority in your country if you are not satisfied with our response in relation to your request for information.
• We are obliged to provide you with information regarding your request, free of charge. However, if your request is unfounded or excessive, or repetitive, we are within our right to charge you a reasonable fee for administrative costs; or simply refuse to act on your request.
• We are obliged to prove that your request for information is unfounded or excessive, or repetitive, should we believe it to be the case.

Your right to information being provided when personal data are collected from you

• At the time when we collect your personal data, we are obliged to provide you the following information:
  • our identity and contact details and, where applicable, those of our representative;
  • the contact details of our data protection officer, where applicable;
  • the purposes of the processing for which your personal data are intended as well as the legal basis for the processing;
  • where the processing is based on legitimate interests, the legitimate interests pursued by us, or by any third party collecting your personal data on our behalf;
  • the recipients or categories of recipients of your personal data, if any;
  • where applicable, the fact that we intend to transfer your personal data to a third country or international organisation, and the existence or absence of an adequacy decision by the European Commission for this activity;
  • the period for which your personal data will be stored or, if that is not possible, tźhe criteria used to determine said period;
  • the existence of your right to request to us:
    • access to your personal data,
    • rectification or erasure of your personal data,
    • a restriction of processing concerning your personal data,
    • to object to processing your personal data,
    • portability of your personal data;
  • the existence of your right to withdraw consent for collecting and further processing your personal data at any time;
  • the existence of your right to lodge a complaint with a supervisory authority;
  • whether the provision of personal data is a statutory or contractual requirement, or is a requirement necessary to enter into a contract, as well as whether you are obliged to provide your personal data and of the possible consequences of failure to provide such data; and
  • the existence of automated decision-making mechanisms, including profiling; and, if so, meaningful information about the logic involved, and the significance and the envisaged consequences of said automated processing for you.
• We are obliged to provide you with information on any intention to further process your personal data for a purpose other than that for which your personal data were obtained, as well as any relevant further information (as previously described), all prior to our our further processing of your personal data.

Your right to information being provided when your personal data are not collected from you

• When your personal data are not collected from you, we are obliged to provide you with the information listed in Article 13, as well as the following information:
  • the categories of personal data not obtained from you;
  • the recipients or categories of recipients of your personal data not obtained from you, if any; and
  • from which source your personal data originate and, if applicable, whether it came from publicly accessible sources.
• Additionally, we are obliged to provide you all of the above-listed information:
  • within a reasonable period after obtaining your personal data, but at the latest within one month, having regard to the specific circumstances in which your personal data are processed;
  • even if your personal data are to be used for communicating to you, at the latest at the time of our first communication to you; and
  • if we envisage the disclosure of your personal data to another recipient, at the latest when your personal data are first disclosed.

Your right to access your personal data

• You have the right to obtain from us confirmation as to whether or not your personal data are being processed; and, where that is the case, access to the following information:
  • our purposes of the processing;
  • the categories of personal data concerned;
  • the recipients or categories of recipient to whom we have or will be disclosing your personal data, in particular recipients in third countries or international organisations;
  • where possible, the envisaged period for which we will store your personal data, or, if not possible, our criteria used to determine that period;
  • the existence of your right to request from us:
    • rectification or erasure of your personal data,
    • a restriction of processing concerning your personal data,
    • to object to processing your personal data;
  • the existence of your right to lodge a complaint with a supervisory authority;
  • where the personal data are not collected from you, any available information as to their source; and
  • the existence of automated decision-making mechanisms, including profiling and, if so, meaningful information about the logic involved, and the significance and the envisaged consequences of said automated processing for you.
• You have the right to be informed of the appropriate safeguards we take whenever we transfer your personal data to a third country or to an international organization.
• We are obliged to provide you with a copy of your personal data that is undergoing processing, free of charge. However, if you require further copies we have the right charge a reasonable fee based on administrative costs.

Your right to rectify your personal data

• You have the right to obtain from us, without undue delay, the rectification of any inaccurate personal data by providing a supplementary statement.
• You have the right to have incomplete personal data completed by providing a supplementary statement, provided that you take into account our purposes of the processing of your personal data.

Your right to erasure, or the “right to be forgotten”

• You have the right to obtain from us, without undue delay, the erasure of personal data when one of the following applies:
  • your personal data are no longer necessary in relation to the purposes for which we collected them or otherwise processed them;
  • you withdraw consent on which our processing is based, and where there is no other legal ground for our processing;
  • you object to our processing, and there are no overriding legitimate grounds for our processing, or you object to our processing pursuant to your right to object; or
  • your personal data have to be erased for compliance with a legal obligation in Union or Member State law to which we are subject.
• If we have made your personal data public, and are obliged to erase your personal data upon your request, we are obliged to take reasonable steps, including technical measures, to inform other controllers which are processing your personal data that you have requested the erasure by such controllers of any links to, or copy or replication of, those personal data.

Your right to restrict the processing of your data

• You have the right to obtain a restriction of processing of your personal data when one of the following applies:
  • you disagree and contest the accuracy of your personal data, during a period of time necessary for us to verify the accuracy of your personal data;
  • our processing is unlawful in some way, and you oppose the erasure of your personal data and request the restriction of their use instead;
  • we no longer need your personal data for the purposes of the processing, but they are required by you for the establishment, exercise or defense of a legal claim; or
  • you have objected to processing pursuant to your right to object, and are pending the verification whether our legitimate grounds override yours.
• When processing of your personal data has been restricted, we are obliged to only process your personal data:
  • with your consent; or
  • for the establishment, exercise or defense of legal claims; or
  • for the protection of the rights of another natural or legal person.
• When lifting a restriction of processing of your personal data, we are obliged to inform you before said restriction is lifted.

Your right to being notified about the rectification or erasure of your personal data, or a restriction of processing

• We are obliged to communicate any rectification or erasure of your personal data or restriction of processing carried out to each recipient to whom your personal data have been disclosed, unless this proves impossible or involves disproportionate effort.
• We are obliged to inform you about those recipients, should you request it.

Your right to data portability

• You have the right to receive your personal data, which you have provided to us, in a structured, commonly used and machine-readable format.
• You have the right to transmit your personal data to another controller without hindrance from us where:
  • the processing is based on your consent, as provided under the legal basis by which we can process your personal data; and
  • the processing is carried out by automated means.
• You have the right to have your personal data transmitted directly from one controller to another, where technically feasible.
• You have the right to exercise your right to data portability without it affecting your to right to erasure (or “right to be forgotten”).

Your right to object, and with regards to automated decision-making

• You have the right to object, on grounds relating to your particular situation, at any time, to processing of your personal data which is based on the legal bases by which we can process your personal data, including profiling based said legal basis. Here, we are obliged to no longer process your personal data unless we demonstrate compelling legitimate grounds for the processing which override your interests, rights and freedoms or for the establishment, exercise or defence of legal claims.
• You have the right to object at any time to the processing of your personal data for direct marketing purposes, which includes profiling to the extent that it is related to such direct marketing.
• We are obliged to no longer process your personal data for marketing purposes when you object to it.
• We are obliged to explicitly bring to your attention your right to object, including your right to object to the processing of your personal data for direct marketing purposes, in a clearly presented way, and separate from any other information, at latest by the time of our first communication with you.
• You have the right to object, when your personal data are processed for scientific or historical purposes, or statistical purposes.

Your right with regards to automated individual decision-making, including profiling

• You have the right to not be subject to a decision based solely on automated processing, including profiling, which produces legal effects concerning you, or which significantly affects you. The above-mentioned right does not apply when:
  • the decision is necessary for entering into, or performance of, a contract between you and us, or
  • it is authorized by European Union or Member State law to which we may be subject; or
  • it is based on your explicit consent.
• When the above-mentioned right does not apply, we are obliged to implement:
  • suitable measures to safeguard your rights and freedoms and legitimate interests;
  • your right to obtain human intervention on our part; and
  • your right to express your point of view and to contest the decision.

Restrictions to your rights under GDPR

Please be advised, European Union or Member State law to which we are subject may restrict the scope of all of your above-listed rights and our obligations provided for.

Should any such restriction occur, we will do our best to notify you accordingly.