MOBILE APPLICATION AND WEBSITE PRIVACY POLICY

The READYorNot™ e-Health Mobile Application (the "App") and the READYorNot™ e-Health website (the "Site") are owned by and operated for The Research Institute of the McGill University Health Centre and its Partners (the "Research Institute", "we" or "us").

The Research Institute is committed to protecting the Personal Information (as defined below) with which you entrust us. The Research Institute takes this responsibility seriously. The Research Institute is committed to collecting, maintaining, and securing Personal Information about you, in accordance with this Privacy Policy ("Policy") and our values of transparency, accessibility, sanity and usability.

This Privacy Policy applies to Personal Information collected through the App and the Site. This Policy does not apply to Personal Information collected from offline resources, except in cases where such Personal Information is consolidated with Personal Information collected by the Research Institute online.

This Policy does not apply to the collection, storage or use of Personal Information by third parties or to the disclosure of Personal Information by Users to third parties whether via the App, the Site or otherwise. The Research Institute and its Partners shall bear no liability for such collection, storage, use or disclosure of Personal Information.

BY ACCESSING OR USING THE APP AND/OR THE SITE, YOU AGREE TO BE BOUND BY THE TERMS SET OUT IN THIS POLICY. IF YOU DO NOT AGREE, YOU MAY NOT ACCESS OR USE THE APP OR THE SITE.

While you may refuse to provide Personal Information to the Research Institute, certain information about you is required to create your profile and to use certain features on the Site or in the App.

I. Definitions.

"Cookie" means a data file that is sent by web servers to your computer's hard drive, where your internet browser files are kept. Cookies enable websites to store bits of information on your computer and retrieve that information at a later time. The Research Institute uses two types of cookies: session cookies, which are temporary cookies that are erased from your computer's memory when you close your internet browser or turn your computer off, and persistent cookies, which exist on your computer's hard drive until they expire, unless you delete them at an earlier time.

"Partner" means any person or entity with whom the Research Institute collaborates in order to provide Services to Users, including, without limitation, service providers.

"Personal Information" means any information that identifies an individual or allows an individual to be identified, including, without limitation, name, nickname, research number, sex, contact information (including telephone number and email address), demographic information (such as preferences and interests), medical health condition and description, management of such condition, medication(s) taken, name of physician, medical appointments, results of surveys, feedback on use of the App or Site, and any other information submitted while using the App or the Site.

"Project" means the READYorNot™ Congenital Heart Disease (CHD) Project.

"Research Team" means investigators and other researchers involved in Project.

"Service" means the services provided by the Research Institute through the App or the Site, including, without limitation, customized educational and coaching content, tailored coaching sessions and video testimonials, as well as coaching and communication tools (such as gaming, messaging/reminders/notifications, a virtual companion, etc.).

"User" or "you" means any person who creates a profile on the App or in the Site, as well as any person who visits or uses the App or the Site, including, without limitation, the young person preparing for transition from pediatric to adult care who is the intended beneficiary of the Services and his or her parent or legal guardian. Although the young person may be submitting the personal information, the Research Institute must obtain the parent or legal guardian's consent to the Website and App Terms of Use and Privacy Policy (including the collection, use and disclosure of his or her child's personal information pursuant to this Privacy Policy) since the young person is unlikely to have the capacity to provide an enlightened consent given his or her medical condition.

II. Accountability.

The Research Institute is responsible for Personal Information in its possession or custody, including information that may be transferred to a Partner for processing. The Research Institute will therefore use contractual and/or other means to provide a comparable level of protection for Personal Information processed by a Partner.

III. Identifying Purposes.

The Research Institute collect Personal Information as necessary to enable individuals to register for, customize and personalize certain online resources offered through the App or the Site and to access Services and features offered online or through the App.

IV. Use of Personal Information.

The Research Institute and its Partners may use your Personal Information to create your profile on the App or the Site, to provide you with the Services, to respond to feedback, to provide technical support and assistance, to improve and optimize the App and Site, and as otherwise permitted by law.

The Research Institute and its Partners will also use your Personal Information to create de-identified reports to be used and analyzed by the Research Team for the purposes of the Project.

The Research Team will not have access to your Personal Information, but only to the non-personal information, for the purpose of the Project, except for the members of the Research Team at your health institution, who will have access to the code linking your name and the research number attributed to you.

V. Consent.

Users' knowledge and consent are required for the collection, use or disclosure of Personal Information about them. If a User provides Personal Information in forms or data fields in the App or on the Site, such User consents to the collection, use and disclosure of Personal Information according to the terms of this Policy.

VI. Tracking.

The Research Institute may use tracking technologies (such as Google Analytics) to automatically collect certain non-personal information regarding Users, such as the Internet Protocol (IP) address of your computer, the IP address of your Internet service provider, the type of mobile device that you use, the date and time you access the App or the Site, the operating system you are using, the Internet address of the website from which you linked directly to the Site, and the sections of the App or the Site that you use. This non-personal information is used for App, Site and system administration purposes, to improve the App and the Site and for security purposes. Your non-personal information may be disclosed to others and permanently archived for future use.

The Research Institute may use non-personal information to create aggregate tracking information reports regarding User demographics and Site traffic patterns. None of the tracking information in the reports can be connected to the identities or other Personal Information of individual Users. The Research Institute also may link tracking information with Users' Personal Information, but generally only after you have provided Personal Information to us in the App or on the Site, or where you have created a profile to use the App or the Site by providing a User ID and password. Once such a link is made, all of the linked information is treated as Personal Information and will be used and disclosed only in accordance with this Policy, and in accordance with the law. The Research Institute may use tracking technologies to remember your personal preferences and selections, such as Personal Information that you have entered into data fields in the App or on the Site, answers that you have provided in response to surveys, or sections of the App or the Site that you visit frequently.

Individual Users can control the use of certain tracking technologies, such as Cookies, through most internet browsers. Some internet browsers enable you to limit or disable the use of Cookies for individual websites. Other browsers allow you to select Cookie settings for all websites that you visit. If you limit or disable Cookies, certain functions of the App or the Site may not work properly, including access to some registration-based portions of the App or the Site.

VII. Limiting Collection.

The Research Institute limits the collection of Personal Information to that which is necessary for the full delivery of the Services and the Project by the Research Institute and the tracking of User progress.

VIII. Limiting Use, Disclosure, and Retention.

The Research Institute uses Personal Information only for the identified purposes for which it was collected or as otherwise permitted or required by law.

Personal Information about you will be accessible to the Research Institute and its Partners for use solely for and at the direction of the Research Institute or for the purposes of the Project. Personal Information about you will only be used, stored and disclosed in a manner consistent with this Policy, at all times.

Personal Information will be accessed, used and disclosed on a need-to-know basis, and will be retained only as long as necessary to fulfill its identified purposes or in accordance with applicable laws and/or the Research Institute's policies. Personal Information that is no longer required to fulfill the identified purposes will be securely destroyed, erased, or made anonymous.

In order to ensure your protection and quality control of the Project, the following organization could consult your Personal Information: (a) Government regulatory bodies, such as Health Canada; and (b) the research ethics committees of the health institutions where the research is taking place; or (c) a person mandated by one of the foregoing.

The Research Institute may be required to disclose Personal Information to government authorities or law enforcement officials, wheresoever situated that have asserted their lawful authority to obtain the information or where the Research Institute has reasonable grounds to believe the information could be useful in the investigation of unlawful activity, or to comply with a subpoena, a warrant or an order made by a court, person or body with jurisdiction to compel the production of information, or to comply with court rules regarding the production of records and information, or to protect the Research Institute's rights and property, or to defend against legal claims, or as otherwise required by law or legal process. If the Research Institute or its Partners are involved in a merger or other reorganization or all or substantially all of their assets are sold, your Personal Information may be disclosed to the resulting organization or the acquiring organization. Personal Information provided to Partners in accordance with the terms set forth above may also be disclosed by such Partners to government authorities or law enforcement officials in the foregoing circumstances. The Research Institute may also disclose your Personal Information as otherwise permitted or required by law.

The Research Institute and its Research Team may publish, present or otherwise disclose the results of the research conducted within the context of the Project, but in so doing will not disclose any Personal Information, only statistical, aggregate and/or anonymous non-personal information. For these purposes, your identity will be protected, notably by replacing your name with a research number, which shall be linked to you using a code known only to the members of the Research Team at your health institution.

IX. Accuracy.

The Research Institute will rely upon Users to provide accurate and complete information and to inform The Research Institute if their Personal Information changes, in whole or in part, from time to time.

X. Safeguard.

The security safeguards will be implemented by the Research Institute with the intent to protect Personal Information against loss or theft, as well as unauthorized access, disclosure, copying, use, or modification.

The nature of the safeguards will vary depending on the sensitivity of the information that has been collected, the amount, distribution, and format of the Personal Information, and the method of storage. The methods of protection may include physical measures (for example, locked filing cabinets and restricted access to offices), organizational measures (for example, security clearances and limiting access to a "need-to-know" basis) and technological measures (for example, the use of passwords and encryption).

Care will be used in the disposal and destruction of Personal Information, to prevent unauthorized parties from gaining access to any Personal Information.

The security of your Personal Information also depends on you. Never share your password with anyone else and notify us immediately if you believe that your password security has been breached.

XI. Transparency.

Personal Information is principally kept at RootQuotient-Amazon dedicated servers located in Canada. Personal Information provided to Partners in accordance with this Policy may be located elsewhere.

XII. Individual Access and Rectification.

You may access your Personal Information by accessing your profile on the Site or in the App. However, in the event that your access to the Site or the App is terminated, you will no longer be able to access your profile or any of your Personal Information. The Research Institute may retain certain Personal Information for as long as it has a legitimate reason for doing so, for any reason, including recordkeeping.

Upon your written request addressed to the Research Institute's Privacy Officer (see coordinates below), the Research Institute will inform you of the existence, use and disclosure of Personal Information about you and you will be given access to that Personal Information. You are entitled to challenge the accuracy and completeness of the Personal Information and have it amended as appropriate, subject to some exceptions as prescribed by law. In certain situations, the Research Institute may not be able to provide access to all the Personal Information it holds about you. Exceptions to such access are limited and specific and may include Personal Information that contains references to other individuals, information that cannot be disclosed for legal, security, or commercial proprietary reasons, and information that is subject to solicitor-client or litigation privilege. The reasons for denying access will be provided to you upon request.

A response will be provided to you within thirty (30) days of a written request for access and/or rectification to Personal Information.

XIII. Withdrawal of Consent.

In some jurisdictions, you may withdraw your consent to the use and intention of your Personal Information. To do this, please contact the Research Institute's Privacy Officer (see coordinates below).

XIV. Contact.

Should you have any questions about this Policy or the collection, use and disclosure practices of the Research Institute or the privacy policies and practices of its Partners, you may contact the Research Institute's Privacy Officer at the following coordinates:

Should you have any questions about this Policy or the collection, use and disclosure practices of the Research Institute or the privacy policies and practices of its Partners, please contact us by email to info@myreadychd.app.

We will use reasonable efforts to respond promptly to requests, questions or concerns regarding the use of Personal Information. Except where required by law, we cannot ensure a response to questions or comments regarding topics unrelated to your Personal Information or to this Policy.

The Research Institute will investigate all complaints. If a complaint is found to be justified, the Research Institute will take appropriate measures, including, if necessary, amending its policies and practices.

XV. Third Party Services and Websites.

The mobile device through which you access and use the App and/or your cellular carrier may also be collecting other information about your use of their device and service. We do not control these third parties' tracking technologies or how they may use the information they collect.

The Site or the App may contain links to other websites or Internet resources operated by third parties. When you click on one of those links you are contacting another website or Internet resource that may collect information about you voluntarily or through cookies or other technologies. The Research Institute assumes no responsibility or liability for or control over those other websites or Internet resources or their collection, use and disclosure of your Personal Information.

XVI. Users.

The Site and the App are hosted in Canada and intended for and directed to Users located in Canada only. Users located outside Canada may not use the Site or the App.

The Research Institute will not knowingly collect Personal Information from anyone under the age of majority without receiving the consent of his or her parent or legal guardian. If a person under the age of majority has provided us with Personal Information, a parent or legal guardian may contact the Privacy Officer (see coordinates above) if they would like to access or rectify this information or to have this information deleted from our records. We will use reasonable efforts to delete the person's information from our databases.

XVII. Terms of Use.

The Research Institute's Terms of Use which may be viewed at <color=blue>https://myreadychd.app/termsofuse</color> contain important provisions disclaiming and excluding the liability of the Research Institute and others regarding your use of the Site and the App and provisions determining the applicable law and exclusive jurisdiction for the resolution of any disputes regarding your use of the Site and the App. Those provisions also apply to any disputes that may arise in relation to this Policy and the collection, use and disclosure of your Personal Information, and are of the same force and effect as if they had been reproduced directly in this Policy.

XVIII. Language Clause.

The parties have expressly requested and required that this Policy and all related documents be drawn up in the English language. Les parties conviennent et exigent expressément que cette Politique et tous les documents qui s'y rapportent soient rédigés en anglais.

XIX. Policy Changes.

This Policy may be changed by the Research Institute from time to time in its sole discretion and without any prior notice or liability to you or any other person. The collection, use and disclosure of your Personal Information by the Research Institute will be governed by the version of this Policy in effect at that time. New versions of this Policy will be posted on the Site and in the App. Your continued use of the Site and/or the App subsequent to any changes to this Policy will signify that you consent to the collection, use and disclosure of your Personal Information in accordance with the changed Policy. Please consult the Site or the App for the most recent version.

This Policy was last updated on July 1st 2021.

Should you have any question or concern, please write to info@myreadychd.app or contact the Research Assistant assigned to you!