Privacy Policy
TrueBlue App Clinical Study- Version 1.1, February 2024
Privacy and security are of utmost importance to BlueSkeye AI and we strive to ensure that our technical and organisational measures in place respect your data protection rights. Wherever possible we minimise the amount of personal data we collect. Where data is collected, we rely on the public task and scientific research purposes as our lawful basis (see further below) .
This Privacy Policy describes how we collect, manage, process and store personal data in connection with the TrueBlue Clinical Study, for what purposes, and your rights in relation to your personal data.
Definitions and interpretation
In this Privacy Policy, the following definitions are used:
Data
collectively all information that you submit to BlueSkeye AI via the TrueBlue app. This definition incorporates, where applicable, the definitions provided in the Data Protection Laws.
Data Protection Laws
any applicable laws and regulations relating to the processing of Personal Data and privacy as may be applicable from time to time, which at the date publication means the Data Protection Act 2018 and the UK GDPR.
UK GDPR
means Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, as it forms part of the law of England and Wales.
BlueSkeye, we or us
BlueSkeye AI Ltd, a company incorporated in England and Wales with registered number 11953581 whose registered office is at The Ingenuity Centre, Triumph Road, Nottingham, England, NG7 2TU.
App
BlueSkeye's TrueBlue app.
About Blueskeye
For purposes of the applicable Data Protection Laws, and in relation to the Data, BlueSkeye and the University of Nottingham are joint "data controllers". This means that BlueSkeye and the University of Nottingham jointly determine the purposes for which, and the manner in which, your Data is processed. [Further information on how the University of Nottingham processes data is available here: [ ]]
The BlueSkeye Data Protection Officer is Dr Anthony Brown. Any queries regarding Data Protection issues should be addressed to them at dataprotection@blueskeye.com
Data collected
As part of the "onboarding" process for the TrueBlue App Clinical Study, we will ask you to complete a personality questionnaire. We will also ask you to confirm if you are pregnant and (if so) invite you to provide your due date. If you have given birth, you will be invited to confirm the date you gave birth.
Throughout the period of your participation in the TrueBlue Clinical Study, we collect via the App your personal data in the form of audio and video recordings of your face and speech. We will also periodically ask you to complete mental health assessments (the Patient Health Questionnaire (PHQ-9), the Edinburgh Postnatal Depression Scale (EPDS), Generalised Anxiety Disorder Assessment (GAD-7) and The Temporal Experience of Pleasure Scale (TEPS)) consisting of multiple choice questions to make an assessment of your mental health and well-being.
Some of the Data we collect will constitute "special category personal data", in the form of information relating to your health.
Why we collect your information
BlueSkeye collects your information in order to undertake the TrueBlue Clinical Study. The study will assess the safety of the App, its ease of use and whether the App is a practical option for use within the NHS. In addition, the study will develop processes where a user’s behaviour (collected from voice and video recorded by the user on the app) can be used to predict and highlight symptoms of depression, anxiety and anhedonia (reduced ability to experience pleasure). The data collected in this study will be used in part to train the AI algorithm of BlueSkeye AI for predicting clinical measures of depression, anxiety and anhedonia.
How do we lawfully use your data?
We rely on the following lawful basis/bases to process Data:
Article 6(1)(e) processing is necessary for the performance of a task carried out in the public interest or in the exercise of official authority vested in the controller; and
Article 9(2)(j) processing is necessary for archiving purposes in the public interest, scientific or historical research purposes or statistical purposes in accordance with Article 89(1) (as supplemented by section 19 of the 2018 Act) based on domestic law which shall be proportionate to the aim pursued, respect the essence of the right to data protection and provide for suitable and specific measures to safeguard the fundamental rights and the interests of the data subject.
How we collect Data
We collect Data in the following ways:
data is given to us by you; and
data is collected automatically.
Data that is given to us by you
BlueSkeye will collect your Data through:
Your video (facial) recorded while completing the tasks on the App.
Your audio data recorded while completing the tasks on the App; and
Responses to mood check-in questions.
in all cases, in accordance with this Privacy Policy.
Data that is collected automatically
To the extent that you access the App, we automatically collect some information about your App usage. The data collected automatically is high-level generalised/anonymised data which informs us when the App is used and what screens are viewed and when.
Who do we share data with?
We may share your data if we consider that the results of any mental health assessment you undertake need to be followed up with a clinician. Initially, a member of the study team will contact you to discuss the outcome of the assessment. If for any reason we are unable to contact you and there is significant ongoing concern for your wellbeing, then the study team may contact appropriate healthcare professionals directly without prior discussion with you, which may involve sharing information about the nature of the concern and any other relevant information.
When doing so we rely on the following lawful basis/bases to process Data: –
Article 6(1)(d) processing is necessary in order to protect the vital interests of the data subject or of another natural person, and;
Article 9(2)(c) processing is necessary to protect the vital interests of the data subject or of another natural person where the data subject is physically or legally incapable of giving consent
We share data with trusted third-party service providers to facilitate a range of optional features in the TrueBlue app, including anonymous usage reporting. You may decide whether to opt in to these features. If the TrueBlue app crashes, a crash report will be generated and may be sent to a third-party service provider, who will process this information on our behalf to help fix bugs in the App.
To the extent that personal data is shared for these purposes, we rely on the following lawful basis/bases to process Data:
Article 6(1)(f) processing is necessary for the purposes of the legitimate interests pursued by the controller or by a third party except where such interests are overridden by the interests or fundamental rights and freedoms of the data subject which require protection of personal data, in particular where the data subject is a child.
Keeping Data secure
The transfer of your Data from your smartphone to BlueSkeye's data servers will be secured through encryption and the data servers themselves will be password protected and will be accessible only to the research team members. Data on these servers will also be encrypted at rest.
Your Data will be held at BlueSkeye secure storage on Google cloud services and at University of Nottingham’s cloud based storage system, OneDrive. All your data will be stored in encrypted files and access will be restricted to include only those who are directly involved with the research.
Technical and organisational measures include measures to deal with any suspected data breach. If you suspect any misuse or loss or unauthorised access to your Data, please let us know immediately by contacting us via this e-mail address: dataprotection@blueskeye.com.
Data retention
All Data recorded during the usage of App for purposes directly connected with research (including audio-visual data) will be stored for a minimum of 7 years, but can be retained for longer periods of time if required; its retention will be reviewed at the end of this research project and then every 2 years after the end of the project.
Other Data not directly connected with research (such as contact details) will be stored only for 6-12 months after the study has ended, unless you have consented to be contacted for similar future studies in which case your personal data will be retained for more than 3 years.
Your rights
You have the following rights in relation to your Data:
Right to access* - the right to request copies of the information we hold about you at any time. If we provide you with access to the information we hold about you, we will not charge you for this, unless your request is "manifestly unfounded or excessive." Where we are legally permitted to do so, we may refuse your request. If we refuse your request, we will tell you the reasons why.
Right to correct* - the right to have your Data rectified if it is inaccurate or incomplete.
Right to restrict our use of your Data* - the right to "block" us from using your Data or limit the way in which we can use it.
Right to data portability - the right to request that we move, copy or transfer your Data.
Right to object - the right to object to our use of your Data including where we use it for our legitimate interests.
(The rights marked with an * are subject to an exemption which applies where data is processed for scientific research purposes, provided the conditions for applying the exemption are met. The right to object is available except where data is processed for scientific research purposes and the processing is necessary for the performance of a task carried out in the public interest.)
To make enquiries or to exercise any of your rights set out above, please contact us via this e-mail address: dataprotection@blueskeye.com
dataprotection@blueskeye.com
If you are not satisfied with the way a complaint you make in relation to your Data is handled by us, you may be able to refer your complaint to the relevant data protection authority. For the UK, this is the Information Commissioner's Office (ICO). The ICO's contact details can be found on their website at https://ico.org.uk/
It is important that the Data we hold about you is accurate and current. Please keep us informed if your Data changes during the period for which we hold it.
General
You may not transfer any of your rights under this Privacy Policy to any other person. We may transfer our rights under this Privacy Policy where we reasonably believe your rights will not be affected.
If any court or competent authority finds that any provision of this Privacy Policy (or part of any provision) is invalid, illegal or unenforceable, that provision or part-provision will, to the extent required, be deemed to be deleted, and the validity and enforceability of the other provisions of this Privacy Policy will not be affected.
Unless otherwise agreed, no delay, act or omission by a party in exercising any right or remedy will be deemed a waiver of that, or any other, right or remedy.
This Agreement will be governed by and interpreted according to the law of England and Wales. All disputes arising under the Agreement will be subject to the exclusive jurisdiction of the English and Welsh courts.
Changes to this Privacy Policy
BlueSkeye reserves the right to change this Privacy Policy as we may deem necessary from time to time or as may be required by law. Updated versions of this Privacy Policy will be posted on the App from time to time, and you are deemed to have accepted the terms of the Privacy Policy on your first use of the App following the alterations. If you are dissatisfied with any aspect of our Privacy Notice, please contact the Data Protection Officer.