mVTx Portal & Multi-User Device (MUD) Privacy Policy

Last updated: 06 January 2022

This Privacy Policy and the mVTx Terms of Use govern your use of the mVTx Portal and MUD provided by Roche. The Portal and MUD is used for Roche to communicate the results of vision activities (the “Activities”) collected from the mVTx App (the “App”) with health care providers and to create user accounts for access the Portal and MUD (“Portal and MUD users”). Medical professionals can use the Portal and MUD to add people living with eye conditions (“App users”), monitor App user Activity results, and display the results of the Activities.

When you use the Portal and MUD, Roche collects personal information about you.  Personal information is information that identifies, relates to, describes, is reasonably capable of being associated with, or could reasonably be linked, directly or indirectly, with a particular consumer or household. This Privacy Policy informs you about what personal information is collected in the Portal and MUD and how the information is used, shared, and otherwise processed. By using the Portal and MUD, you are consenting to our collection, use, disclosure, and processing of your personal information as set forth in this Privacy Policy.

This Privacy Policy is subject to change. We encourage you to review it from time to time, as the effective date will be revised to indicate if it has been updated.

What personal information does Roche obtain, how is it used, and to whom may it be disclosed?

Registration Information – Registration with Roche is mandatory in order to be able to use the basic features of the Portal and MUD. Your email and a password that you provide will allow you to access and use the Portal and MUD, and at registration you can provide your first and last name, phone number and title (collectively the “Registration Information”). We retain and use this Registration Information so that we can verify your identity, communicate with you about your App Users’ Activity results and enforce the Portal and MUD Terms of Use.

When You contact Customer Support  – You may provide Roche with additional information, including your name, contact information, institution name and job title if you reach out to Roche with questions, for technical support, or to provide feedback. Roche uses this information to communicate with you to resolve any issues you may have and to improve the Portal and MUD or the App.

Automatically Collected Information – In addition, the Portal and MUD may automatically send to us certain other information, such as the type of internet browser you use, your Internet Protocol (IP) Address, and information about the way you use the Portal and MUD. We use this information to understand which Portal and MUD features/functions are most useful, troubleshoot and fix Portal and MUD errors, to design Portal and MUD improvements, and to maintain an audit trail of your activity in the Portal and MUD for compliance purposes.

We may also disclose your personal information:

• as required by law, such as to comply with a subpoena, or similar legal process;
• when we believe in good faith that disclosure is necessary to protect our rights, protect your safety or the safety of others, investigate fraud, or respond to a government request;
• with our trusted services providers who perform services on our behalf; or
• if Roche is involved in an actual or potential merger, acquisition, or sale of all or a portion of its assets.

Will Roche Use My Personal Information for Marketing Purposes?

We will not use, sell or transfer your personal information for marketing purposes unless we obtain your consent for such.

Who does Roche Share My Personal Information with?

We may disclose your personal information to the following categories of recipients.

• to our third party service providers and partners, including:
  • Amazon Web Services, Inc. (AWS):  AWS provides hosting and storage services for the Portal and MUD. AWS does not have access to your personal information or any other data contained in the Portal and MUD.
  • ATP, LLC (trading as PPD Medical Communications): Your email and any information you choose to share in your support inquiry. Roche may share your personal information with other Roche Affiliates solely to provide technical support as requested by you.
• to any competent law enforcement body, regulatory, government agency, court or other third party where we believe disclosure is necessary (i) as a matter of applicable law or regulation, (ii) to exercise, establish or defend our legal rights, or (iii) to protect your vital interests or those of any other person;
• to an actual or potential successor (and its agents and advisers) of our activities as a healthcare provider, provided that we inform the successor it must use your personal information only for the purposes disclosed in this Privacy Notice;
• to any other person with your consent to the disclosure.
• to any other person with your consent to the disclosure
  • to any other person with your consent to the disclosure
  • to any other person with your consent to the disclosure
    

Analytics, cookies and similar tracking technologies

We may work with analytics companies to help us understand how the portal is being used, such as the frequency and duration of usage. The Portal and MUD may use cookies, local shared objects (LSOs) and other tracking technologies to identify users who have previously visited so the user is recognized upon return, thereby saving them time while on the portal. A cookie is a piece of data stored on the user's hard drive containing information about the user. If a user rejects the cookie, they may still use our website. A cookie may be placed by us, or by vendors or service agencies who work with us or with our partners. Similar to a cookie, a Local Shared Object is a collection of data that a web site running Adobe Flash can place on your hard drive to recognize a repeat visitor and store settings and other information.

The Portal and MUD use the following types of cookies and tracking technologies, for the following purposes:

• Strictly Necessary Cookies. These cookies are strictly necessary to provide you with the Portal and MUD and to use some of their features, such as logging in.  

• Analytical Cookies. These cookies allow us (and our third party service providers) to count visits and traffic sources so we (and our third party service providers) can measure and improve the performance of the Portal and MUD. The data collected by these cookies is only used for purposes that are strictly necessary to understand how you use the Portal and MUD and help us improve the Portal and MUD from a product development perspective. The data collected by these cookies is not shared with advertising or marketing agencies, or sold to any third party.

These cookies are set using Google Analytics which is provided by Google Inc. and its subsidiary, Firebase, Inc (“Google”) and Amplitude, Inc. (“Amplitude”) to help us (and our third party service providers) manage these analytics. The information generated by the cookies about your use of the Portal and MUD will be transmitted to and stored by Google and Amplitude on servers in the United States. We use the IP-anonymisation feature of Google Analytics, which means that your IP address is anonymised at the earliest possible stage before being transmitted to Google’s servers. Only in exceptional cases (for example, a failure of the EU based system) will the whole IP address be first transferred to a Google server in the United States and anonymised there. In no event will Google associate your IP address with any other data it holds. IP addresses are not collected by Amplitude.

If you wish to prevent analytical cookies from tracking you anonymously as you navigate the Portal, you can reset your browser to refuse all cookies or to indicate when a cookie is being sent. Strictly necessary cookies allow you to take advantage of some of the Portal’s essential features. Therefore, if you block or otherwise reject all cookies, the Portal may not function correctly and you may not be able to access or use the Portal.

All browsers allow you to fine-tune cookie settings and determine which ones to accept and which to disable or delete. Your browser can also notify you when you receive new cookies. Please consult your browser’s ‘help’ section for more information on adjusting your cookie settings.

What are my opt-out rights?

There are multiple opt-out options for users of this Portal and MUD. You can contact mVTx customer support. Your clinic's administrator can also make the request to remove portal and MUD users. See support contact information below.

For US-based sites:

Email: mvtx.trialsupport@roche.com
Phone: 1-877-268-0262

For sites outside of US:

Email: mvtx.trialsupport@roche.com
Phone: (+44) 161 768 3553 

If you opt out of the Portal and MUD, you will not be able to access App Users’ Activity results.

California Residents

The California Consumer Privacy Act of 2018 (CCPA) gives California residents the right to know certain types of personal information collected about them, including whether it is being sold or disclosed to third-parties, and the right to prevent Roche from selling that information. Certain types of information, such as information covered by the Health Insurance Portability and Accountability Act (“HIPAA”), are not subject to the CCPA. Roche does not sell personal information.  To learn more about the personal information we may collect from or about you, including how we may use and share it, please see our California Supplemental Privacy Notice.

Residents of Switzerland, the United Kingdom and/or any country-member of the European

Union

Residents have certain data protection rights under the General Data Protection Regulation (2016/679/EU) (GDPR) and other applicable privacy laws. Roche aims to take reasonable steps to allow you to correct, amend, delete or limit the use of your Personal Information.

In certain circumstances, you have the following data protection rights:

The right to access, update or delete the information we have on you. Whenever made possible, you can access, update or request deletion of your personal information directly within your account settings section. If you are unable to perform these actions yourself, please contact us to assist you.

The right of rectification. You have the right to have your information rectified if that information is inaccurate or incomplete.

The right to object. You have the right to object to our processing of your personal information.

The right of restriction. You have the right to request that we restrict the processing of your personal information.

The right to data portability. You have the right to be provided with a copy of the information we have on you in a structured, machine-readable and commonly used format.

The right to withdraw consent. You also have the right to withdraw your consent at any time where Roche relied on your consent to process your personal information.

You have the right to lodge a complaint to a Data Protection Authority about our collection and use of your personal information. For more information, please contact your local data protection authority in the European Economic Area (EEA).

Australian Residents

Roche will manage your personal information in accordance with the Privacy Act 1988 (Cth) and Australian Privacy Principles. If you wish to access further information about how Roche collects, uses and stores your data, please use the contact details provided in the 'Further Information/Contact Us' section below. You are entitled to rights under Australian Law:

The right to access: You obtain the right to access, update and delete your personal information held by Roche.

The right to withdraw consent: You can withdraw your consent at any time by contacting us. However, if you choose to withdraw your consent, we may not be able to provide you with information and/or access to services.

Data Retention Policy, Deletion Requests

We will retain your Registration Information and personal information related to your use of the Portal and MUD for as long as you use the Portal and MUD and a reasonable time thereafter in accordance with our data retention policies. We may retain your personal information for a longer period of time if so required by applicable law. If you would like us to delete any of this personal information, please contact us using the contact details in the ‘Further Information/Contact Us’ section below and we will respond in a reasonable time.

Children

We do not use the Portal and MUD to knowingly solicit data from or market to children under the age of 13. If a parent or guardian becomes aware that his or her child has provided us with information without their consent, he or she should contact us using the contact details in the ‘Further Information/Contact Us’ section below. We will delete such information from our files within a reasonable time.

Where is information entered into the Portal and MUD stored, and how secure is the information?

The information you enter into the Portal and MUD is stored in one or more encrypted proprietary databases hosted by Roche and/or a trusted third party cloud services provider.  Use of the Portal and MUD is password protected. You are responsible for maintaining the security of your password. If you believe that your password has been compromised, you should immediately change it and contact the help desk.

How secure is the information shared with Roche?

Roche cares about safeguarding the confidentiality of your information. We provide physical, electronic, and procedural safeguards designed to protect personal information we process and maintain. For example, we limit access to this information to authorized employees and contractors who need to know that information in order to operate, develop or improve the Portal and MUD. Please be aware that, although we endeavor to provide reasonable security for information we process and maintain, no security system can prevent all potential security breaches.

Further Information/Contact Us

If you would like to contact Roche regarding this Policy or exercise any of the rights afforded to you by applicable law, please contact us as follows: