Privacy Policy – ELF Connect

About this Privacy Notice

This Privacy Notice explains how the European Lung Foundation (ELF) collects, uses, stores and protects your personal data when you use the ELF Connect platform. ELF Connect is a digital platform designed to form a bridge between patients and healthcare professionals to improve care and outcomes for patients with respiratory conditions.

ELF is the data controller for the personal data collected through ELF Connect. This means we are responsible for deciding how we hold and use your personal information. We are committed to protecting your privacy and complying with the EU General Data Protection Regulation (GDPR) and the UK General Data Protection Regulation (UK GDPR).

To understand how your personal information will be treated, please read the following policy. This policy may change from time to time so please refer to it periodically. In addition, we will where applicable send you a notice of any such change.

What is ELF Connect and what features does it offer?

ELF Connect provides registered users with the following features:

(a) Access to evidence-based resources: Users can access a library of information about specific respiratory conditions. This library includes resources provided by ELF and resources shared from trusted partners.

(b) Search functionality: Users can search the platform resources using a search function supported by an AI instance. Please note that the questions you submit through the search function are not used to train the AI instance.

(c) ‘Ask a Question’ feature: Users can submit questions to a panel of experts using the ‘submit a question to an expert’ button. If your question has previously been asked at an in-person conference and answered by the expert panel, you will receive that previous response with an explanation that the question was asked before. If your question is new, it will be submitted to ELF (along with your user ID), who will ask the expert panel offline and then send the response to you as a direct message within the platform.

(d) Community feature: ELF Connect includes a community feature where users can interact with each other (the Community Feature). ELF and healthcare professionals can create posts, add images, polls and text, comment, reply and like content. Patients can view posts, comment on posts, reply to comments and like content, but cannot create new posts. Your use of the Community Feature is subject to the ELF Connect Community Guide which can be accessed here: https://elfconnect.eu/community-guidelines/. Personal data collected through the Community Feature may include:

(i) User-generated content: Posts, replies, comments, reactions (such as likes), poll responses and any other content you submit through the Community Feature.

(ii) Profile information: Profile fields you complete, your display name or nickname, and your profile visibility settings.

(iii) Group membership: Information about any groups you join or participate in within the community.

(iv) Private or direct messages: If enabled, any messages you send or receive through the platform’s messaging functionality.

(v) Reports: Information you provide when reporting content or other users.

What personal data do we collect?

ELF Connect may collect or process the following types of personal data:

(a) Account and profile data: Account registration data, email address, username, display name or nickname, user role (for example, patient, carer, healthcare professional, ELF representative or supporter), condition interest or group membership (where selected), country, region and language preference (where selected), profile fields completed by the user, and profile visibility settings.

(b) User-generated content: Posts, replies, comments and reactions, poll and survey responses, images or other content submitted by users (where enabled), direct or private messages (if enabled), and Ask an Expert submissions.

(d) Technical data: Technical data such as IP address, browser, device, logs and platform activity.

(e) Moderation and safeguarding data: Moderation records, reports, warnings, safeguarding records and account status.

Information may be stored in ELF’s platform systems, databases and approved service-provider systems. Users will only be added to mailing lists where they have opted in or where otherwise permitted by law.

Why do we collect your personal data?

We process your personal data for the following purposes:

(a) To create and manage user accounts: We process your account registration data, email address, username, display name, user role and profile information to create, authenticate and manage your ELF Connect account. This processing is necessary for the performance of our contract with you.

(b) To operate the ELF Connect platform: We process your user ID and platform usage data to provide you with access to the platform and its features. This processing is necessary for the performance of our contract with you.

(c) To provide access to resources and content: We process your usage data to provide you with access to our library of resources and content about respiratory conditions. This processing is necessary for the performance of our contract with you.

(d) To operate the community features: We process your user-generated content (including posts, comments, replies, reactions, poll responses and images), your profile information (including display name or nickname and profile visibility settings), your group memberships, and any private or direct messages you send or receive (if enabled), in order to provide and operate the community features. This processing is necessary for the performance of our contract with you. Your use of the community features is subject to the ELF Connect Community Guide.

(e) To allow users to participate: We process your data to allow you to join groups, comment, reply, react and otherwise participate in the platform. This processing is necessary for the performance of our contract with you.

(f) To operate AI-assisted search: We use an AI-supported search function to help you find relevant resources. Your search queries are processed to provide search results. This processing is necessary for the performance of our contract with you. Your search queries are not used to train the AI instance.

(g) To operate Ask an Expert: When you submit a question through the Ask an Expert feature, we process your user ID and question content to facilitate the expert panel response. This processing is necessary for the performance of our contract with you.

(h) To send service notifications: We may send you service-related communications and notifications about ELF Connect, including updates about your account, the platform and its features. This processing is necessary for the performance of our contract with you. Where we send you marketing communications, we will do so only with your consent, and you may withdraw your consent at any time.

(i) To moderate the platform and protect users: We process moderation records, reports, warnings, safeguarding records and account status information to moderate the platform, enforce our Community Guide and Terms of Use, and protect the safety and wellbeing of our users. This processing is based on our legitimate interests in maintaining a safe and welcoming platform environment.

(j) To manage reports, complaints and safeguarding concerns: We process your data to manage reports of inappropriate content or behaviour, to handle complaints, and to address safeguarding concerns. This processing is based on our legitimate interests in maintaining a safe platform and, where relevant, our legal obligations.

(k) To analyse usage and improve the service: We may analyse aggregated and anonymised usage data to understand how the platform is used and to improve our services, which may include evaluating and improving the performance of our AI-supported search function. This processing is based on our legitimate interests in developing and enhancing ELF Connect. For the avoidance of doubt, your search queries are not used to train or fine-tune the AI instance, and this commitment not to use data for AI training applies to all of your search queries.

(l) To manage consent and privacy rights: We process your data to manage your consent preferences and to respond to requests to exercise your data protection rights. This processing is necessary for compliance with our legal obligations under the GDPR and the UK GDPR.

(m) To comply with legal obligations: We may process your personal data where necessary to comply with applicable laws and regulations.

Special category (health) data

Because ELF Connect is designed for patients with respiratory conditions, the search queries you enter, the questions you submit through the ‘Ask a Question’ feature, and any content you post through the Community Feature may contain information about your health. Information concerning health is a special category of personal data under Article 9 of the GDPR and the UK GDPR and is subject to additional protection.

Where we process special category data of this kind, we rely on your explicit consent under Article 9(2)(a) of the GDPR and the UK GDPR. You may withdraw your consent at any time by contacting us, although this will not affect the lawfulness of any processing carried out before withdrawal. We apply appropriate safeguards to protect special category data, including: data minimisation; access controls; role-based admin access; secure hosting; contractual restrictions on service providers; written data processing agreements with processors, where required; restrictions on use of search queries for AI training; moderation and reporting processes; safeguarding escalation processes where appropriate; user account controls; consent capture at registration; ability for users to withdraw consent; and retention, deletion and anonymisation processes where appropriate.

Community feature

ELF Connect includes a community feature that allows users to interact with each other (the Community Feature). ELF and healthcare professionals may create posts, add images, polls and text, comment, reply and react to content (such as likes). Patients may view posts, comment on posts, reply to comments and react to content, but may not create new posts.You should not share any personal information (whether about yourself or others) that you do not wish to be publicly accessible.

Your use of the Community Feature is governed by the ELF Connect Terms of Use and the ELF Connect Community Guide, which sets out the rules for participation. For further information, please refer to the Terms of Use which can be accessed here [link] and the Community Guide which can be accessed here: https://elfconnect.eu/community-guidelines/. Key points include:

(a) Profile and display name: You may set up a profile and choose a display name or nickname. You are responsible for the accuracy of your profile information and for keeping it up to date. Your profile visibility settings determine what information is visible to other users.

(b) User-generated content: You are responsible for the content you post, including posts, replies, comments, reactions, poll responses and images. By posting content, you grant ELF a licence to use, display and distribute that content within the platform.

(c) Groups: You may join or participate in groups within the community. Group membership and participation are subject to the Community Guide.

(d) Private or direct messages: If enabled, you may send and receive private or direct messages through the platform. These messages are subject to the same content rules as public posts.

(e) Reporting: You may report content or users that you believe breach the Community Guide. We will review reports and take appropriate action, which may include removing content or suspending accounts.

(f) Moderation and takedown: ELF reserves the right to moderate, edit or remove any content that breaches the Community Guide, these terms or applicable law. We may take down content without prior notice where we consider it necessary.

(g) Account suspension and removal: ELF may suspend or remove your account if you breach the Community Guide or these terms, or if we consider it necessary to protect the safety or wellbeing of other users.

(h) Prohibited content and behaviour: You must not post content that is unlawful, harmful, threatening, abusive, harassing, defamatory, obscene, hateful or otherwise objectionable. You must not impersonate any person or entity, or misrepresent your affiliation with any person or entity.

(i) Medical misinformation: You must not post content that contains medical misinformation or that could reasonably be expected to cause harm if relied upon.

(j) No user-to-user medical advice: The Community Feature is not intended for the provision of medical advice from one user to another. You must not provide or seek individualised medical advice through the community. If you require medical advice, please consult a qualified healthcare professional.

(k) No emergency use: The Community Feature is not intended for use in medical emergencies. If you are experiencing a medical emergency, please contact your local emergency services immediately.

(l) Safeguarding: If we become aware of any safeguarding concerns through content posted on the community, we may take appropriate action, including escalating the matter to relevant authorities where necessary.

Who do we share your personal data with?

We do not sell your personal data. We may share your personal data with the following categories of recipients where necessary for the purposes described in this Privacy Notice:

(a) Expert panel members: Where you submit a new question through the Ask an Expert feature, expert panel members receive only the information needed to answer the question. This may include: the question submitted by you; relevant context you have chosen to include; condition or topic category, where relevant; and language, where relevant. Expert panel members do not receive your name, email address, full profile, wider account details or other identifying information unless there is a specific operational or legal reason to share it.

(b) Service providers: We may share your data with third-party service providers who assist us in operating the platform, including hosting providers, IT support, and analytics providers. These providers are contractually bound to process your data only on our instructions and in accordance with data protection laws.

(c) AI service provider: Where our AI-supported search function is provided or hosted by a third-party provider OpenAI API, your search queries may be transmitted to that provider solely for the purpose of generating search results. Your search queries are not used to train the AI instance. Any such provider acts as our processor, is bound by a written data processing agreement, and may process your data only on our instructions and in accordance with data protection laws. Where this involves a transfer of personal data outside the EEA or the UK, we put in place appropriate safeguards as described in the ‘International transfers of personal data’ section below.

(d) European Respiratory Society (ERS): As ELF operates under ERS, your data may be shared within this organisational structure for administrative and operational purposes.

(e) Legal and regulatory authorities: We may disclose your data where required by law or to protect our legal rights.

Automated decision-making and AI

The ELF Connect platform uses an AI-supported search function to help you find relevant resources. The AI instance does not make any decisions that produce legal effects concerning you or that similarly significantly affect you. Search results are generated algorithmically from our curated library of resources and are not individually reviewed by ELF before being presented to you. We do not carry out any profiling of you. Accordingly, you are not subject to decisions based solely on automated processing within the meaning of Article 22 of the GDPR and the UK GDPR.

International transfers of personal data

ELF operates under the European Respiratory Society (ERS) which is based in Switzerland. Switzerland is recognised as providing an adequate level of data protection under both the EU GDPR and the UK GDPR. Where your personal data is transferred outside the European Economic Area (EEA) or the United Kingdom, we ensure that appropriate safeguards are in place. In particular, where our AI-supported search function is hosted on infrastructure located outside the EEA or the UK, your search queries may be transmitted to that infrastructure in order to generate search results. Any such transfer is made on the basis ofan adequacy decision or, where no adequacy decision applies, the UK International Data Transfer Agreement and/or the European Commission’s standard contractual clauses, together with any additional safeguards required to protect your personal data.

How long do we keep your personal data?

We retain your personal data only for as long as necessary to fulfil the purposes for which it was collected, including to satisfy any legal, accounting or reporting requirements. When you close your ELF Connect account, we will delete or anonymise your personal data, unless we are required to retain it for legal or regulatory purposes.

Opting out, changing or having your information deleted

At any time, you can cancel or modify your information by contacting the ELF office (info@europeanlung.org). You can also at any time ask to see your data by contacting us. ELF takes very seriously the accuracy of the information it holds on you. Where contact details are not provided on the page and if you wish to have all your personal information deleted from our databases, you can contact us for further information.

What choices are available to you regarding collection, use and distribution of the information?

Any information on new ELF activities that you registered to receive will be sent to you electronically or by other means. ELF may also send you e-mail messages and newsletters which you consented to and are of interest to you. You can indicate that you do not wish to receive such e-mail messages or newsletters by using the unsubscribe link in the newsletters or emailing us at info@europeanlung.org and you will be removed from the recipients’ list.

How do we protect your personal data?

We implement appropriate technical and organisational measures to protect your personal data against unauthorised access, alteration, disclosure or destruction. However, no method of transmission over the internet or electronic storage is completely secure, and we cannot guarantee absolute security.

Cookies and similar technologies

ELF Connect uses cookies and similar technologies to provide and improve the platform. Cookies are small text files stored on your device that help us recognise you, remember your preferences, and understand how you use the platform.

For statistical analysis purposes, a cookie may also be used to pass a randomly generated and anonymous unique number to our servers. Cookies cannot be used by themselves to identify you. A cookie will typically contain the name of the domain from which the cookie has come, as well as the lifetime and expiration of the cookie, and a value, usually a text value or a randomly generated unique number.

You can manage your cookie preferences through your settings. However, disabling certain cookies may affect your ability to use some features of ELF Connect.

Links to third-party resources

ELF Connect may contain links to third-party websites or resources from trusted partners. We are not responsible for the privacy practices or content of these external sites. We encourage you to review the privacy notices of any third-party sites you visit.

Your legal rights

You have a number of rights under data protection laws in relation to your personal data.

You have the right to:

• Request access to your personal data (commonly known as a “subject access request”). This enables you to receive a copy of the personal data we hold about you and to check that we are lawfully processing it.

• Request correction of the personal data that we hold about you. This enables you to have any incomplete or inaccurate data we hold about you corrected, though we may need to verify the accuracy of the new data you provide to us.

• Request erasure of your personal data in certain circumstances. This enables you to ask us to delete or remove personal data where there is no good reason for us continuing to process it. You also have the right to ask us to delete or remove your personal data where you have successfully exercised your right to object to processing (see below), where we may have processed your information unlawfully or where we are required to erase your personal data to comply with local law. Note, however, that we may not always be able to comply with your request of erasure for specific legal reasons which will be notified to you, if applicable, at the time of your request.

• Object to processing of your personal data where we are relying on a legitimate interest (or that of a third party) as the legal basis for that particular use of your data. In some cases, we may demonstrate that we have compelling legitimate grounds to process your information which override your right to object.

• You also have the absolute right to object any time to the processing of your personal data for direct marketing purposes (see clause above headed ‘What choices are available to you regarding collection, use and distribution of the information?’ for details of how to object to receiving direct marketing communications).

• Request the transfer of your personal data to you or to a third party. We will provide to you, or a third party you have chosen, your personal data in a structured, commonly used, machine-readable format. Note that this right only applies to automated information which you initially provided consent for us to use or where we used the information to perform a contract with you.

• Withdraw consent at any time where we are relying on consent to process your personal data (see clauses above headed ‘Why do we collect your personal data?’ and ‘Special Category (health) Data’ for details of when we rely on your consent as the legal basis for using your data). However, this will not affect the lawfulness of any processing carried out before you withdraw your consent. If you withdraw your consent, we may not be able to provide certain products, information or services to you. We will advise you if this is the case at the time you withdraw your consent.

• Request restriction of processing of your personal data. This enables you to ask us to suspend the processing of your personal data in one of the following scenarios:

o If you want us to establish the data’s accuracy;

o Where our use of the data is unlawful but you do not want us to erase it;

o Where you need us to hold the data even if we no longer require it as you need it to establish, exercise or defend legal claims; or

o You have objected to our use of your data but we need to verify whether we have overriding legitimate grounds to use it.

Complaints

If you believe that we have breached data protection laws in the way we collect, use, store or otherwise handle your personal information, you have the right to make a complaint directly to us, to the Information Commissioner’s Office (ICO), or to pursue legal action. You do not need to complain to us before contacting the ICO or taking legal action.

We will acknowledge receipt of your complaint within 30 days of receipt and will aim to reach an outcome within 30 working days. Some complaints may take longer to resolve where they are complex, serious or relate to multiple data protection issues; in such cases, we will keep you informed of our progress and expected timeframes.

Where your complaint relates to personal information processed by one of our service providers, we will liaise with the relevant provider to obtain details and information relevant to your complaint without undue delay.

If you are dissatisfied with the outcome or any aspect of how we have handled your complaint, you may lodge a complaint with a supervisory authority. In the UK, this is the Information Commissioner’s Office (ICO) at www.ico.org.uk. In the EU, you may contact your local data protection supervisory authority. You also have the right to complain to the ICO, or your local supervisory authority at any time and, in the UK, to lodge a claim before a competent court, irrespective of whether you have lodged a complaint with us using our complaints process.

Contact us

If you have any questions about this Privacy Notice or how we process your personal data, or if you wish to raise a complaint with us, or you wish to exercise your other data protection rights, please contact us at:

European Lung Foundation

Email: info@europeanlung.org

Last updated: [Insert date]