Privacy Policy

1. Who we are and how to contact us

The mobile application MyFoodRepo (the “App”), the website https://v2.myfoodrepo.org/ (the “Website”), and its application programming interface (the “API”), altogether the “Services” are provided by the École Polytechnique Fédérale de Lausanne, Bâtiment CE, 3.316, Station 1, 1015 Lausanne, Switzerland.

You can contact the data controller by contacting Prof. Marcel Salathé's laboratory:

Salathé Lab, School of Life Sciences SV
Global Health Institute
EPFL SV GHI UPSALATHE1
Station 19
CH-1015 LAUSANNE
Switzerland
https://salathelab.epfl.ch
marcel.salathe@epfl.ch

2. Parental consent

The Services are not directed to children under the age of 13 years old, and you cannot use the Services if you are under the age of 13 years old. Depending on you State of residency, a parental consent is required for children (between 13 and 16 years old). In such case, you can only use the Services with the consent of your parent.

3. Data we collect

3.1. Categories of data

Among the Services, we are notably offering pictures' availability to the public and algorithms that do not process personal data. We are not offering specific features, tools, algorithms, or data that could help third parties to identify you.

However, in order to be able to provide you with the Services, we need to process your account data (3.2) and metadata (3.3) (altogether “Personal Data”), as well as pictures (3.4).

3.2. Account data

For the purposes described in section 4, you provide us with the following personal data:

• Time and timezone when a picture is taken

3.3. Metadata (Automatically Collected Data)

Besides the information you will actively provide us, we automatically collect the following data once you accept to use the Services:

• Usage and log information: IP address, timestamps of access to our Services, credentials (passwords are never stored directly on our servers; they are salted and hashed per industry standard), information about your subscription (such as your consent's proof);
• Device and connection information: operating system, device's vendor, and device's name, browser, etc.;
• Cookies or similar technologies: Cookies or similar technologies can be useful in many ways to make your visit to our App and Website simpler, more pleasant and more pertinent. Cookies and similar technologies are data files that your browser automatically saves on your device's hard drive when you visit our Website or App.

Various types of cookies are present on our Website and App:

• Cookies that are strictly necessary, which are necessary for navigation, along with your authentication token after logging in, and to secure the Website and App;
• Analytical cookies, which serve to count the visits in relation with our Services and serve to analyze the sources of traffic and improve our Services;
• Functionality cookies, which are collecting some of your surfing preferences such as language preferences.

3.4. Pictures

By using the App, you will share with us pictures that you take. According to the Terms of use, you shall not take pictures that includes personal data. You must however understand that we cannot verify each picture.

Your pictures, including any personal data potentially contained in them, are solely accessible by you, the managers of the cohorts you are part of, and the administrators of the Website.

4. Purposes and justification

4.1. Provision of Services

We process your Personal Data to provide the Services.

The processing is necessary for the performance of the contract to which you are a party once you accepted the Terms of use when you first opened the App or first accessed to the Website or the API.

To provide the Services, we use the following third-party services:

• https://www.heroku.com to host the Website
• https://aws.amazon.com to store the pictures
• https://azure.microsoft.com to analyze your pictures and comments with AI
• https://sentry.io)to track errors so we can improve the App and the Website
• https://www.papertrail.com to store and browse the logs of the Website

4.2. Research projects

We process your Personal Data to conduct research projects.

The processing is necessary for the performance of our tasks and is carried out in the public interest and according to art. 36c and seq. of the Swiss Federal Act on the Federal Institutes of Technology of 4 October 1991.

The processing of your Personal Data for research projects include your pictures.

5. How we retain your data

We store your Personal Data as long as your account exist. You are taking your pictures and entering your personal data usually through the App, and your pictures are saved on our Website's servers.

When we use your Personal Data for research purposes, we may keep your data for up to 10 years, or even longer if we have a legal obligation to do so.

We are using an external provider for data storage, namely: Amazon Web Services. The servers we use are based in Frankfurt, Germany (European Union) and we have an agreement with this provider, who guarantees an adequate level of security.

6. Data Sharing

We do not share your Personal Data. Only your pictures and dish descriptions and comments are accessible to the managers of the cohorts you are part of and to the administrators of the Website.

Please note however that the external providers, including their affiliate entities and/or subprocessors, may get the access to your personal data for the purpose of data storage, and these affiliate entities and/or subprocessors may be based outside the European Union, especially in the United States.

7. Security

We have put in place appropriate security measures pursuant to the acknowledged rules of the art. This includes in particular an access limitation, as technical and organisational security measures.

Please note however that we cannot guarantee an absolute security for your Personal Data, to the extent that the Personal Data retention and electronical transmission involves certain risks.

Jailbreak detection for iOS and root detection for Android have not been implemented in our mobile apps. Devices that are jailbroken or rooted are more vulnerable to hacking and data theft. Therefore, we cannot guarantee the security of data on such devices and do not recommend using them.

8. Your Rights

You have a number of rights according to the data protection legislation. These rights can be limited in particular when they affect rights and freedom of others. We will inform you of applicable exceptions in our answer to your potential request. These rights include:

• right of access: You have the right to know what personal data we hold about you and to ask, in writing, to see your personal data.
• right to be informed: You have the right to be informed how your personal data will be used. This privacy notice as well as any additional information or notice that is provided to you either at the time you provided your details, or otherwise, is intended to provide you with this information.
• right to withdraw consent: Where we process your personal data on the basis of your consent, you can withdraw that consent at any time.
• right to object: You also have a right to object to us processing personal data where we are relying on a task carried out in the public interest or our legitimate interests to do so.
• right to restrict processing: In certain situations, you have the right to ask for processing of your personal data to be restricted because there is some disagreement about its accuracy or legitimate usage.
• right of erasure: In some cases, you have the right to have your personal data to be deleted.
• right of rectification: If you believe your personal data is inaccurate you have the right to ask for their update.
• right to data portability: Where we are processing your personal data because you have given us your consent to do so or when their processing is necessary for the performance of the contract that binds us to you, you have the right to request that the personal data is transferred from one service provider to another.
• right to file a complaint: If you are unhappy with the way in which we have handled your personal data, you have the right to file a complaint with the Federal Data Protection and Information Commissioner (FDPIC) or with the supervisory authority of your country or residency.

For deleting your account, please go to the profile screen in the App, and then tap on the “Delete My Account” button and confirm. Alternatively, you may request account deletion by email (support@myfoodrepo.org). This will delete all Account Data and metadata on our servers.

You can delete your pictures one by one from within the App. If you want to delete all your pictures, you may contact us via email (support@myfoodrepo.org). Deleting your account will delete your pictures.

9. Changes to this Privacy Policy

We may revise this Privacy Policy from time to time. The most current version of the policy will govern our processing of your personal data and will always be at https://v2.myfoodrepo.org/privacy. In case of modifications, we will publish a notice on the Website. Therefore, it is strongly recommended to check the Website regularly. If you disagree to any of the changes to the Privacy Policy, you must stop using our Services and delete your account.