CPAPAnalyzer Privacy Policy

1. CPAPAnalyzer Privacy Policy – personal data controller

The controller of personal data processed within CPAPAnalyzer.pl is:

In the remainder of this Policy, this entity is referred to as the “Controller” or “CPAPAnalyzer”.

In certain relationships with medical Facilities, CPAPAnalyzer may act not as the controller but as a processor acting on behalf of a given Facility. The rules for such processing are also described in the section concerning physicians and Facilities.

2. CPAPAnalyzer Privacy Policy – scope of this document

This Policy applies to the processing of personal data in connection with the use of:

• public CPAPAnalyzer.pl pages,
• registration and login,
• the User Dashboard,
• PAP therapy data Import,
• therapy and trend analysis,
• the Mask Test,
• leak analysis,
• Reports and PDF files,
• automated Interpretation of data,
• functions using artificial intelligence models,
• the Professional Dashboard,
• physician Accounts,
• Facility and clinic Accounts,
• payments,
• contact with the Controller,
• technical support,
• cooperation with partners.

3. What data may be processed

The scope of data depends on how the Service is used. CPAPAnalyzer may process in particular:

Identification and contact data

• first name,
• last name,
• email address,
• telephone number,
• date of birth, if provided as part of the Account,
• other data voluntarily provided in the profile.

Account data

• Account identifier,
• Account status,
• registration date,
• information about email address confirmation,
• selected Plan,
• access period,
• history of significant operations on the Account.

PAP therapy data

• therapy time,
• therapy sessions,
• AHI,
• respiratory events,
• leaks,
• pressure,
• therapy settings available in the source data,
• mask information,
• trends,
• period comparisons,
• data created in the Mask Test module,
• other parameters read from a supported device.

Technical data

• IP address,
• date and time of connection,
• technical information about the browser and device,
• server logs,
• information related to errors and security.

Professional User data

• data of a physician or another authorized person,
• Facility data,
• role and scope of permissions,
• information needed to verify a Professional Account,
• links to assigned Patients.

4. Health data

Such data is subject to enhanced protection under the GDPR.

Where a person uses their own User Account, therapy data is processed only where there is an appropriate basis under the GDPR, including – to the extent required by law – the explicit consent of the data subject.

If Patient data is processed by CPAPAnalyzer on behalf of a Facility, the legal basis for processing the Patient's data is determined by the relevant data controller – for example, the Facility – and CPAPAnalyzer may act as a processor under an appropriate data processing agreement.

Acceptance of the Terms of Service alone does not replace explicit consent required for processing health data where the processing is based specifically on consent.

5. Purposes and legal bases for processing

6. Registration and User Account

Data provided during registration is used to create and maintain the Account and to provide access to Service functions.

CPAPAnalyzer may require confirmation of the email address before login is enabled.

To protect forms and the registration process, the Service may use its own technical mechanisms, such as security tokens, nonces, rate-limiting mechanisms, a honeypot or other mechanisms designed to prevent automated abuse.

Account data is not publicly available.

7. Therapy Data and Import

The User may provide CPAPAnalyzer with data originating from a compatible PAP device, in particular from an SD card or another supported source.

The data is processed by the Service's mechanisms in order to create, among other things:

• therapy results,
• therapy history,
• trends,
• leak analysis,
• pressure analysis,
• the Mask Test,
• period comparisons,
• Reports.

CPAPAnalyzer should process only the data needed to perform the functions selected by the User.

The User should retain the original device data independently of the data stored in CPAPAnalyzer.

8. Artificial intelligence and the OpenAI API

CPAPAnalyzer may use models made available through OpenAI API to create descriptive Interpretation of previously calculated therapy results.

First, the data is processed by CPAPAnalyzer's analytical mechanisms; then a limited scope of prepared results needed to create descriptive Interpretation may be sent to the model.

In particular, CPAPAnalyzer designs this process so that data such as the following is not sent to the AI model:

• Patient's first and last name,
• home address,
• telephone number,
• email address,

where such information is not necessary to perform the specific operation.

Information related to therapy may, however, be sent to the OpenAI API, for example AHI values, events, leaks, pressure, therapy time, trends or other results required to prepare the Interpretation.

Despite limiting identification data, this information may still constitute health data.

For entities using the API in the European Economic Area, the service provider is the relevant OpenAI group entity, in particular OpenAI Ireland Ltd., in accordance with the current OpenAI terms of service.

According to OpenAI's rules for business services and the API, data sent through the API is not used to train OpenAI models by default.

In the standard configuration, certain inputs, outputs or logs related to use of the API may be retained by OpenAI for up to 30 days for purposes including security and abuse detection, unless a different retention mechanism applies to the solution being used.

CPAPAnalyzer does not use AI Interpretation to make automatic changes to a PAP device.

AI Interpretation may contain errors or simplifications and does not replace an individual assessment by a physician.

9. Physicians, clinics and Facilities

CPAPAnalyzer provides functions intended for physicians and Facilities that enable access to data of properly assigned Patients.

Patient Account

If a Patient uses their own Account and grants access to a physician or Facility, CPAPAnalyzer enables technical management of such access in accordance with the permissions granted.

Data processed on behalf of a Facility

If a Facility provides CPAPAnalyzer with Patient data and commissions its processing as part of the service, the Facility may act as the data controller, while CPAPAnalyzer may act as a processor within the meaning of Article 28 GDPR.

In such a case, the scope, purpose, duration and rules of data processing should also be specified in a data processing agreement or another required legal instrument.

This Policy does not replace a Facility's information obligations toward its Patients.

Physician and personnel data

CPAPAnalyzer remains the controller of data needed to maintain a Professional Account, in particular contact and identification data and information about roles and permissions.

10. Hosting, infrastructure and backups

The CPAPAnalyzer.pl server infrastructure is maintained using the services of LH.pl.

According to information published by LH.pl, the hosting infrastructure used for hosting services is located in Poland.

The hosting infrastructure may store, among other things:

• Service files,
• database,
• Therapy Data,
• Account information,
• technical logs,
• backups.

Backups are stored within the hosting infrastructure in accordance with the configuration and backup cycle of the service being used.

After data is deleted from the active database, copies may remain in backups for a limited period until they are replaced as part of the normal backup cycle.

Mailboxes in the domain @cpapanalyzer.pl are managed by the Controller.

11. Payments

Payments for CPAPAnalyzer services are made directly to the Controller's bank account.

In this model, CPAPAnalyzer does not use an external payment gateway that requires therapy data to be provided to a payment operator.

Banks involved in processing a transfer process payment-related data in accordance with banking law and their own legal obligations.

Payment-related data may be retained for the period required by applicable tax and accounting regulations or for the purpose of establishing, pursuing or defending claims.

12. Advertising and partners

Advertising may be selected contextually according to where it is displayed.

For example, an advertisement concerning masks may be displayed in the part of the Service concerning masks, but its display should not depend on:

• a specific User's AHI,
• the type of respiratory events,
• leak level,
• therapy pressure,
• diagnosis,
• Mask Test result,
• other individual health data.

An advertising partner does not receive a User's individual Therapy Data by virtue of running an advertising campaign.

Campaign reporting may include aggregate data such as:

• number of impressions,
• number of clicks,
• CTR,
• UTM campaign identifiers.

After an advertisement is clicked and the user moves to an external partner's website, further data processing is carried out in accordance with that partner's rules.

13. Cookies and similar technologies

The Service may use cookies and similar technical mechanisms.

Necessary cookies may be used without consent where they are required for:

• maintaining a session,
• login,
• security,
• remembering necessary settings,
• proper operation of the Service.

If CPAPAnalyzer uses analytical, advertising or other cookies or technologies whose use requires consent, they will be activated in accordance with applicable consent requirements.

Detailed rules concerning cookies are described in the separate Cookie Policy.

14. Recipients and processors

Access to data may be entrusted only to entities where this is necessary to provide the service or required by law.

Recipients or processors may include in particular:

• LH.pl – hosting and technical infrastructure,
• OpenAI – in connection with the use of AI functions,
• banks involved in processing payments,
• physicians and Facilities with valid authorization to access the data of a given Patient,
• entities providing legal, accounting or technical services where access to data is genuinely necessary,
• public authorities where the obligation to disclose data arises from law.

Advertising partners do not receive individual Therapy Data solely because they run advertising in CPAPAnalyzer.

15. Transfers of data outside the EEA

CPAPAnalyzer's primary hosting infrastructure is maintained by LH.pl in Poland.

Use of the OpenAI API may, however, involve processing of data by entities or subprocessors also located outside the European Economic Area.

In such a case, data transfers should take place in accordance with mechanisms permitted under the GDPR, in particular on the basis of an adequacy decision or Standard Contractual Clauses approved by the European Commission.

OpenAI publishes an up-to-date list of its subprocessors and the data transfer mechanisms it uses.

16. How long we retain data

Data is not retained for longer than is necessary for the purpose for which it was collected.

Account

As a rule, Account-related data is retained for the period during which the Account is used and, after its deletion, only to the extent that further retention is justified by a legal obligation or the need to establish, pursue or defend claims.

Therapy Data

Therapy Data is retained until it is deleted by the User, the Account is deleted, the relevant basis for processing is withdrawn, or another basis for ending the processing arises – subject to legal obligations and claims.

Payment data

Payment-related data is retained for the period required by tax, accounting and claims-related regulations.

Correspondence

Correspondence is retained for the period needed to handle the matter and then, where necessary, for a period related to possible claims.

Technical logs

Technical logs are retained for a period justified by the need to ensure security, diagnose errors and protect the Service.

Backups

Deleted data may remain in backups for a limited period until it is overwritten in accordance with the backup cycle.

OpenAI API

In the standard OpenAI API configuration, certain data related to a request or response may be retained by OpenAI for up to 30 days, unless a different retention method applies to a specific endpoint or configuration.

17. CPAPAnalyzer Privacy Policy – data subject rights

To the extent provided by the GDPR, the data subject may have the right to:

• access their data,
• receive a copy of their data,
• rectify their data,
• have their data erased,
• restrict processing,
• data portability,
• object to processing based on legitimate interests,
• withdraw consent where processing is based on consent.

The scope of a specific right depends on the legal basis and the nature of the processing.

Requests concerning data may be sent to:

kontakt@cpapanalyzer.pl

The data subject also has the right to lodge a complaint with the President of the Polish Personal Data Protection Office (UODO), if they believe that their data is being processed in violation of the GDPR.

18. Withdrawal of consent

Where specific processing is based on consent, that consent may be withdrawn at any time.

Withdrawal of consent does not affect the lawfulness of processing carried out before the consent was withdrawn.

Where explicit consent is the basis for processing health data, withdrawal of that consent may make it impossible to continue providing functions that require processing of such data.

Withdrawal of consent may be submitted using the relevant Account function, if available, or via:

kontakt@cpapanalyzer.pl

19. Profiling and automated decision-making

CPAPAnalyzer automatically processes Therapy Data to create analyses, charts, trends, comparisons and Interpretation.

Such automated processing does not mean that CPAPAnalyzer makes a medical decision on behalf of the Patient.

The Service is not intended to make decisions based solely on automated processing that produce legal effects concerning the User or similarly significantly affect the User.

Health data is not used for advertising profiling.

20. Data security

The Controller applies technical and organizational measures appropriate to the nature of the Service and the data being processed.

The measures may include in particular:

• access control for Accounts,
• authentication mechanisms,
• restricted access to private dashboards,
• form protection mechanisms,
• protection against repeated login attempts,
• session and security-token mechanisms,
• backups,
• system and code updates,
• use of hosting infrastructure intended for the provision of online services.

Detailed and verified information about the safeguards used may be published on the “Security and Data Protection” page.

Incidents or suspected unauthorized access may be reported to:

pomoc@cpapanalyzer.pl

21. Data of other persons

The User should not provide the Service with data concerning another person unless the User has an appropriate legal basis or authorization.

A physician, Facility or other person using Patient data is required to ensure an appropriate basis for access to such data.

When using the Service on behalf of a minor or a person represented by a legal representative, the authorization required by applicable law must be held.

22. Technical logs and security

When CPAPAnalyzer is used, the server may automatically record technical information such as:

• IP address,
• date and time of the request,
• address of the requested resource,
• browser information,
• server response code,
• information related to errors or security.

This data may be used for diagnostics, security, abuse prevention and maintenance of the Service.

23. Links and external services

CPAPAnalyzer may contain links to external services, including partner, manufacturer and social-media websites and other services.

After visiting an external website, data processing takes place in accordance with the rules of that website's operator.

CPAPAnalyzer is not responsible for the privacy policies of independent third parties.

24. CPAPAnalyzer Privacy Policy – changes to this document

This Policy may be updated, in particular in the event of:

• changes in law,
• changes in the way data is processed,
• addition of new functions,
• changes to technical service providers,
• changes to infrastructure,
• changes in the operation of AI,
• launch of new professional functions.

The current version of the Policy is published on CPAPAnalyzer.pl together with its effective date.

25. Contact regarding privacy matters

For matters relating to privacy, access to data, deletion of data or the exercise of other rights, contact the Controller: