Privacy Policy (App)

Privacy Policy of Relisten/Revidence (the solution)

The solution collects some Personal Data from its Users.

Owner and Data Controller

Recog Analytics – Paseo de la Castellana, 194, 28046, Madrid, Madrid, Spain

Owner contact email address: contact@recog.es

Types of Data collected

Among the types of Personal Data collected by the solution, either directly or through third parties, are: Usage Data; IP address; device information; browser information; operating systems; city; postal code; state; county; country; latitude (of the city); longitude (of the city); metropolitan area; geographic region; Trackers; email address; password; configuration and professional profile data: medical specialty, workplace and professional geography declared by the User, such as city, province, autonomous community or country.

Full information regarding each category of Personal Data collected is provided in the sections of this privacy policy dedicated to that purpose or through specific explanatory texts shown before such Data is collected.

Personal Data may be freely provided by the User or, in the case of Usage Data, collected automatically when the solution is used.

Unless otherwise stated, all Data requested by the solution is mandatory and failure to provide it may make it impossible for the solution to provide its services. In cases where the solution specifically states that certain Data is not mandatory, Users are free not to communicate such Data without this having any consequence for the availability or operation of the Service. Users who have doubts about which Data is mandatory may contact the Owner.

The use of Cookies – or other tracking tools – by the solution or by the owners of third-party services used by the solution is intended to provide the Service requested by the User, in addition to any other purposes described in this document.

The User assumes responsibility for any third-party Personal Data obtained, published or shared through the solution.

Method and place of processing of the Data collected

Methods of Processing

The Owner shall process Users’ Data properly and shall adopt appropriate security measures to prevent unauthorized access, disclosure, alteration or destruction of the Data.

Data processing shall be carried out using computers and/or IT tools, following procedures and organizational methods strictly related to the purposes indicated. In addition to the Owner, in some cases certain categories of authorized persons related to the operation of the solution (administration, sales, marketing, legal department and system administration) or external contractors providing services to the Owner (such as external technical service providers, courier companies, hosting companies, IT companies, communication agencies) may have access to the Data and shall be appointed by the Owner as Data Processors, if necessary. An updated list of such persons may be requested from the Owner at any time.

Place

Data processing is carried out on cloud infrastructure managed by the service providers contracted by the Owner. This infrastructure may be located in different countries, which could involve the transfer of Data to other jurisdictions, depending on the location of the servers.

The Owner ensures that such transfers comply with the applicable data-protection regulations, implementing appropriate safeguards to protect Users’ privacy.

For more information about the specific locations and processing of Personal Data, Users may consult the corresponding section of this Policy.

Retention period

Unless otherwise stated in this document, Personal Data shall be processed and retained for the time necessary and for the purpose for which it was collected, and may be retained for longer due to a relevant legal obligation or based on Users’ consent.

Purpose of Processing of the Data collected

Data relating to the User is collected to allow the Owner to provide its Service, comply with its legal obligations, respond to enforcement requests, protect its rights and interests (or those of its Users or third parties), detect any malicious or fraudulent activity, as well as for the following purposes: traffic optimization and distribution, hosting and backend infrastructure, and registration and authentication provided directly by the solution; managing and configuring the User profile; personalizing the solution’s responses and functionalities according to the User’s specialty, workplace and geographic scope; and, when authorized by the User, communicating certain profile data to third parties for the purposes indicated in this Policy.

Users can find specific information about the Personal Data used for each purpose in the section “Detailed information on the Processing of Personal Data”.

Detailed information on the Processing of Personal Data

Personal Data is collected for the following purposes and using the following services:

Hosting and backend infrastructure

These types of services are intended to host Data and files in order to allow the solution to operate and be distributed, as well as to provide an infrastructure that is ready to operate and that allows various functionalities or parts of the solution to be launched.

Some of the services listed below, where applicable, may operate through geographically distributed servers, which makes it difficult to determine the exact location where Personal Data is stored.

Amazon S3 (Amazon Web Services, Inc.)

Amazon S3 is a cloud storage service provided by Amazon Web Services, Inc.

Personal Data processed: Usage Data.

Place of processing: United States – Privacy Policy.

Category of Personal Information collected under the CCPA: internet or other electronic network activity information.

Traffic optimization and distribution

These types of services allow the solution to distribute its content through servers located in various countries and to optimize its performance.

The Personal Data processed will depend on the characteristics and implementation methods of these services, which by their nature filter communications between the solution and the User’s browser. Given the distributed nature of this system, it is difficult to determine the exact location to which content that may contain the User’s Personal Data is transferred.

Amazon CloudFront (Amazon Web Services, Inc.)

Amazon CloudFront is a traffic optimization and distribution service provided by Amazon Web Services, Inc.

Personal Data processed: city; county; postal code; Usage Data; IP address; state; device information; browser information; latitude (of the city); longitude (of the city); country; geographic region; operating systems; metropolitan area.

Place of processing: Ireland – Privacy Policy.

Category of Personal Information collected under the CCPA: identifiers; internet or other electronic network activity information; geolocation data.

Registration and authentication provided directly by the solution

By registering or authenticating, the User allows the solution to identify them and give them access to dedicated services. Personal Data is collected and stored only for registration or identification purposes. Only the Data necessary to provide the service requested by Users is collected.

Direct registration

The User registers by filling out the registration form and providing their Personal Data directly to the solution.

Personal Data processed: Usage Data; email address; password; Trackers.

Category of Personal Information collected under the CCPA: identifiers; internet or other electronic network activity information.

Profile configuration and personalization
The solution processes the configuration data provided by the User to create and maintain their professional profile and to adapt the Service’s responses, content and functionalities.
Data processed: email address, medical specialty, workplace and declared professional geography.
Legal basis: performance of the contract with respect to the data necessary to provide the requested Service, and consent with respect to optional fields or uses.
Retention: while the account remains active and, after its deletion, for the period strictly necessary to address legal liabilities.

Communication of data to third parties
The solution may communicate the User’s email address and professional profile data — medical specialty, workplace and professional geography — as well as usage metadata (categorization of cases of clinical interest) to IQVIA in order to facilitate their availability to life-sciences companies that may search for profiles for clinical trials or other activities of interest to them.
These third parties may process the data as independent controllers and must provide the User with their own data-protection information. This communication is not necessary in order to use the solution and the User may withdraw their consent at any time from settings, without affecting processing carried out previously.

Further information for Users

Legal basis of Processing

The Owner may process the User’s Personal Data if one of the following conditions applies:
– Users have given their consent for one or more specific purposes.
– Obtaining Data is necessary for the performance of a contract with the User and/or any pre-contractual obligation thereof.
– Processing is necessary for compliance with a legal obligation binding on the User.
– Processing is related to a task carried out in the public interest or in the exercise of official authority vested in the Owner.
– Processing is necessary for the purposes of a legitimate interest pursued by the Owner or by a third party.

In any case, the Owner is available to define the specific legal bases that apply to the processing and, in particular, whether obtaining the Personal Data is a contractual or statutory requirement or a requirement necessary to enter into a contract.

Further information on retention time

Therefore:
– Personal Data collected for the performance of a contract between the Owner and the User shall be retained as such until that contract has been fully performed.
– Personal Data collected on the basis of the Owner’s legitimate interest shall be retained for as long as necessary to fulfill that purpose. Users can find specific information related to the Owner’s legitimate interest by consulting the relevant sections of this document or by contacting the Owner.

The Owner may retain Personal Data for an additional period when the User gives consent to such processing, provided that such consent remains valid. In addition, the Owner may be required to retain Personal Data for an additional period whenever necessary to comply with a legal obligation or an order from an authority.

Once the retention period has ended, the Personal Data must be deleted. Therefore, the rights of access, erasure, rectification and data portability may not be exercised once that retention period has expired.

Users’ rights under the General Data Protection Regulation (GDPR)

Users may exercise certain rights in relation to their Data processed by the Owner. In particular, Users have the right to do the following, to the extent permitted by law:
– Withdraw their consent at any time. Users have the right to withdraw their consent where they have previously given it for the processing of their Personal Data.
– Object to the processing of their Data. Users have the right to object to the processing of their Data if such processing is carried out on a legal basis other than consent.
– Access their Data. Users have the right to know whether their Data is being processed by the Owner, to obtain information about certain aspects of the processing, and to obtain a copy of the Data being processed.
– Verify and request rectification. Users have the right to verify the accuracy of their Data and request that it be updated or corrected.
– Restrict the processing of their Data. Users have the right to restrict the processing of their Data. In such a case, the Owner shall process their Data only for storage purposes.
– Erase or delete Personal Data. Users have the right to obtain the erasure of their Data by the Owner.
– Receive their Data and transfer it to another controller. Users have the right to receive their Data in a structured, commonly used and machine-readable format and, where technically feasible, to have it transmitted to another controller without hindrance.
– Lodge a complaint. Users have the right to lodge a complaint with the competent personal-data protection authority.

Users shall also have the right to know the legal bases for Data transfers abroad, including to any international organization governed by Public International Law or formed by two or more countries, such as the UN, and to know the security measures taken by the Owner to safeguard their Data.

Information on the right to object to processing

Where Personal Data is processed in the public interest, in the exercise of official authority vested in the Owner or on the grounds of a legitimate interest pursued by the Owner, Users may object to such processing by providing a reason related to their particular situation to justify their objection.

Users should be aware, however, that if their Personal Data is processed for direct-marketing purposes, they may object to such processing at any time, free of charge and without the need for justification. When the User objects to processing for direct-marketing purposes, the Personal Data may no longer be processed for such purposes. To find out whether Users’ Personal Data is being processed by the Owner for direct-marketing purposes, Users should consult the relevant sections of this document.

How to exercise these rights

Any request to exercise the User’s rights may be addressed to the Owner through the contact details provided in this document. Such requests are free of charge and the Owner shall respond to them as soon as possible and always within one month, providing Users with the information required by law. The Owner shall communicate any rectification or erasure of Personal Data or restriction of processing to each recipient, where applicable, to whom the Personal Data has been disclosed, unless this proves impossible or involves disproportionate effort. At Users’ request, the Owner shall inform them about such recipients.

Further information for Users in Brazil

This section of the document integrates with and supplements the information contained in the rest of the privacy policy and is provided by the company operating the solution and, where applicable, by its parent company, subsidiaries and affiliates (for the purposes of this section, collectively referred to as “we”, “us” or “our”). This section applies to all Users located in Brazil (below, such Users are referred to simply as “you”, “your”, “yours”), in accordance with the “Lei Geral de Proteção de Dados” (the “LGPD”), and with respect to such Users, it supersedes any other divergent or conflicting information contained in the privacy policy.

This part of the document uses the term “Personal Information” as defined in the LGPD.

Reasons why we process your personal information

We may only process your personal information if we have a legal basis for such processing. The legal bases are the following:
– Your consent to the corresponding processing activities;
– The performance of a contract and its pre-contractual measures, in cases where you are a party to that contract;
– The exercise of our rights in judicial, administrative or arbitration proceedings.

For more information about the legal bases, you may contact us at any time using the contact details provided in this document.

Categories of personal information processed

To find out which categories of your personal information are processed, you can read the section entitled “Detailed information on the Processing of Personal Data” in this document.

Why we process your personal information

To find out why we process your personal information, you can read the sections entitled “Detailed information on the Processing of Personal Data” and “Purpose of Processing of the Data collected” in this document.

Your privacy rights in Brazil, how to submit a request and our response to your requests
Your privacy rights in Brazil

You have the right to:
– Obtain confirmation of the existence of processing activities involving your personal information.
– Access your personal information.
– Have incomplete, inaccurate or outdated personal information rectified.
– Obtain the anonymization, blocking or deletion of your unnecessary or excessive personal information, or information that is not being processed in accordance with the LGPD.
– Obtain information about the possibility of giving or denying your consent and the consequences of such actions.
– Obtain information about the third parties with whom we share your personal information.
– Obtain, upon your express request, the portability of your personal information (except anonymized information) to another service or product provider, provided that our trade and industrial secrets are protected.
– Achieve the deletion of your personal information that is being processed if the processing is based on your consent, unless one or more of the exceptions provided for in art. 16 of the LGPD apply.
– Revoke your consent at any time.
– File a complaint regarding your personal information with the ANPD (the National Data Protection Authority) or with consumer-protection bodies.
– Object to a processing activity in cases where the processing is not carried out in accordance with the law.
– Request clear and adequate information about the criteria and procedures used for an automated decision.
– Request the review of decisions made solely on the basis of automated processing of your personal information and affecting your interests. This includes decisions that define your personal, professional, consumer or credit profile, or aspects of your personality.

You will never be discriminated against or suffer any other type of harm if you exercise your rights.

How to submit your request

You may submit your express request to exercise your rights free of charge, at any time, using the contact details provided in this document or through your legal representative.

How and when we will respond to your request

We will endeavor to respond promptly to your requests.

In any case, if it is impossible for us to do so, we will make sure to inform you of the factual or legal reasons that prevent us from granting your requests immediately or even absolutely. In cases where we are not processing your personal information, we will indicate the individual or legal entity to whom you should address your requests, if we are in a position to do so.

If you submit a request for access or confirmation of processing of personal information, please make sure to specify whether you want your personal information to be delivered to you in electronic or printed format. You must also inform us whether you want us to respond to your request immediately, in which case we will do so in a simplified manner, or whether you need a complete statement instead.

In the latter case, we will respond within 15 days from the time of your request, providing you with all information about the origin of your personal information, confirmation of whether records exist or not, any criteria used in the processing, and the purposes of the processing, while protecting our trade and industrial secrets.

If you submit a request for rectification, deletion, anonymization or blocking of personal information, we will make sure to immediately communicate your request to other parties with whom we have shared your personal information in order to allow such third parties to also comply with your request – except in cases where such communication proves impossible or involves disproportionate effort on our part.

Transfers of personal information outside Brazil permitted by law

We are allowed to transfer your personal information outside the territory of Brazil in the following cases:
– When the transfer is necessary for international legal cooperation between public intelligence, investigation and judicial bodies, in accordance with the legal means established under international law.
– When the transfer is necessary to protect your life or physical safety or that of a third party.
– When the transfer is authorized by the ANPD.
– When the transfer results from a commitment assumed in an international cooperation agreement.
– When the transfer is necessary for compliance with a public policy or a legal attribution of a public service.
– When the transfer is necessary for compliance with a legal or regulatory obligation, the performance of a contract or its pre-contractual measures, or the regular exercise of rights in judicial, administrative or arbitration proceedings.

Further information for Users in the United States

This part of the document integrates with and supplements the information contained in the rest of the privacy policy and is provided by the business running the solution and, if the case may be, its parent, subsidiaries and affiliates (for the purposes of this section referred to collectively as “we”, “us”, “our”).

The information contained in this section applies to all Users (Users are referred to below, simply as “you”, “your”, “yours”), who are residents in the following states: California, Virginia, Colorado, Connecticut, Utah, Texas, Oregon, Nevada, Delaware, Iowa, New Hampshire, New Jersey, Nebraska and Montana.

For such Users, this information supersedes any other possibly divergent or conflicting provisions contained in the privacy policy. This part of the document uses the term Personal Information (and Sensitive Personal Information).

Notice at collection

The following Notice at collection provides you with timely notice about the categories of Personal Information collected or disclosed in the past 12 months so that you can exercise meaningful control over our use of that Information.

While such categorization of Personal Information is mainly based on California privacy laws, it can also be helpful for anyone who is not a California resident to get a general idea of what types of Personal Information are collected.

Identifiers
Internet or other electronic network activity information
Geolocation data

You can read the definitions of these concepts inside the “Definitions and legal references section” of the privacy policy.

To know more about your rights to limit the use of your sensitive personal information (“Limit the Use of My Sensitive Personal Information”) you can refer to the “Your privacy rights under US state laws” section of our privacy policy.

For more details on the collection of Personal Information, please read the section “Detailed information on the processing of Personal Data” of our privacy policy.

We won’t process your Information for unexpected purposes, or for purposes that are not reasonably necessary to and compatible with the purposes originally disclosed, without your consent.

What are the sources of the Personal Information we collect?

We collect the above-mentioned categories of Personal Information, either directly or indirectly, from you when you use the solution.

For example, you directly provide your Personal Information when you submit requests via any forms on the solution. You also provide Personal Information indirectly when you navigate the solution, as Personal Information about you is automatically observed and collected.

Finally, we may collect your Personal Information from third parties that work with us in connection with the Service or with the functioning of the solution and features thereof.

Your privacy rights under US state laws

You may exercise certain rights regarding your Personal Information. In particular, to the extent permitted by applicable law, you have:

– the right to access Personal Information: the right to know. You have the right to request that we confirm whether or not we are processing your Personal Information. You also have the right to access such Personal Information;
– the right to correct inaccurate Personal Information. You have the right to request that we correct any inaccurate Personal Information we maintain about you;
– the right to request the deletion of your Personal Information. You have the right to request that we delete any of your Personal Information;
– the right to obtain a copy of your Personal Information. We will provide your Personal Information in a portable and usable format that allows you to transfer data easily to another entity – provided that this is technically feasible;
– the right to opt out from the Sale of your Personal Information;
We will not discriminate against you for exercising your privacy rights.
– the right to non-discrimination.

Additional rights for Users residing in California

In addition to the rights listed above common to all Users in the United States, as a User residing in California, you have:
– The right to opt out of the Sharing of your Personal Information for cross-context behavioral advertising;
– The right to request to limit our use or disclosure of your Sensitive Personal Information to only that which is necessary to perform the services or provide the goods, as is reasonably expected by an average consumer. Please note that certain exceptions outlined in the law may apply, such as when the collection and processing of Sensitive Personal Information is necessary to verify or maintain the quality or safety of our service.

Additional rights for Users residing in Virginia, Colorado, Connecticut, Texas, Oregon, Nevada, Delaware, Iowa, New Hampshire, New Jersey, Nebraska and Montana

In addition to the rights listed above common to all Users in the United States, as a User residing in Virginia, Colorado, Connecticut, Texas, Oregon, Nevada, Delaware, Iowa, New Hampshire, New Jersey, Nebraska and Montana, you have:
– The right to opt out of the processing of your personal information for Targeted Advertising or profiling in furtherance of decisions that produce legal or similarly significant effects concerning you;
– The right to freely give, deny or withdraw your consent for the processing of your Sensitive Personal Information. Please note that certain exceptions outlined in the law may apply, such as, but not limited to, when the collection and processing of Sensitive Personal Information is necessary for the provision of a product or service specifically requested by the consumer.

Additional rights for users residing in Utah and Iowa

In addition to the rights listed above common to all Users in the United States, as a User residing in Utah and Iowa, you have:
– The right to opt out of the processing of your Personal Information for Targeted Advertising;
– The right to opt out of the processing of your Sensitive Personal Information. Please note that certain exceptions outlined in the law may apply, such as, but not limited to, when the collection and processing of Sensitive Personal Information is necessary for the provision of a product or service specifically requested by the consumer.

How to exercise your privacy rights under US state laws

To exercise the rights described above, you need to submit your request to us by contacting us via the contact details provided in this document.

For us to respond to your request, we must know who you are. We will not respond to any request if we are unable to verify your identity and therefore confirm the Personal Information in our possession relates to you. You are not required to create an account with us to submit your request. We will use any Personal Information collected from you in connection with the verification of your request solely for verification and shall not further disclose the Personal Information, retain it longer than necessary for purposes of verification, or use it for unrelated purposes.

If you are an adult, you can make a request on behalf of a child under your parental authority.

How to exercise your rights to opt out

In addition to what is stated above, to exercise your right to opt out of Sale or Sharing and Targeted Advertising you can also use the privacy choices link provided on the solution.

If you want to submit requests to opt out of Sale or Sharing and Targeted Advertising activities via a user-enabled global privacy control, such as for example the Global Privacy Control (“GPC”), you are free to do so and we will abide by such request in a frictionless manner.

How and when we are expected to handle your request

We will respond to your request without undue delay, but in all cases within the timeframe required by applicable law. Should we need more time, we will explain to you the reasons why, and how much more time we need.

Should we deny your request, we will explain to you the reasons behind our denial (where envisaged by applicable law you may then contact the relevant authority to submit a complaint).

We do not charge a fee to process or respond to your request unless such request is manifestly unfounded or excessive and in all other cases where it is permitted by the applicable law. In such cases, we may charge a reasonable fee or refuse to act on the request. In either case, we will communicate our choices and explain the reasons behind them.

Additional information about Data collection and processing

Legal defense

The User’s Personal Data may be used for the legal defense of the Owner before a court or in the preliminary judicial stages of a possible dispute arising from inappropriate use of the solution or of the related Services. The User acknowledges that the Owner may be required by public authorities to disclose Personal Data.

Additional information about the User’s Personal Data

In addition to the information contained in this privacy policy, the solution may provide the User with additional and contextual information relating to specific Services or to the collection and processing of Personal Data.

System logs and maintenance

For reasons related to operation and maintenance, the solution and any other third-party service used may collect system logs; that is, files that record interaction with the solution and that may contain Personal Data, such as the User’s IP address.

Information not contained in this privacy policy

Additional information about the collection and processing of Personal Data may be requested from the Owner at any time. The contact information is indicated at the beginning of this document.

Amendment of this privacy policy

The Owner reserves the right to amend this privacy policy at any time, notifying Users through this page and, where possible, through the solution and/or, where technically and legally possible, by notifying Users directly if the Owner has the contact information necessary for that purpose. Users are strongly advised to review this page frequently, taking as reference the date of the latest update indicated at the end of the page.

If the changes affect processing activities carried out on the basis of the User’s consent, the Owner shall obtain the User’s new consent, if necessary.

Definitions and legal references

Personal Data (or Data) / Personal Information (or Information)

Personal data means any information that, directly, indirectly or in relation to other information – including a personal identification number – allows a natural person to be identified.

Sensitive Personal Information

Sensitive Personal Information means any Personal Information that is not available to the public and that reveals information considered sensitive under the applicable privacy law.

Usage Data

Information collected automatically by the solution (or by third-party services used by the solution) may include: the IP addresses or domain names of the computers used by the User connecting to the solution, URI (Uniform Resource Identifier) addresses, the time of the request, the method used to submit the request to the server, the size of the file obtained in response, the numerical code indicating the server response status (successful result, error, etc.), the country of origin, the characteristics of the browser and operating system used by the visitor, the various time coordinates of the visit (for example, the time spent on each page) and details relating to the path followed within the Application, with special reference to the sequence of pages viewed and the parameters relating to the User’s operating system and IT environment.

User

The individual using the solution, who, unless otherwise stated, must coincide with the Data Subject.

Data Subject

The natural person to whom the Personal Data refers.

Data Processor (or Processor)

The natural or legal person, public administration, agency or any other body that processes Personal Data on behalf of the Controller, as described in this privacy policy.

Data Controller (or Owner)

The natural or legal person, public administration, agency or any other body that, alone or jointly with others, determines the purposes and means of the processing of Personal Data, including security measures relating to the operation and use of the solution. Unless otherwise specified, the Data Controller is the Owner of the solution.

The solution (or this Application)

The means through which the User’s Personal Data has been collected and processed.

Service

The service provided by the solution, as described in the definitions and legal references (where available) and on this page or application.

Sale

A Sale means any exchange of Personal Information by the Owner with a third party, in exchange for monetary or other valuable consideration, as defined under the applicable privacy law of a U.S. State. Please note that the exchange of Personal Information with a service provider under a written contract that meets the requirements established by applicable law does not constitute a Sale of your Personal Information.

“Sharing”

“Sharing” means any act of sharing, renting, disclosure, release, dissemination, making available, transfer or communication by any other means, whether orally, in writing or by electronic means, of a consumer’s personal information by the business to a third party for cross-context behavioral advertising, whether or not in exchange for monetary or other valuable consideration, including transactions between a business and a third party for cross-context behavioral advertising for the benefit of a business in which no money is exchanged, as defined in California privacy laws. Please note that the exchange of Personal Information with a service provider under a written contract that meets the requirements established by California privacy laws does not constitute an act of “Sharing” your Personal Information.

Targeted advertising

Targeted Advertising means displaying advertisements to a consumer where the advertisement has been selected based on Personal Information obtained from that consumer’s activities over time and across non-affiliated websites or online applications to predict that consumer’s preferences or interests, as defined under applicable U.S. privacy laws.

European Union (or EU)

Unless otherwise stated, all references made to the European Union in this document include all current Member States of the European Union and the European Economic Area.

Cookie

Cookies are Trackers consisting of small amounts of data stored in the User’s browser.

Tracker

Tracker means any technology – e.g. Cookies, unique identifiers, web beacons, embedded scripts, entity tags and fingerprinting – that enables Users to be tracked, for example, by accessing or storing information on the User’s device.

Legal information

This privacy policy has been drafted based on the provisions of multiple laws. This privacy policy refers only to the solution, unless otherwise stated in this document.

Last revised: June 12, 2026