Privacy Policy

1. Who we are

HHT Compass is the patient diary app for the Diamond Trial (protocol DIAG723-PT-CL-001, a clinical study of a treatment for hereditary haemorrhagic telangiectasia (HHT).

The controller of your personal data — the organisation that decides why and how it is processed — is the study sponsor:

Your study site — the hospital or clinic where you enrolled — is a separate controller for your medical records and for the document that links your Patient ID to your identity. Their own privacy notice covers that, and their contact details are on your informed consent form and in the app under Menu → Support.

2. Who this policy covers

This policy applies to you if you are an enrolled participant in the Diamond Trial using either:

• the HHT Compass mobile app on iOS or Android, or
• the patient web portal, which does the same thing in a browser.

It does not cover the separate clinical portal used by study staff, which has its own notice, nor anything your study site or your own doctor does with your medical records.

You cannot use HHT Compass without an account, and accounts are issued only to enrolled participants. Registration needs an email address plus a Patient ID and Study ID that your study team gives you, and every new account is reviewed by the study team before it is activated.

3. What data we collect

3.1 Account and identity data

• Email address — used to sign in, to verify your address, and to reset your password
• Password — stored only as a salted hash; we never see or store the password itself
• Patient ID (in the form XXX-001, where the first three letters identify the study site) and Study ID
• Participant type, enrolment date and enrolment status (for example Screening, Active, Withdrawn, Completed)
• Your study site, and its name, address and support contacts
• Time zone — so that a diary entry is recorded against the right calendar day

3.2 Health data you record

This is the heart of the app, and it is special category data under the GDPR, which means it gets a higher level of protection.

• Nosebleed episodes: the date it happened, how long it lasted in minutes, the worst blood-flow intensity (spotting, dripping, dripping quickly, steady stream, pouring, gushing), and whether it happened while you were asleep
• Days with no nosebleed: your confirmation that a given day was clear
• Late entries: if you record something after the fact, the reason (forgot, technical problem, other) and what prompted you (a reminder, or something else)
• Health survey responses: your answers about your overall state of health, which the app offers periodically
• Entry metadata: when each entry was created, the time zone it was created in, and whether it came from the phone app or the web portal

3.3 Problem reports

If you report a technical or data problem, we receive the category, your description (up to 3,000 characters), the date you flagged, and up to 12 photos or screenshots if you choose to attach them. To help us reproduce the problem, the report also carries the app version and build, your operating system and its version, your device model and, in the browser, your browser and its version.

Attaching a photo asks your permission to reach your photo library. The app never opens your camera or microphone — those permissions are switched off in the build. Please do not attach photographs of yourself, of other people, or of anything showing your health, unless the study team has asked you to.

3.4 Reminders and notifications

If you turn on reminders, we store your chosen reminder time and a push notification token issued by Apple or Google for your device. The token identifies the device, not you, and it lets us deliver the reminder. Reminder content is deliberately generic and does not mention your health.

3.5 Technical and security data

• Server logs of requests to our systems, including IP address, timestamp and the endpoint called, kept for security monitoring and troubleshooting
• Authentication events such as sign-in, sign-out, password change and token refresh
• An audit trail of changes to study data — who changed what, and when. Good Clinical Practice requires this, and it is written to storage that cannot be altered or deleted, even by us

3.6 Data stored on your own device

The mobile app keeps some data locally so that it works without a connection:

• Your sign-in tokens, in the platform's secure store (iOS Keychain / Android Keystore)
• Your app PIN, stored only as a salted hash — never as the four digits themselves
• An encrypted cache of your recent diary data, so the app opens instantly and lets you record an entry offline; a queued entry is sent when you are back online
• Non-sensitive settings such as your language and reminder preference

The web portal stores nothing on your computer. Your session is held in memory only and disappears when you close the tab.

4. What we do not collect

Specifically, we do not collect:

• your location, at any precision
• your contacts, calendar, call history, SMS messages or files
• advertising identifiers (IDFA, GAID) or any cross-app or cross-site identifier
• camera or microphone recordings
• your browsing activity outside HHT Compass
• biometric data — if you enable Face ID, Touch ID or a fingerprint unlock, that check happens entirely on your device and the result never leaves it

We do not sell your personal data, we do not share it for advertising or marketing, and we do not use it to build profiles about you.

5. Why we use your data, and our legal basis

Under the GDPR we need a lawful basis for using your data, and a second, stricter one for health data. Because HHT Compass is a regulated clinical trial, most of what we do rests on legal obligations rather than on consent.

6. Who we share your data with

Your data is shared only with those who need it to run the trial or who are entitled to it by law.

• Your study site and investigator — they can see your diary data to monitor your participation and your safety. They already know who you are.
• The sponsor's study team — monitors and data managers, who work with data identified only by your Patient ID.
• Contract research organisations and the statistics team — who analyse coded trial data. Exports are delivered over an audited, encrypted file transfer channel, and every download is logged.
• Regulators and ethics committees — for example the EMA, national competent authorities and the FDA, who may inspect trial records, including source data.
• Independent auditors and monitors — who verify that the trial was run correctly.
• Our technology providers, acting as processors under contract and only on our instructions:
  • Amazon Web Services — hosting, databases, file storage and email delivery, in the EU
  • Apple (APNs) and Google (FCM) — delivery of push notifications to your device, if you enable reminders
• Courts and authorities, where we are legally required to disclose.

If the trial or the sponsor is transferred to another organisation, your data may transfer with it, and the new owner takes on the same archiving duties. You would be informed.

Results are published as aggregate statistics. Nothing published identifies you.

7. Where your data is stored

Your data is hosted on Amazon Web Services in the eu-central-1 region (Frankfurt, Germany), inside the European Union.

Some recipients are outside the EEA — study sites in the United States, Canada, Australia and New Zealand, the FDA, and other national regulators. Where we transfer personal data to a country without an EU adequacy decision, we rely on Standard Contractual Clauses (Art. 46 GDPR) with supplementary measures, or on the derogations in Art. 49 where a transfer to a regulator is legally required. You can ask us for a copy of the safeguards in place.

Push notification tokens are handled by Apple and Google, which may process them outside the EEA under their own transfer mechanisms.

8. How we protect your data

• In transit: everything between the app and our servers travels over TLS. Certificate validation is enforced.
• At rest: databases, file storage and backups are encrypted with keys managed in AWS Key Management Service.
• On your device: a 4-digit PIN is required to open the app, with optional Face ID, Touch ID or fingerprint unlock. The PIN is stored as a salted hash, tokens sit in the platform secure store, and the local diary cache is encrypted.
• Pseudonymisation: study data is held under your Patient ID. The key that links it to your name stays with your study site.
• Access control: staff access is role-based and least-privilege, and every account is tied to a named individual.
• Immutable audit trail: changes to study data are written to storage locked against modification and deletion, as Good Clinical Practice requires.
• Network protection: a web application firewall, private networking and continuous monitoring with alerting.
• Storage hygiene: file storage is private by default with public access blocked, and versioning enabled.

No system is perfectly secure. If a breach occurs that is likely to result in a high risk to you, we will notify you and the relevant supervisory authority as the law requires — within 72 hours of becoming aware, where the GDPR applies.

What you can do: keep your device locked and up to date, do not share your PIN or password, and tell your study site straight away if you lose your device or think someone else has used your account.

9. How long we keep your data

The rules that require it:

• EU Clinical Trials Regulation (EU) No 536/2014, Art. 58 — the sponsor and the investigator must archive the clinical trial master file for at least 25 years after the end of the trial
• 21 CFR 312.62(c) (United States) — investigators retain records for 2 years after a marketing application is approved for the indication studied, or 2 years after the investigation is discontinued and the FDA is notified
• ICH E6 Good Clinical Practice, the study protocol, and equivalent national rules in each participating country

Where periods differ, we apply the longest that applies to your data.

10. Your rights

Depending on where you live, you have some or all of the following rights. To exercise any of them, write to dpo@diagonaltx.com. We will respond within one month, and will tell you if we need longer and why. We do not charge for this.

• Access — ask what data we hold about you and get a copy
• Rectification — have inaccurate data corrected. In a trial, corrections are made through a controlled process that keeps the original value visible in the audit trail; nothing is silently overwritten.
• Erasure — ask us to delete your data, subject to the limits below
• Restriction — ask us to limit processing while a dispute is resolved
• Objection — object to processing based on legitimate interests
• Portability — receive the data you gave us in a machine-readable format, where it is processed by automated means on the basis of consent or contract
• Withdraw consent — for anything based on consent, such as reminders, without affecting what happened before
• Complain — to your national data protection authority. In the EU, that is the authority where you live, work, or where the alleged infringement happened.

The limits on erasure

Your study data cannot be erased on request. GDPR Art. 17(3) disapplies the right to erasure where processing is necessary for compliance with a legal obligation — Art. 17(3)(b) — and for scientific research or archiving in the public interest where erasure would make that research impossible or seriously impair it — Art. 17(3)(d). Both apply to clinical trial records.

What we can do is close your account, which removes your sign-in credentials and stops the app working for you. See Account deletion for how to request that and exactly what is removed.

Withdrawing from the study

You may leave the Diamond Trial at any time, without giving a reason and without any effect on your medical care. That is arranged with your study doctor, not through this app. Withdrawing stops the collection of new data; data collected up to that point is kept, for the reasons above.

Automated decision-making

We do not make decisions about you by automated means, and we do not profile you. The app calculates reminder timing and how often to offer the health survey, but nothing about your treatment or your participation is decided automatically.

11. Cookies and tracking

The patient web portal does not use cookies. It sets no advertising, analytics or preference cookies, and it stores nothing in your browser's local storage. Your session is held in memory and ends when you close the tab, which is a deliberate choice so that no patient data is written to a shared or public computer.

The mobile app contains no tracking technologies. There is no cookie banner because there is nothing to consent to.

12. Children

HHT Compass is not a general-audience app and cannot be used by anyone who is not enrolled in the Diamond Trial. Participants must be at least 18 years old, as set by the study protocol and approved by the ethics committees. Where a participant is a minor under local law, enrolment and data processing additionally require the consent of a parent or legal guardian, obtained by the study site.

13. Regional information

European Economic Area and United Kingdom

The GDPR (and, in the UK, the UK GDPR and Data Protection Act 2018) applies to processing described here. You may complain to your national supervisory authority; in the UK this is the Information Commissioner's Office. Contact details for our DPO and, where applicable, our Art. 27 representative are in section 1.

United States

Clinical trial records are governed principally by FDA regulations (21 CFR Parts 11, 50, 54, 56 and 312) and, for US sites, by the Common Rule. If your study site is a HIPAA covered entity, its use and disclosure of your protected health information is governed by the HIPAA authorisation you signed with that site, and by the site's own Notice of Privacy Practices — not by this policy.

Several US states give residents rights over personal information. Most of those laws exempt information collected in, or used for, clinical trials conducted under Good Clinical Practice or the Common Rule, and information covered by HIPAA. Where an exemption does not apply, you may exercise your rights by writing to us. We do not sell personal information, and we do not share it for cross-context behavioural advertising, under any definition of those terms.

Canada

Processing is subject to PIPEDA and to provincial health privacy legislation, including Quebec's Law 25. Complaints may be made to the Office of the Privacy Commissioner of Canada or to your provincial commissioner.

Australia and New Zealand

In Australia, the Privacy Act 1988 and the Australian Privacy Principles apply, together with the NHMRC National Statement on Ethical Conduct in Human Research. Complaints may be made to the Office of the Australian Information Commissioner. In New Zealand, the Privacy Act 2020 and the Health Information Privacy Code apply, and complaints may be made to the Office of the Privacy Commissioner.

14. Summary for app store disclosures

This table restates the sections above in the categories used by the Google Play Data safety form and Apple's App Privacy labels. Nothing in it is used for tracking or advertising, and nothing is linked to you across other companies' apps or websites.

Data is encrypted in transit. You can request account deletion — see Account deletion — noting the retention obligations in section 9.

15. Changes to this policy

We may update this policy, for example if the trial changes or the law does. The effective date at the top of the page always shows the current version, and we keep previous versions on file. If a change materially affects how your data is used, we will tell you in the app, by email, or through your study site — and where a change requires ethics committee approval, we will obtain it first.

16. Contact us