Privacy Policy

1. Introduction and Controller Identity

This Privacy Policy describes how BreasyMed Ltd.("BreasyMed", "we", "us", or "our"), the developer of the BREASY application and platform, collects, uses, stores, and protects personal information in connection with:

• The BREASY mobile application (iOS and Android)
• The BREASY website (breasymed.com and related domains)
• Any related services, tools, or platforms operated by BreasyMed

By using the BREASY app or website, you agree to the practices described in this Privacy Policy.

Data Controller: BreasyMed Ltd.
Contact: [email protected]

2. Information We Collect

2.1 Information You Provide

• Name and contact information (when registering or contacting us)
• Email address and professional role (if applicable)
• Organization or institution name
• Messages or inquiries submitted via contact forms

2.2 Information Collected Automatically

• Device information (device type, operating system version, unique device identifiers)
• App usage data (features accessed, session duration, interaction logs)
• IP address and approximate location (country/region level)
• Crash reports and diagnostic data

2.3 Health and Medical Data (App Users)

When you use BREASY to capture and analyze a child's breathing video:

• Short video recordings of chest and abdominal breathing motion
• Derived respiratory motion analysis outputs
• Session metadata (date, time, duration)
• Any information you voluntarily associate with a session

We treat all health-related data as sensitive personal data and apply the highest level of protection in accordance with applicable data protection laws.

Video recordings undergo an automated anonymization process (face-blurring) as part of analysis. See Section 7 (Data Security, Anonymization, and Research Data Storage) for details on how videos are anonymized and where research data is stored.

3. How We Use Your Information

• To provide, operate, and improve the BREASY application and services
• To analyze respiratory motion patterns and generate decision-support outputs
• To respond to your inquiries and provide support
• To conduct clinical research and validate algorithm performance (only with appropriate consent and/or ethical approval)
• To comply with legal obligations, regulatory requirements, and safety reporting
• To detect and prevent fraud, abuse, or security incidents
• To improve app safety, performance, and user experience

We do not use your personal data for targeted advertising or sell your data to third parties.

4. Legal Basis for Processing (GDPR / EEA Users)

Where the General Data Protection Regulation (GDPR) applies, we process your data on the following legal bases:

• Consent — for processing health/medical data, optional research participation, and marketing communications
• Contract performance — to deliver services you have requested
• Legitimate interests — for security, fraud prevention, and service improvement
• Legal obligation — to comply with applicable laws and regulations

5. Data Sharing and Disclosure

We do not sell your personal information. We may share data only in the following circumstances:

• Service providers: trusted third-party vendors who assist us in operating the app and services (cloud storage, analytics), under strict data processing agreements
• Research partners: de-identified or anonymized data may be shared with clinical research collaborators under ethical frameworks and data sharing agreements
• Legal requirements: when required by law, court order, or to protect the rights and safety of users or the public
• Business transfers: in the event of a merger, acquisition, or sale of assets, with appropriate notice to users

6. Data Retention

• Account data is retained for as long as your account is active or as needed to provide services
• Health-related session data is retained for the minimum period necessary for service provision and applicable regulatory requirements
• Original video recordings are replaced by anonymized, face-blurred versions as part of processing (see Section 7)
• You may delete your account at any time from within the app, and may request deletion of your data at any time (see Section 9, including Section 9.1 on what account deletion removes and what is retained in de-identified form)
• Research datasets used under ethical approval are subject to separate retention schedules as specified in the relevant consent forms

7. Data Security, Anonymization, and Research Data Storage

7.1 Security Measures

We implement industry-standard security measures to protect your personal information, including:

• Encryption of data in transit (TLS/HTTPS) and at rest
• Access controls limiting data access to authorized personnel only
• Regular security assessments and vulnerability monitoring
• Secure development practices and code review processes

No method of transmission over the internet or electronic storage is 100% secure. While we strive to protect your data, we cannot guarantee absolute security.

7.2 Video Anonymization (Face-Blurring)

BREASY is designed to minimize the retention of identifiable video. When a breathing video is processed, an automated anonymization step detects faces throughout the recording and applies irreversible blurring to them. Once this step completes, the stored recording is replaced with the anonymized, face-blurred version, so that the video retained for ongoing analysis and research is the anonymized version rather than the original recording.

Respiratory motion analysis relies on chest and abdominal movement and does not depend on facial identity.

7.3 Research Data Storage and Governance

BREASY is currently used to support clinical research conducted with Tel Aviv Sourasky Medical Center (Ichilov Hospital). Recorded videos and derived analysis outputs are stored in a dedicated, access-controlled Amazon Web Services (AWS) environment provisioned for this research and governed in accordance with the requirements of the Israeli Ministry of Health. Access is restricted to authorized personnel, and data is handled under the applicable ethical approvals and data protection obligations described in this Policy.

8. Children's Privacy

BREASY is a clinical decision-support tool intended for use by adults (caregivers and healthcare professionals) to support assessment of children. The app does not allow children to create accounts or directly interact with the service.

Video data of children captured through BREASY is:

• Used solely for respiratory motion analysis within the session
• Subject to parental/guardian consent requirements where applicable
• Never used for advertising, profiling, or non-clinical purposes
• Handled in compliance with applicable child data protection laws including COPPA (US) and GDPR provisions for children's data (EU/EEA)

9. Your Rights

Depending on your jurisdiction, you may have the right to:

• Access: request a copy of the personal data we hold about you
• Rectification: request correction of inaccurate or incomplete data
• Erasure: request deletion of your personal data ('right to be forgotten')
• Restriction: request that we limit processing of your data
• Portability: receive your data in a structured, machine-readable format
• Objection: object to processing based on legitimate interests
• Withdraw consent: where processing is based on consent, withdraw it at any time without affecting prior processing

To exercise any of these rights, contact us at: [email protected]

We will respond within 30 days (or as required by applicable law).

9.1 Deleting Your Account

You can delete your BREASY account at any time from inside the app, without contacting us: Settings → Delete Account. You will be asked to confirm twice. Deletion is immediate and permanent — there is no grace period, and a deleted account cannot be restored or recovered by you or by us.

Deleting your account permanently removes:

• Your account and your ability to sign in
• Your email address and profile information
• Any patient names you entered, everywhere they are stored
• The credentials stored on your device, including biometric sign-in
• Any video recording that had not yet completed the automated face-blurring step described in Section 7.2 — if a recording was never successfully anonymized, it is deleted rather than retained

What is retained, in de-identified form: BREASY is used to support clinical research (see Section 7.3). Face-blurred recordings and their respiratory analysis outputs are retained for that research after your account is deleted, together with the date of birth, gender, and respiratory questionnaire answers recorded for the session. Before this data is retained, all names are erased and the data is detached from your account, so it is no longer associated with you or with any identified user.

We retain this de-identified research data because removing individual records from a study already under way would compromise the integrity of the research, and because it is held under the ethical approvals and Israeli Ministry of Health governance described in Section 7.3. It is never used for advertising or profiling, and it is not sold.

If you would prefer that your de-identified research data also be removed, contact us at [email protected] and we will assess the request against the applicable research approvals and your rights under Section 9.

10. International Data Transfers

BreasyMed operates primarily from Israel. If you are located in the European Economic Area (EEA) or other jurisdictions with data transfer restrictions, your data may be transferred to and processed in countries that may not have equivalent data protection laws. Where such transfers occur, we ensure appropriate safeguards are in place, such as Standard Contractual Clauses (SCCs) or adequacy decisions.

11. Third-Party Services and SDKs

The BREASY app may integrate third-party services for analytics, crash reporting, or infrastructure. These may include services such as cloud computing providers. Each third-party service has its own privacy policy, and we select vendors who meet our data protection standards.

We will update this section to list specific third-party SDKs as the app moves toward public release.

12. Cookies and Tracking (Website)

Our website may use cookies and similar technologies to:

• Maintain session functionality
• Analyze website traffic and usage patterns (analytics)
• Remember your preferences

You can control cookie settings through your browser. Disabling cookies may affect website functionality. We do not use advertising or cross-site tracking cookies.

13. Regulatory Compliance

BREASY is currently under development and is not yet cleared or approved as a medical device in any jurisdiction. We are committed to compliance with applicable health data regulations including:

• GDPR (EU/EEA) — General Data Protection Regulation
• HIPAA (US) — Health Insurance Portability and Accountability Act (where applicable)
• PIPEDA (Canada) — Personal Information Protection and Electronic Documents Act
• Israeli Privacy Protection Law and associated regulations
• Apple App Store and Google Play data safety and privacy requirements

App Store Compliance:In accordance with Apple App Store and Google Play requirements, we provide this publicly accessible, active privacy policy. Our app's data safety declarations in the respective stores reflect the practices described in this document.

14. Changes to This Policy

We may update this Privacy Policy from time to time. When we do, we will:

• Update the 'Last Updated' date at the top of this page
• Notify users of material changes through the app or email (where applicable)
• Provide reasonable notice before changes take effect

Continued use of BREASY after changes constitutes acceptance of the updated policy.

15. Contact Us

For privacy-related questions, requests, or concerns:

BreasyMed Ltd.
Privacy / Data Protection Inquiries
Email: [email protected]

This Privacy Policy is publicly accessible, not geo-blocked, and maintained as a live web page in compliance with Apple App Store and Google Play requirements.