Privacy Statement

This is the Privacy Statement of Lanas Health Limited as it relates to this website (“Site”) and both its practice management system Health One and HPM together with any related applications, portals, modules, features, integrations, connected services and ancillary offerings that are provided, enabled or made available by or on behalf of Lanas Health Limited, including through its affiliates, in connection with that system (collectively “Product(s)”). This Privacy Statement describes our personal data processing practices, including the types of personal data we obtain, how we may use that personal data, with whom we may share it, and how individual data subjects may exercise their rights regarding our processing of their personal data. The Privacy Statement also describes the measures we take to safeguard the personal data we obtain and how you can contact us about our privacy practices.

This Privacy Statement does not apply to personal data that our employees provide us in connection with their employment, which is covered by a separate privacy notice. We are not responsible for the content or privacy practices of other websites. Any external links to other websites are clearly identified as such. For the avoidance of doubt, this Privacy Statement applies only to processing activities where Lanas Health Limited acts as a data controller. Where personal data is processed through the Product(s) on behalf of customers, Lanas Health Limited acts as a data processor and the relevant customer acts as the data controller. Such processing is governed by separate contractual arrangements, including applicable data processing agreements.

2. Who we are

Lanas Health Limited together with its affiliates and subsidiaries shall be collectively referred to as “Lanas” or “we”, “us”, “our”. This Privacy Statement relates to processing where we are the data controller and applies to personal data we obtain through the Site, marketing channels and certain limited product usage data as described below.

Lanas Health Limited is committed to maintaining the trust and confidence of our visitors to our Site. We respect the rights of users of our Site and are committed to protecting your privacy in accordance with applicable data protection legislation. We will not collect any personal information (also referred to as personal data) about you on this Site without your permission or as otherwise in accordance with applicable data protection legislation.

3. Personal Data We Collect

You are not required to provide us with any personal data in order to use our Site. You can choose not to give us personal data when we ask you for it. If you decide not to give us your personal data, it may restrict our relationship with you. However, where you choose to give us personal data, via online feedback forms or email or through visiting the Site, we will collect:

• Basic Information: name, surname, country location, preferred language;
• Contact Information: email, mailing address, contact phone number, or online form; and
• Technical data: information about your device and your usage of our websites, including your IP address, browser type, session information, operating system, domain name, access times and referring website addresses, and whether you reached the Site using a search engine or via a link on another website. We use this technical data for administrative and statistical purposes to understand how the Site is used and to help us improve our Site. This technical data does not provide us with the personal data of visitors to our Site.

We will treat your personal data in accordance with applicable data protection legislation. We collect this information directly from you when you input it in our Site or from your session when you visit the Site.

4. Cookies

Like most websites, we use cookies and similar tracking technologies to enhance your experience. Cookies are small text files stored on your device when you visit a site. Some cookies are necessary for the website to function, while others (for example analytics or advertising cookies) require your consent. Non-essential cookies will only be set with your permission. Cookies may be set by the website you are visiting (“first party cookies”) or by other websites who run content on the page you are viewing (“third party cookies”). When first visiting our Site you will be provided notice that our Site uses cookies before cookies are set. If you continue to use the Site after fair notice is provided we will consider this as consent, through an affirmative action taken by you, to the use of cookies.

You can withdraw your consent or adjust cookie settings at any time by using our cookie management tool or through your browser settings. For further information on Internet browser cookies please see our relevant Cookie Statement which appears at the bottom of the pages on the Site.

5. Giving us your Personal Information

If you voluntarily provide personal data to us through this Site (for example, by contacting us via an online form, subscribing to updates, or emailing us), we will process that information for the purposes you provided it. Where you provide us with your personal information (for example name, email address, work address, phone and/or other contact information), through a facility provided on this Site or directly to us by email, we will:

1. Process and administer your personal data to perform all necessary actions to give effect to your request or instruction, including to identify and authenticate your rights to access our Site and to respond to Site queries or requests.
2. Process your personal data to tell you about our website, events, products and services. We will only do so after asking for your explicit consent, or by relying on legitimate interest (in the case of existing customers).
3. Retain a record of incoming and outgoing communications (for example email) in compliance with the storage limitation principles of the EU General Data Protection Regulation. Information in the emails we receive and send will not be disclosed to any third party without the permission of the sender unless otherwise in accordance with the Data Protection legislation.
4. We may anonymise, pseudonymise, de-identify, and/or aggregate personal information and use it for analysing Site usage and areas for Site functionality improvement, and/or to protect security of the Site.

In addition to the above purposes, we may also process your personal data to comply with our legal obligations or regulatory requirements (for example, fulfilling reporting duties, or if we are required by law enforcement or court order to disclose information). Also, we may process data to further our legitimate interests (for example, improving our services or securing our systems), provided those interests are not overridden by your rights and freedoms. We will not use your personal data for purposes that are incompatible with the above purposes, unless it is required or authorised by law.

6. Who we Share Your Data with

We may disclose personal information we collect about you to other parties. We may share your personal data with these third parties:

• Lanas Healthcare Technology Group companies: We may share your personal information within our group of companies for the purposes described above.
• Third party service providers: We may share your personal data with our third party service providers, contractors that provide website hosting or development services, cloud storage services, and professional services on our behalf.
• Legal and regulatory authorities (where required): we may have to share your personal information in response to authorised requests of government authorities or where required by law.
• In connection with a corporate transaction: As part of any merger, sale, joint venture, transfer, or other disposal of all or any portion of our business (including as part of any bankruptcy or similar proceedings), we may transfer your personal information to other parties involved in these transactions. Under these circumstances, all parties will enter into a confidentiality agreement to protect personal information and must only use personal information for the purpose it was collected for in the first instance.

7. Lawful Bases for Processing

We rely on the following lawful bases:

• Consent: for marketing communications and where required for special category data. You are free to withdraw that consent at any time.
• Contract: If you request a service or information from us via the website, or if you are in the process of entering into an agreement with us, we may process your data because it is necessary for the performance of a contract with you, or to take steps at your request before entering into a contract.
• Legitimate interests provided those interests are not overridden by your fundamental rights and freedoms: responding to queries, in the case of existing customers soft opt-in to marketing communications, analysing Site usage, improving and securing the Site.
• Legal obligation: compliance with law, fraud prevention, and regulatory reporting.
• Special Category Data (Sensitive Personal Data): explicit consent if you, for example, volunteer health-related information to us through the Site.

8. Data Transfer

We may need to transfer your personal data internationally. We do not share your data outside the EEA and UK unless adequate safeguards are in place, such as standard contractual clauses or adequacy decisions.

9. Data Retention

We hold data for as long as there is a need by considering (i) the length of our relationship with you, and whether we need to keep your personal information to respond to or process a question or request from you, (ii) our legal position (including statutes of limitation), (iii) whether there is a requirement to keep your personal data for a period required by law, and (iv) whether we should keep your personal data in connection with legal action or an investigation involving us.

10. Marketing Communications Opt-in and Opt-out

Lanas adheres to the data protection and ePrivacy rules on direct marketing. We operate a strict “opt-in” policy for individuals who are not existing customers. This means we will not send you promotional emails, texts, or other electronic communications about our products and services unless you have actively given your consent for us to do so (for example, by signing up for a newsletter or ticking an opt-in box).

For business contacts or existing customers, Lanas relies on what the law recognises as a “soft opt-in” or appropriate legitimate interest to inform you about our similar products or services, provided that: (i) we obtained your contact details in the context of a sale or negotiations for a sale of our services, (ii) the marketing is about our own similar healthcare products or services, and (iii) you were given a clear opportunity to opt out of such marketing both at the time your details were collected and with each message we send. In practice, this means Lanas may continue to send business customers updates on our offerings until you inform us that you no longer wish to receive them.

Regardless of whether you are an individual or business contact, you always have the right to object to direct marketing at any time. If you wish to stop receiving marketing communications from us (to “opt-out”), you can use the unsubscribe link provided at the bottom of every marketing email or message we send. Once you opt out, we will promptly remove you from our marketing contact list and cease further outreach. There is no charge for this, and opting out will not affect any other services you have with us.

For additional information on the rules governing electronic direct marketing in Ireland, including the difference between individual and corporate recipients, and the requirements for consent, you can refer to the Irish Data Protection Commission (DPC). The DPC’s website provides FAQs and resources explaining when consent is needed and how the “existing customer” exemption works, in line with Regulation 13 of the ePrivacy Regulations and Article 21 GDPR (which gives individuals the right to object to direct marketing). We comply with these requirements in our marketing practices.

11. Analytics

We collect limited technical information about how users interact with the Lanas Products(s) (“Usage Data”), such as feature usage, usage events, system-performance and technical information, together with pseudonymised user identifiers and customer-account identifiers in relation to Product(s). We use Usage Data to measure use of Product(s) in accordance with customer agreement and data processing agreement and to improve the software, including to understand adoption and identify and resolve errors.

Where Usage Data is personal data, we act as controller and rely on our legitimate interests in operating and improving the software. We use an approved analytics service provider acting on our behalf. User identifiers are pseudonymised, we limit the information used, and we aggregate it where practicable. Usage Data does not include personal data relating to patients or other recipients of GP services.

12. Security of Data

Lanas maintains appropriate technical and organisational measures to protect the personal information collected via this Site against unauthorised access, alteration, disclosure, or destruction. These measures include physical security controls, administrative policies, and technological safeguards aligned with industry standards for data protection. Please be aware that while we strive to protect all information, no method of transmission over the Internet or method of electronic storage is completely secure. We cannot guarantee absolute security of data transmitted to our Site; any transmission is at your own risk. However, once we receive your personal data, we apply strict security standards to try to prevent any unauthorised access or misuse. We also encourage you to take precautions when sending personal information to us. For instance, standard email may not always be secure against interception, so consider using encryption or contacting us before sending highly sensitive details. We continually review and update our security practices to adapt to emerging threats and to ensure ongoing confidentiality, integrity, and availability of your data.

13. Your Data Protection Rights

As an individual (“data subject”) whose personal data we process, you have a number of rights under GDPR and Irish law. We respect these rights and have processes in place to enable you to exercise them. Your principal data protection rights include:

• Right to be informed: You have the right to clear and transparent information about how we collect and use your personal data. This Privacy Statement is part of our effort to keep you informed. If you have further questions about our data practices, you can contact us (see Section 13).
• Right of access: You have the right to request a copy of the personal data we hold about you, as well as information on how we use it, who we share it with, and how long we keep it. This is commonly known as a “Subject Access Request”.
• Right to rectification: If any of the personal data we hold about you is inaccurate or incomplete, you have the right to have it corrected or updated without undue delay.
• Right to erasure: You have the right to request deletion of your personal data in certain circumstances, for example if the data are no longer needed for the purposes they were collected, or if you withdraw consent and no other legal basis for processing applies. We will honour valid erasure requests unless we have a compelling legal reason to keep the data.
• Right to restrict processing: You have the right to request that we limit the processing of your data in certain situations, for example while we are verifying the accuracy of data you contested or if you want us to preserve data you need for a legal claim but no longer require otherwise.
• Right to data portability: To the extent we process your personal data based on your consent or a contract with you, and the processing is carried out by automated means, you have the right to obtain a copy of your provided data in a commonly used, machine-readable format, and to have it transmitted to another service provider where technically feasible.
• Right to object: You have the right to object to our processing of your personal data at any time on grounds relating to your particular situation when we process data based on legitimate interests. We will stop processing unless we can demonstrate compelling legitimate grounds that override your interests, rights, and freedoms, or if we need to continue processing for the establishment, exercise, or defence of legal claims.
• Right not to be subject to automated decisions: Lanas does not carry out any decision-making based solely on automated processing (including profiling) that produces legal or similarly significant effects on individuals via this Site. We will inform you if we ever engage in automated decision processes involving your data and of your related rights.
• Right to withdraw consent: Where we rely on your consent to process personal data, you have the right to withdraw that consent at any time. Withdrawing consent will not affect the lawfulness of processing before its withdrawal.
• Right to lodge a complaint: If you believe your data protection rights have been violated or you are dissatisfied with how we have handled your personal information, you have the right to lodge a complaint with the Irish Data Protection Commission (DPC). See www.dataprotection.ie, phone +353 57 868 4800, or write to 21 Fitzwilliam Square South, Dublin 2, D02 RD28, Ireland. We would appreciate the chance to address your concerns first.

Exercising Your Rights: You can exercise any of these rights by contacting us at [email protected]. To process your request, we may need to verify your identity for security purposes.

For Subject Access Requests, we may provide a standard form to help you specify the information you seek. Once we have received all necessary information and proof of identity, we will respond to your request without undue delay and in any event within one month, as required by GDPR. In the case of particularly complex requests or multiple requests, we may extend this period by an additional two months if necessary; if so, we will inform you within the first month and explain why the extension is needed. Generally, we will not charge a fee for fulfilling your rights. If we cannot fulfil your request, we will clearly explain the reasons (unless legally prevented from doing so) and inform you of next steps, including how to complain to the DPC. If your request related to a data controller where Lanas acts a data processor, we will refer the data subject to the relevant data controller for such requests.

14. Data Protection Officer contact details

We have appointed a data protection officer. Our DPO can be contacted by email at [email protected] or by post to:

Data Protection Officer, Lanas Headquarters Limited, Suite 17, The Courtyard, Carmanhall Road, Sandyford, Dublin 18, Ireland, D18 K33C

15. Website Terms and Conditions of Use

Access to this Site and the use of information contained on it is governed by the terms and conditions set out below. By using this Site you will be deemed to have accepted these terms and conditions. This Site is owned and operated by Lanas Healthcare Technology Group and references to “we”, “us” and “our” mean Lanas Healthcare Technology Group.

Copyright in this Site and the information set out on it belongs to us and/or our licensors and may not be copied, transmitted or reproduced without our consent. All copyright, trademark and other proprietary notices must be left intact. Save as otherwise specified, the contents of all the pages contained in this site are copyright of Lanas Healthcare Technology Group or its licensors.

Reproduction of part or all of the contents of the pages in any form is prohibited other than in accordance with the following permissions:

• You are granted a non-exclusive, non-transferable licence solely for the purpose of using this site and any services available on this Site.
• You may make one electronically stored, transient copy of these pages of this site for the exclusive purpose of online viewing.
• You may make one hard copy of these pages for exclusively non-commercial purposes.

Save where otherwise specified, the author(s) of the literary and artistic work set out in the pages contained in this site has/have asserted his/her/their moral rights to be identified as the author of these works.

This licence does not permit incorporation of the material or any part of it in any other work or publication, whether in hardcopy or electronic or any other form. In particular, no part of this Site may be distributed or copied for any commercial purpose.

No part of this Site may be reproduced on or transmitted to or stored in any other website or other form of electronic retrieval.

Some pages on this Site contain hypertext links to websites of business units and subsidiaries of Lanas Healthcare Technology Group. When you enter such sites, you will be subject to the terms and conditions of those sites.

Some pages on this Site contain hypertext links to websites not maintained by Lanas Healthcare Technology Group. When you enter such websites via such hypertext links, you will not be subject to these terms and conditions and you will not benefit from the protections afforded to you in using our Site. We will not be liable in any way for the content, availability or use of such linked websites and you use such links entirely at your own risk.

You warrant that you will use this Site in accordance with all the terms and conditions applying to such use and you agree to indemnify Lanas Healthcare Technology Group for any liability accruing to Lanas Healthcare Technology Group from your use of this Site.

This Site is established in Ireland in accordance with the laws of Ireland and will be governed by the laws of that country. When you use the Site, you accept that your use of the Site and any information on the Site will also be governed by the laws of Ireland and, if any claim or dispute arises from your use of the site or any information on it, you agree that the Irish Courts will have non-exclusive jurisdiction over all such claims or disputes.

The use of this Site or the distribution of information on this Site may be restricted by local law or regulation in certain jurisdictions. This Site is not intended for use, nor is the information intended for distribution, in such jurisdictions. Persons accessing this Site should inform themselves about and observe any such restrictions.

No third party is permitted to link any other website to this Site without obtaining Lanas Healthcare Technology Group’s prior written consent.

Please note that the sending of personal information via email over the Internet may not be secure and can be intercepted by third parties or incorrectly delivered. You should not divulge confidential or personal information over the Internet unless you are using secure or encrypted communications technology.

The contents of this Site including these terms and conditions are subject to change. Should we make changes to our privacy settings or policy we will notify you in advance. We accept no responsibility or liability for keeping the information in this Site up to date or for any failure to do so.

16. Disclaimer

The information contained in this Site is for information purposes only. Whilst every care has been taken in its preparation we do not make any warranties or representations as to its completeness, accuracy or reliability. Although we have made all reasonable efforts to ensure that all of the information on the Site is accurate at the time of inclusion, we do not represent that this is the case and it should not be relied upon as such.

We neither accept nor assume any responsibility to you in relation to the contents of this Site. Access to and use of this Site is at the user’s own risk and we do not represent or warrant the use of this Site or any material downloaded from it will not cause damage to property, including but not limited to loss of data or computer virus infection.

In no event do we accept liability of any description including liability for negligence for any damages whatsoever resulting from loss of use, data or profits arising out of or in connection with the access, use or performance of this Site or any of its contents.

We do not accept liability for any inaccuracies or omissions on this Site. All implied warranties are excluded to the fullest extent permissible under law.

We reserve the right to update or alter the information on this Site including these terms and conditions at any time without giving notice of the alterations. Lanas Healthcare Technology Group does not give any warranty of uninterrupted use of this Site and Lanas Healthcare Technology Group does not accept liability for any information posted on this Site by third parties.

You will ensure that your use of this Site complies with all applicable laws and regulations, including but not limited to those principles of law which protect against compromise of copyrights, trade secrets, proprietary information and other intellectual property rights, libel or defamation, invasion of privacy or tortious interference.

No data transmission over the Internet can be guaranteed as totally secure. Whilst we strive to protect such information we do not warrant and cannot ensure the security of any information which you transmit to us. Accordingly, any information which you transmit to us is transmitted at your own risk. Nevertheless, once we receive your transmission, we will take reasonable steps to preserve the security of such information.

You agree not to post or publish any offensive, defamatory or unlawful material that could encourage or constitute a criminal offence, civil liability or violation of any law.

Lanas Healthcare Technology Group reserves the right to monitor or review the contents of the Site but is not obliged to do so and assumes no liability or responsibility for the contents therein. Lanas Healthcare Technology Group reserves the right to remove any materials posted to the Site at its absolute discretion and may disclose your identity to relevant parties to aid any investigation.

You warrant that the information you enter on this Site is accurate and you indemnify us in respect of any damage or legal costs arising out of any action taken against us in respect of the material posted by you.

17. Glossary of Technical Terms used

• IP address: The identifying details for your computer (or your internet company’s computer), expressed in “internet protocol” code (for example 192.168.55.34). Every computer connected to the web has a unique IP address, although the address may not be the same every time a connection is made.
• Personal data: Information about you which can identify you and which is within the possession of Lanas Healthcare Technology Group (for example your name and address).
• Web browser: The piece of software you use to read web pages. Examples include Microsoft Edge/Internet Explorer, Google Chrome, Firefox and Safari.

18. More Information

For more information about how we process and protect your data, please contact [email protected].

19. Updates to This Privacy Statement

Technology and data privacy best practice are constantly developing. We reserve the right to revise and publish changes on the Privacy Statement page of our website. We review and update this Privacy Statement regularly. We encourage you to review this page periodically to ensure you are aware of what information we collect and how we process it.