0. Basic information

0.1 Who we are and how to contact us

The mobile application MyFoodRepo (the “App”),the website https://www.myfoodrepo.org/ (the “Website”), and its application programming interface (the “API”) are run by the École Polytechnique Fédérale de Lausanne, Bâtiment CE, 3.316, Station 1, 1015 Lausanne, Switzerland, c/o Salathé Lab.

You can contact the data controller by contacting Prof. Marcel Salathé’s laboratory:
Salathé Lab
School of Life Sciences SV
Global Health Institute
Campus Biotech
Bâtiment B1.01
Ch. des Mines 9
CH-1202 Genève
Switzerland
http://salathelab.epfl.ch
marcel.salathe@epfl.ch

0.2 Description of the Services

The different Services (as defined in the Terms of Use [please insert link]) are not directed to children, and you cannot use the App if you are under the age of 18 years old.

Despite EPFL running the various Services, we are notably offering photographs’ availability to the public and algorithms that do not process personal data. We are not offering specific features, tools, algorithms, or data that could help third parties to identify you.

However, our Services need to collect some of your personal data (as described in section 0.3).

0.3 User Data Processing Purposes

We are using your personal data and photographs (collectively, “User Data”) in order to:

1. Operate and provide you the Services linked with the App and Website;

2. Conduct research projects with the User Data you provide for scientific purposes;

3. If you consent, publish the photographs you take in a public repository available on the Website.

Regarding the purpose #2, you must understand that we can use User Data for research purposes even if you mark them as “private” because it serves a purpose based on a different legal ground (see section 0.3).

0.4 User Data Usage Basis

As outlined in section 0.3, we are use your User Data for three distinct purposes. We are collecting such information based on the following grounds:
· Operating and providing the Services: you give your consent when you first open the App or first access to the Website or the API. You may revoke your consent at any time by deleting your account (see section 2.1);
· Conducting of research projects: We are processing your User Data on the basis of a legal act (art. 36c and seq. of the Swiss Federal Act on the Federal Institutes of Technology of 4 October 1991), which enables us to use personal data within the scope of research projects and without your specific consent;
· Publication of your photos on the Website (public repository): you may give your consent by configuring the corresponding option in the menu in the App. You may revoke your consent at any time by marking a photograph as “private” (see section 1.2) or by deleting your photos or your account.

0.5 Data Storage Time and Location

We store your User Data as long as your account exist. You are taking your photographs and entering your personal data usually through the App, and your photographs are saved on our Website’s servers.

When we use your User Data for research purposes, we may keep your data for up to 10 years. We use the servers of our sub-processors that are based in Frankfurt, Germany (European Union).

1. Collected Data

By using the Services and for the purposes described in the section 0.3, we are collecting and using your personal data (1.1), photographs (1.2), and metadata (1.3). You must understand that photographs may contain some personal information.

If you choose the corresponding option, photographs may be made public on the Website. It means that anyone throughout the world can have access to it, including the personal data potentially contained in it.

1.1 Personal Data

For the purposes described in section 0.3, you provide the following personal data:
· Your email address
· Your nickname
· Your password’s salted hash (Industry standard. We cannot see or recover user passwords).

1.2 Photographs

By using the App, you will share with us photographs that you take. Each photograph may contain personal data, including: the date and time it was taken, and timezone information.[CF1]

You can decide if you want to mark your photographs as “public” or “private”. For changing the status of your photos, please go to the profile screen in the App and change the corresponding option. The option applies to all your photos, and you cannot choose which photo individually you want to share publicly.

Please keep in mind that we can still use your photographs for research purposes without your consent, even if your photos are marked as “private”, but you always have the opportunity to delete them or to contact us if you are opposed to such use.

1.3 Metadata (Automatically Collected Data)[CF2]

Besides the information you will actively provide us, we automatically collect the following data once you accept to use the Services:

· Usage and log information: IP address, timestamps of access to our Services, credentials (passwords are never stored directly on our servers; they are salted and hashed per industry standard), information about your subscription (such as your consent’s proof);
· Device and connection information: operating system, device’s vendor, and device’s name, browser, etc.;
· Cookies or similar technologies: Cookies or similar technologies can be useful in many ways to make your visit to our App and Website simpler, more pleasant and more pertinent. Cookies and similar technologies are data files that your browser automatically saves on your device’s hard drive when you visit our Website or App. Various types of cookies are present on our Website and App:
o Cookies that are strictly necessary, which are necessary for navigation, along with your authentication token after logging in, and to secure the Website and App;
o Analytical cookies, which serve to count the visits in relation with our Services and serve to analyze the sources of traffic and improve our Services;
o Functionality cookies, which are collecting some of your surfing preferences such as language preferences.

2. Your Rights

2.1 Account Deletion

For deleting your account, please go to the profile screen in the App, and then tap on the “Delete My Account” button and confirm. Alternatively, you may request account deletion by email (support@myfoodrepo.org). This will delete all User Data and metadata on our servers.

Please note that search engines (e.g. Google) and other third parties (such as another research institution or company) may still retain copies of your public photographs. We have no control over these third parties.

2.2 Photograph Deletion

You can delete your photographs one by one from within the App. If you want to delete all your photos, you may contact us via email (support@myfoodrepo.org). Deleting your account will delete your photos (see section 2.1).

2.3 Access Rights

You have the right to access a copy of the personal data we hold about you. You can download this information directly in the Website in the menu X. In the section “download your information”, click on the associated button, and you will receive a .csv document with all your personal data.

2.4 Other Rights: Edit, Challenge, etc.

When you are logged into the App, you can manage your privacy settings and other account features at any time in the profile menu.

You can edit your personal data by tapping on the “Edit” button on that screen.

Finally, you can always withdraw your consents by deleting your account. You can also challenge our use of your User Data for research purposes. In this case, and if you also have additional request, please contact us (see section 0.1).

3. Data Sharing

Your User Data
data is stored in our sub processor’s facilities in the EU. Your photographs are shared with other research institutions, unless you elected to mark your photos as “private” (see section 1.2).

3.1 Research Purposes

We do not communicate your personal data to any third-parties, (though they are stored in our sub processor’s facilities in the EU). However, we may communicate your photos to another research institutions for scientific research purposes exclusively, irrespective of whether you decide to share your photos with the public or not.

3.2 Services and Photo Publishing

If your mark your photos as “public”, you accept to share your photos anonymously with all people around the world. It means that anyone can have access to your photos and is able to use it for other purposes.

You agree that we cannot control the use of your photos by these third-parties. Therefore, we cannot be considered as data controller for the processing of these third parties.

3.3 Subprocessing Activities

We are using an external provider for data storage, namely: Amazon Web Services. The servers we use are based in Frankfurt, Germany (European Union). We have an agreement with this provider, who guarantees an adequate level of security.

4. International Data Transfers

We do not communicate your personal data to any third-parties, so no international transfer of your personal data is foreseen.

The personal data’s transfers to our external provider are made to Germany, a reliable European Union country which appears to have adequate privacy legislation pursuant to the Swiss Federal Data Protection and Information Commissioner.

Otherwise, we envisage sharing your photos for research purposes with other research institutions. The international footprint of EPFL involves a large number of international partners. Generally, your photos marked as “private” will stay within the European Union. However, we cannot exclude having relation with other foreign countries, which do not have necessarily an adequate privacy legislation. In those situations, we will implement Standard Contractual Clauses approved by the Swiss Federal Data Protection and Information Commissioner, or similar contractual clauses in other jurisdictions. In case such transfers are made to the U.S., we will choose a partner who adheres to the Swiss-U.S. Privacy Shield Framework.

5. Other Provisions

5.1 Complaints

The competent authority is the Swiss Federal Data Protection and Information Commissioner. You can contact its services here:
https://www.edoeb.admin.ch/edoeb/fr/home/le-pfpdt/contact/formulaire-de-contact.html,
or call the following number: +41 (0)058 462 43 95.

5.2 Third-Party Tracking

You are aware that browsing the web entails certain risks that we are not able to control. In particular, we do not control third parties’ applications or other technologies for tracking, even if they are present on our Website or in our advertisements. The confidentiality policies of these third parties must be consulted.

5.3 Changes to this Privacy Policy

We may revise this Privacy Policy from time to time. The most current version of the policy will govern our processing of your personal data and will always be at https://www.myfoodrepo.org/privacy. In case of modifications, we will publish a notice on the Website. Therefore, it is strongly recommended to check the Website regularly. If you disagree to any of the changes to the Privacy Policy, you must contact us directly or delete your account.
[CF1]Le développeur m’a transmis le commentaire suivant à ce sujet : « : As for the time at which the meals were eaten and timezone, it's probably a mistake to consider that 'photograph data', but then the section on 'personal data' needs to mention that. Photos taken from within the app contain by themselves absolutely zero extra info, they’re just raw pixels. Pictures picked from the phone’s camera roll are stored on our side in such a way that they don’t contain any EXIF info but their width and height.”

[CF2]Commentaire du développeur: “The image metadata (filename, EXIF (which includes phone model, GPS), and the like) will be scrubbed.”

Log in

Can't log in?