Health Diary Application – Privacy Addendum

Version 1.0
Effective Date: November 27, 2025
Last Updated: November 27, 2025

1. Application Overview

1.1 Application Description

The Health Diary ("Diary" or "Application") is a mobile and web-based health diary designed to help individuals track health observations and related information. The Diary serves multiple purposes:

• Personal Health Management: Enabling users to maintain accurate records of their health observations for personal reference and sharing with healthcare providers
• Research Contribution: Supporting research organizations by allowing users to voluntarily contribute de-identified data for medical research
• Clinical Trial Support: Serving as an electronic diary for participants in pharmaceutical clinical trials

1.2 Data Controllers

The following entities serve as Data Controllers for this Application:

Development Phase (Current):

• Anspar Foundation – Data Controller for application development, testing, and initial deployment

Operational Phase:

• Sponsor Organization – Data Controller for personal health data and research data (the specific organization depends on your deployment)
• Clinical Trial Sponsors – Joint Data Controllers (with the Sponsor Organization) for clinical trial participant data, as specified in trial-specific informed consent documents

1.3 Applicable Regulations

In addition to the regulations listed in the General Privacy Policy, when used for clinical trials, this Application is subject to:

• FDA 21 CFR Part 11 – Electronic records and electronic signatures requirements for clinical trial data
• EU Clinical Trial Regulation (EU) No 536/2014 – Requirements for clinical trials conducted in the European Union
• EU GMP Annex 11 – Computerized systems requirements including 25-year data retention
• ICH E6(R2) Good Clinical Practice – International standards for clinical trial conduct

1.4 Transferability

This Application is being developed by Anspar Foundation. The Application and associated data may transfer to the Sponsor Organization at a future date as determined by the contracting parties. Upon such transfer:

• All existing user consents and authorizations remain valid
• The Sponsor Organization assumes all obligations under this Addendum
• Users will be notified but are not required to provide new consent for the transfer

2. Data We Collect

This section details the specific data elements collected through the Health Diary.

2.1 Account and Identity Information

• Name (first and last)
• Email address
• Date of birth
• Account credentials (username, encrypted password)
• Country/region of residence
• Timezone settings

2.2 Health Data – Health Observations

For each health observation recorded:

• Date and time (start and end)
• Duration (calculated and/or user-entered)
• Severity/intensity (using applicable standardized scales)
• Location or type of observation
• Spontaneous vs. provoked indicator (if applicable)
• Interventions used
• Free-text notes (optional)
• No-event confirmations (days without events)

2.3 Health Data – Additional Health Information

Users may optionally record:

• Related health events
• Medical observations
• Medical appointments and treatments
• Medications and supplements
• Environmental factors (weather, activities)
• Quality of life assessments

2.4 Clinical Trial Data (When Applicable)

For users participating in clinical trials, additional data may include:

• Trial participant identifier
• Protocol-specific health assessments
• Standardized outcome scores
• Medical support records
• Quality of life questionnaires
• Adverse event reports
• Protocol-specific assessments
• Electronic signatures (21 CFR Part 11 compliant)
• Participation in third-party trials (true/false indicator only, to enable proper analysis of data that might be influenced by outside factors)

2.5 Technical and Device Data

• Device type, model, and operating system
• Diary version
• Usage timestamps and patterns
• Synchronization status and history
• Error logs and crash reports
• Audit trail data (for regulatory compliance)

2.6 Audit Trail Data (FDA 21 CFR Part 11 / EU Annex 11)

For regulatory compliance, the Diary maintains comprehensive audit trails including:

• Record creation timestamps (UTC)
• Record modification history
• User attribution for all actions
• Electronic signature records
• Data export and access logs

3. How We Use Your Data

3.1 Personal Health Management

• Displaying your health history and patterns
• Generating personal health reports
• Sending reminders to complete diary entries
• Enabling data export for sharing with healthcare providers
• Backing up your data securely

3.2 Research (With Consent)

If you consent to contribute data for research:

• Contributing de-identified data to research databases
• Enabling longitudinal health studies
• Supporting development of treatment guidelines
• Advancing scientific understanding

3.3 Clinical Trial Support (With Consent)

For clinical trial participants who consent:

• Collecting protocol-specified endpoints
• Maintaining regulatory-compliant audit trails
• Enabling investigator review of participant data
• Supporting regulatory submissions (FDA, EMA)
• Facilitating sponsor monitoring and audits

3.4 Diary Improvement

• Analyzing usage patterns to improve user experience
• Identifying and fixing technical issues
• Developing new features based on user needs
• Ensuring Diary security and reliability

4. Data Sharing

4.1 Sponsor Organization (Opt-In)

We do not automatically share your data with the Sponsor Organization. If you choose to contribute your data to support research and patient services, you may opt in through the Diary's consent settings. Upon opting in, your data may be used for:

• Research database contribution (de-identified)
• Program development and patient support services
• Aggregate reporting on the patient community

You may opt out at any time, which will stop future data sharing while preserving data already contributed to de-identified research databases.

Important: Under GDPR, you own your basic health data and may choose to share it with the Sponsor Organization independently of any clinical trial participation.

4.2 Clinical Trial Sponsors and Partners (Opt-In)

Clinical trial data sharing occurs only when you voluntarily enroll in a clinical trial and provide informed consent. If you choose to participate in a clinical trial, data may be shared with:

• Pharmaceutical Sponsors: Trial-specific data as specified in your informed consent
• Contract Research Organizations (CROs): For trial management and monitoring
• Clinical Investigators: Site-specific participant data
• Data Safety Monitoring Boards: For safety oversight
• Regulatory Authorities (FDA, EMA): As required for drug approval

You will receive a separate, detailed informed consent document that explains exactly what data will be shared and with whom. You may decline trial participation without affecting your use of the Diary for personal health tracking.

Note on Third-Party Trial Participation: If you participate in other clinical trials or research studies, you may optionally indicate this participation (as a yes/no indicator only) to enable proper analysis of your data. No information about the identity of the sponsor, trial, or any other details will be collected or shared.

4.3 Healthcare Providers

At your direction, you may export or share your data with your healthcare providers.

4.4 Service Providers

We use the following categories of service providers, all bound by appropriate agreements:

• Cloud infrastructure (data hosting and storage)
• Security and monitoring services
• Application performance monitoring

5. Clinical Trial Provisions

5.1 Regulatory Override

When you consent to participate in a clinical trial governed by FDA 21 CFR Part 11, EU Clinical Trial Regulation 536/2014, or ICH-GCP guidelines, the following regulatory requirements take precedence:

• Data Integrity: Clinical trial data cannot be deleted or substantially modified to preserve scientific integrity
• Audit Trails: All data entries and modifications are permanently logged with timestamps and user attribution
• Extended Retention: Clinical trial data must be retained for regulatory-mandated periods (see Section 6)
• Regulatory Access: Regulatory authorities may inspect clinical trial records

5.2 Patient-Reported Data Authority

Consistent with international consensus standards for clinical trials:

• Patient-reported data remains authoritative – Your original diary entries are the primary record
• Investigator annotations are separate – Any investigator corrections or queries are stored as metadata, not modifications to your original entries
• Data provenance is maintained – The origin and history of all data is fully traceable

5.3 Modified Rights During Trial Participation

During active clinical trial participation, certain rights may be limited:

• Right to Erasure: May be suspended for trial data integrity; you may withdraw from the trial, but existing data must be retained
• Right to Rectification: Original entries cannot be overwritten; corrections are recorded as annotations
• Right to Restriction: Limited for data required by trial protocol

These limitations apply only to clinical trial data and only during the trial period plus required retention. Your non-trial personal health data remains subject to full privacy rights.

5.4 Electronic Signatures

For clinical trial data requiring electronic signatures (21 CFR Part 11):

• Signatures are legally binding and equivalent to handwritten signatures
• Each signature is linked to your unique credentials
• Signature events are permanently logged
• You must not share your credentials with anyone

6. Data Retention

6.1 Standard Retention (Non-Clinical Trial)

• Account Information: Life of account plus 3 years after deletion request
• Health Data: Active account plus 7 years
• Technical Logs: 1 year
• Research Database (De-identified): Indefinitely, as permitted for scientific research

6.2 Clinical Trial Retention

Clinical trial data is subject to extended regulatory retention requirements:

• FDA (U.S.): At least 2 years after drug approval or investigation discontinuation
• EU Annex 11: 25 years from trial completion
• ICH-GCP: As specified by applicable regulatory requirements

The longest applicable retention period governs.

6.3 Deletion Requests

You may request deletion of your data subject to:

• Regulatory retention requirements for clinical trial data
• Legal obligations
• Data already contributed to de-identified research databases

7. Local Data and Offline Operation

7.1 Offline-First Architecture

The Diary is designed to function offline:

• All diary entries are stored locally on your device first
• You control when data synchronizes to the cloud
• The Diary remains fully functional without internet connection
• Local data is encrypted on your device

7.2 Your Local Data

Data stored locally on your device:

• Remains under your control
• Is deleted if you uninstall the Diary (unless backed up)
• Is subject to your device's security settings

7.3 Synchronization

When you choose to synchronize:

• Data is transmitted securely using TLS 1.2+ encryption
• A copy is stored in our secure cloud infrastructure
• You can access your data from multiple devices
• Cloud data is subject to this Privacy Addendum

8. Your Rights

Your rights under the General Privacy Policy (Section 6) apply in full, with the following Diary-specific details:

8.1 Access and Export

• Export your complete health diary in standard formats (PDF, CSV)
• View all data we hold about you through the Diary
• Request a machine-readable copy for data portability

8.2 Correction

• Correct account information at any time through the Diary
• For non-clinical trial health data, corrections may be made with notation of the change
• For clinical trial data, corrections follow regulatory procedures (annotations, not overwrites)

8.3 Deletion

• Delete your account and associated non-trial data
• Clinical trial data deletion is subject to regulatory retention requirements
• De-identified data already in research databases cannot be deleted

8.4 Consent Management

• Manage research data sharing consent through the Diary
• Clinical trial consent is managed through separate informed consent processes
• Withdraw consent at any time (prospectively)

9. Contact Information

Diary-Specific Inquiries:
Email: privacy@anspar.org
Subject Line: Diary Privacy Inquiry

Development Phase Inquiries:
Anspar Foundation
Email: privacy@anspar.org

Clinical Trial Inquiries:
Contact your clinical trial site or the sponsor as identified in your informed consent form

General Privacy Inquiries:
See General Privacy Policy Section 13

Appendix A: Data Element Summary

The following table summarizes data elements, purposes, and legal bases:

Appendix B: Document Control

Version History:
Version 1.0 – November 27, 2025 – Initial Release

Related Documents:

• Anspar Foundation General Privacy Policy (Version 1.0)
• Concise General Privacy Policy
• Health Diary Terms of Service
• Clinical Trial Informed Consent Forms (trial-specific)

Review Schedule:
This Addendum shall be reviewed at least annually and updated as necessary.

Approval:

___________________________________
Privacy Officer, Anspar Foundation
Date: _________________