Our Data Retention Policy

This data retention policy sets out the obligations of Vascular Health Specialists, LLC (“us/we/our/Rosadyn”) and the basis upon which we shall retain, review and destroy data held by us, or within our custody or control.

This policy applies to our entire organisation including our officers, employees, agents and sub-contractors and sets out what the retention periods are and when any such data may be deleted.

Objectives

It is necessary to retain and process certain information to enable our business to operate. We may store or access data in the following places:

• our own servers;
• any third party servers;
• potential email accounts;
• desktops;
• employee-owned devices (BYOD);
• potential backup storage; and/or
• our paper files.

This policy applies equally to paper, electronic media and any other method used to store personal data. The period of retention only commences when the record is closed.

We are bound by various obligations under the law in relation to this and therefore, to comply with the law, information must be collected and used fairly, stored safely and not disclosed to any other person unlawfully in respect of their personal data under the General Data Protection Regulation (“the Regulation”).

The Regulation defines “personal data” as any information relating to an identified or identifiable natural person (a data subject); an identifiable natural person is one who can be identified, directly or indirectly, in particular by reference to an identifier such as a name, an identification number, location data, an online identifier, or to one or more factors specific to the physical, physiological, genetic, mental, economic, cultural, or social identity of that natural person.

This Policy sets out the procedures that are to be followed when dealing with personal data and how we aim to comply with the Regulation in so far as it is possible. In summary, the Regulation states that all personal data shall be:

• processed lawfully, fairly, and in a transparent manner in relation to the data subject;
• collected for specified, explicit, and legitimate purposes and not further processed in a manner that is incompatible with those purposes; further processing for archiving purposes in the public interest, scientific or historical research purposes or statistical purposes shall not be considered to be incompatible with the initial purposes;
• adequate, relevant and limited to what is necessary in relation to the purposes for which it is processed;
• accurate and, where necessary, kept up to date; every reasonable step must be taken to ensure that personal data that is inaccurate, having regard to the purposes for which they are processed, is erased or rectified without delay;
• kept in a form which permits identification of data subjects for no longer than is necessary for the purposes for which the personal data is processed;
• personal data may be stored for longer periods insofar as the personal data will be processed solely for archiving purposes in the public interest, scientific or historical research purposes or statistical purposes subject to implementation of the appropriate technical and organisational measures required by the Regulation in order to safeguard the rights and freedoms of the data subject;
• processed in a manner that ensures appropriate security of the personal data, including protection against unauthorised or unlawful processing and against accidental loss, destruction or damage, using appropriate technical or organisational measures.

The Fourth and Fifth Data Protection Principles require that any data should not be kept longer than necessary for the purpose for which it is processed and when it is no longer required, it shall be deleted and that the data should be adequate, relevant and limited for the purpose in which it is processed.

With this in mind, this policy should be read in conjunction with our other policies which are relevant such as our data protection policy and IT security policy.

Security and Storage
All data and records are stored securely to avoid misuse or loss. We will process all personal data we hold in accordance with our IT Security Policy [OR take appropriate security measures against unlawful or unauthorised processing of personal data, and against the accidental loss of, or damage to, personal data].

We will put in place procedures and technologies to maintain the security of all personal data from the point of collection to the point of destruction. Personal data will only be transferred to a data processor if there is agreement by them to comply with those procedures and policies, or if there are adequate measures in place.

Examples of our storage facilities are as follows:
Front End of Website & Blog Hosted on Secure Servers that have Anti-hacking, Malware software in place
Ecommerce platform hosted on secure servers by a 3rd party technology subscription where only customer Name Email and Purchase history stored..

All Credit Card and payment information is stored within a third party payment processing service.

We will maintain data security by protecting the confidentiality, integrity and availability of the personal data, defined as follows:

Confidentiality means that only people who are authorized to use the data can access it.
Integrity means that personal data should be accurate and suitable for the purpose for which it is processed.

Availability means that authorized users should be able to access the data if they need it for authorized purposes.

Retention Policy
Data retention is defined as the retention of data for a specific period of time and for back up purposes.
We shall not keep any personal data longer than necessary, but acknowledge that this will be dependent on the different types of documents and data that we have responsibility for. As such, our general data retention period shall be for a period of [Insert Number of Years ] years. Our specific data retention periods are set out below

We collect certain personal information about visitors and users of our Sites.
The most common types of information we collect include things like: user-names, member names, email addresses, IP addresses, other contact details, survey responses, blogs, photos, payment information such as payment agent details, transactional details, tax information, support queries, forum comments, content you direct us to make available on our Sites (such as item descriptions) and web analytics data. We will also collect personal information from testimonials, reviews and other user submitted information.

How we collect personal information

We collect personal information directly when you provide it to us, automatically as you navigate through the Sites, or through other people when you use services associated with the Sites.
We collect your personal information when you provide it to us when you complete membership registration and buy or provide items or services on our Sites, subscribe to a newsletter, email list, submit feedback, enter a contest, fill out a survey, or send us a communication.

Personal information we collect about you from others

Although we generally collect personal information directly from you, on occasion, we also collect certain categories of personal information about you from other sources. In particular: financial and/or transaction details from payment providers located in the US in order to process a transaction; third party service providers (like Google, Facebook) who are located in the US or UK, which may provide information about you when you link, connect, or login to your account with the third party provider and they send us information such as your registration and profile from that service, this only occurs if you are using Rosadyn (VHS) profiles, website or advertising. The information varies and is controlled by that service provider or as authorized by you via your privacy settings at that service provider; and
other third party sources/ and or partners from Australia, US or UK, or where third party service is used, whereby we receive additional information about you (to the extent permitted by applicable law), such as demographic data or fraud detection information, and combine it with information we have about you. For example, fraud warnings from service providers like identity verification service. We also receive information about you and your activities on and off the Rosadyn platform through partnerships, or about your experiences and interactions from our partner ad networks. We also receive information about you as a rights holder from our third party authors. For example, information in the form of a review or testimonial release when your words and/or your image is used in an item made available on our Sites.

How we use personal information

We will use your personal information:
To fulfill a purchase, contract or support, or take steps linked to: in particular, in facilitating and processing transactions that take place on the Sites, like where you purchase an item from our website and or other venues in which your purchase or contact is processed through VHS (Rosadyn) symptoms. Third party marketplaces like Amazon, we do not receive or process user purchases or data, as such if you interacted, purchased through your Amazon account, you have full rights to manage your purchases, data through their systems and your personal account there.

Where this is necessary for purposes which are in our, or third parties, legitimate interests. These interests include:

• operating the Sites;
• providing you with services described on the Sites;
• verifying your identity when you sign in to any of our Sites;
• responding to support tickets, and helping facilitate the resolution of any disputes;
• updating you with operational news and information about our Sites and services e.g. to notify you about changes to our Sites, website disruptions or security updates;
• carrying out technical analysis to determine how to improve the Sites and services we provide;
• monitoring activity on the Sites, e.g. to identify potential fraudulent activity and to ensure compliance with the user terms that apply to the Sites;
• managing our relationship with you, e.g. by responding to your comments or queries submitted to us on the Sites or asking for your feedback or whether you want to participate in a survey;
• managing our legal and operational affairs (including, managing risks relating to content and fraud matters);
• training VHS(Rosadyn) staff about how to best serve our user community;
  improving our products and services.
• providing general administrative and performance functions and activities;

Where you give us consent:
providing you with marketing information about products and services which we feel may interest you; and
customizing our services and websites, like advertising that appear on the Site – where this involves the use of cookies or similar technologies – in order to provide a more personalized experience.

For purposes which are required by law.
For the purpose of responding to requests by government, a court of law, or law enforcement authorities conducting an investigation.

When we disclose your personal information

We will disclose personal information to the following recipients:
companies that are in the VHS group “Rosadyn” which are located in US;

• authors of any items or services made available to you, so they can facilitate support and purchase validation, who maybe located in any of the countries our products are available in;
  subcontractors and service providers who assist us in connection with the ways we use personal information (as set out above), in particular: website hosting providers which are located in, US; technical and customer support services which are located in which are located in, US ; marketing and analytics services which are located in the US; security and fraud prevention services which are located in the US; subscription management services which are located in the US; payment processing services which are located in the US,; identification verification services located in the US; and operational tooling services which are located in the US. Noting that our subcontractors and services providers may also transfer and access such information from other countries in which they have operations.
• our professional advisers (lawyers, accountants, financial advisers etc.) which are located in, USA;
  regulators and government authorities in connection with our compliance procedures and obligations;
  a purchaser or prospective purchaser of all or part of our assets or our business, and their professional advisers, in connection with the purchase;
• a third party to respond to requests relating to a criminal investigation or alleged or suspected illegal activity;
• a third party, in order to enforce or defend our rights, or to address financial or reputation risks;
  a rights holder in relation to an allegation of intellectual property infringement or any other infringement; and other recipients where we are authorized or required by law to do so.

Sensitive data

From time to time, it may be necessary to retain or access historic personal data under certain circumstances such as if we have contractually agreed to do so or if we have become involved in unforeseen events like litigation or business disaster recoveries.

Where you give us consent:
providing you with marketing information about products and services which we feel may interest you; and
customizing our services and websites, like advertising that appear on the Site – where this involves the use of cookies or similar technologies – in order to provide a more personalized experience.

For purposes which are required by law.
For the purpose of responding to requests by government, a court of law, or law enforcement authorities conducting an investigation.

When we disclose your personal information

We will disclose personal information to the following recipients:
companies that are in the VHS(Rosadyn) group which are located in US;

• subcontractors and service providers who assist us in connection with the ways we use personal information (as set out above), in particular: website hosting providers which are located in, US; technical and customer support services which are located in the US;  marketing and analytics services which are located in the US; security and fraud prevention services which are located in the US; subscription management services which are located in the US; payment processing services, subscription and identification management services  which are located in the US. Noting that our subcontractors and services providers may also transfer and access such information from other countries in which they have operations.
• Our professional advisers (lawyers, accountants, financial advisers etc.) which are located in, USA;
  regulators and government authorities in connection with our compliance procedures and obligations;
  a purchaser or prospective purchaser of all or part of our assets or our business, and their professional advisers, in connection with the purchase;
• a third party to respond to requests relating to a criminal investigation or alleged or suspected illegal activity;
• a third party, in order to enforce or defend our rights, or to address financial or reputational risks;
  a rights holder in relation to an allegation of intellectual property infringement or any other infringement; and other recipients where we are authorized or required by law to do so.
  Where we transfer and/or store your personal information

We are based in USA so your data will be processed in US. Some of the recipients we have described in section above, and to whom we disclose your personal information, are based outside USA in places like Canada, Ireland, Germany, UK, and the France. We do this on the basis of your consent to this policy. In order to protect your information, we take care where possible to work with subcontractors and service providers who we believe maintain an acceptable standard of data security compliance.

How you can access your personal information

You can access some of the personal information that we collect about you by logging in to your account. You also have the right to make a request to access other personal information we hold about you and to request corrections of any errors in that data. You can also close the account you have with us for any of our Sites at any time. To make an access or correction request, contact support using the contact details at the end of this policy.

Marketing Choices regarding your personal information

Where we have your consent to do so (e.g. if you have subscribed to one of our e-mail lists or have indicated that you are interested in receiving offers or information from us), we send you marketing communications by email about products and services that we feel may be of interest to you. You can ‘opt-out’ of such communications if you would prefer not to receive them in the future by using the “unsubscribe” facility provided in the communication itself.

You also have choices about cookies, as described below. By modifying your browser preferences, you have the choice to accept all cookies, to be notified when a cookie is set, or to reject all cookies. If you choose to reject cookies some parts of our Sites may not work properly in your case.

Cookies  and web analytics

For more information about how we use cookies, web beacons, pixels and similar technologies, see http://www.allaboutcookies.org.

When you visit our Sites, there’s certain information that’s recorded which is generally anonymous information and does not reveal your identity. If you’re logged into your account some of this information could be associated with your account. We’re talking about the following kinds of details:
your IP address or proxy server IP address’;
the domain name you requested;
the name of your internet service provider is sometimes captured depending on the configuration of your ISP connection;
the date and time of your visit to the website;
the length of your session;
the pages which you have accessed;
the number of times you access our site within any month;
the file URL you look at and information relating to it;
the website which referred you to our Sites; and
the operating system which your computer uses.

Occasionally, we will use third party advertising companies to serve ads based on prior visits to our Sites. For example, if you visit our Sites, you may later see an add for our products and services when you visit a different Site.

Information you make public or give to others

If you make your personal information available to other people, we can’t control or accept responsibility for the way they will use or manage that data. There are lots of ways that you can find yourself providing information to other people, like when you post a public message on a forum thread, share information via social media, or make contact with another user (such as a third party Author) whether via our Sites or directly via email. Before making your information publicly available or giving your information to anyone else, think carefully. If giving information to another user via our Sites, ask them how they will handle your information. If you’re sharing information via another website, check the privacy policy for that site to understand its information management practices as this privacy policy will not apply.

How long we keep your personal information

We retain your personal information for as long as is necessary to provide the services to you and others, and to comply with our legal obligations. If you no longer want us to use your personal information or to provide you with the VHS(Rosadyn), you can request that we erase your personal information and close your VHS(Rosadyn)account. Please note that if you request the erasure of your personal information we will retain information from deleted accounts as necessary for our legitimate business interests, to comply with the law, prevent fraud, collect fees, resolve disputes, troubleshoot problems, assist with investigations, enforce the terms of service and take other actions permitted by law. The information we retain will be handled in accordance with this Data Privacy Policy.

Destruction and Disposal
Upon expiry of our retention periods, we shall delete confidential or sensitive records categorized as requiring high protection and very high protection, and we shall either delete or anonymise less important documents.

Our [Records Management Officer/Other Officer/Manager] is responsible for the continuing process of identifying the records that have met their required retention period and supervising their destruction. The destruction of confidential, financial, and personnel-related records shall be securely destroyed electronically or by shredding if possible. Non-confidential records may be destroyed by recycling.

How you can contact us

If you have any questions about our privacy practices or the way in which we have been managing your personal information, please contact our privacy champion in writing at 225 S. Ivy Ave #1027 Monrovia, CA 91017 or support@rosadyn.com

You made it to the end of the data privacy policy, because knowing this stuff is the best way to understand how your personal information is used and how to best manage it!

If you’re a user or visitor in the European Economic Area these rights also apply to you:

For the purposes of applicable EU data protection law (including the General Data Protection Regulation 2016/679 (the “GDPR”), we are a ‘data controller’ of your personal information.

How you can access your personal information

You are also entitled to ask us to port your personal information (i.e. to transfer in a structured, commonly used and machine-readable format, to you), to erase it, or restrict its processing. You also have rights to object to some processing that is based on our legitimate interests, such as profiling that we perform for the purposes of direct marketing, and, where we have asked for your consent to process your data, to withdraw this consent as more fully described below.

These rights are limited in some situations – for example, we can demonstrate that we have a legal requirement to process your personal information. In some instances, this means that we may retain some data even if you withdraw your consent.

Where we require your personal information to comply with legal or contractual obligations, then provision of such data is mandatory: if such data is not provided, then we will not be able to manage our contractual relationship with you, or to meet obligations placed on us. In all other cases, provision of requested personal information is optional.

If you have unresolved concerns you also have the right to complain to data protection authorities. The relevant data protection authority will be the data protection authority of the country: (i) of your habitual residence; (ii) of your place of work; or (iii) in which you consider the alleged infringement has occurred.

Both personal information and personal data have the same meaning in the context of this Data Privacy Policy

VHS (Rosadyn) Data Privacy Valid effective date May 5th, 2018