Privacy Policy — Cuestionarios Disfagia

Last updated: March 17, 2026

1. Introduction

This Privacy Policy explains how the Cuestionarios Disfagia mobile application ("the App"), operated by Asociación de Investigación Biomédica Mancha Centro ("we", "us", "our"), collects, uses, stores, retains, and protects your personal and health data.

By using the App, you consent to the practices described in this Privacy Policy. If you do not agree with this policy, please do not use the App.

2. Purpose of the App

Cuestionarios Disfagia is a clinical tool designed to help patients diagnosed with Eosinophilic Esophagitis (EoE) complete standardized medical questionnaires related to their condition. The questionnaires assess dysphagia symptoms, quality of life, swallowing function, and dietary behaviors. The data collected supports clinical monitoring and research conducted by healthcare professionals.

3. Data We Collect

3.1 Personal Data

When your healthcare provider registers you in the system, the following personal data is collected:

• Full name (first name and last name)
• Email address
• Phone number
• Associated medical center
• Voucher/ticket code (used to access the App)

3.2 Health Data

The App collects sensitive health data through standardized clinical questionnaires. This includes:

• Dysphagia Symptom Questionnaire (CSD): Information about solid food consumption, swallowing difficulties, actions taken to manage swallowing issues, and pain/discomfort severity.
• EoE Quality of Life Questionnaire (EoO-QOL-A): Stress related to your diagnosis, dietary restrictions and concerns, impact on daily routines, social limitations, and food-related anxiety.
• EAT-10 Swallowing Screening: Weight changes due to swallowing problems, difficulty swallowing solids, liquids, and pills, pain when swallowing, and impact on food enjoyment.
• MD Anderson Dysphagia Inventory (MDADI): Psychological and emotional impact of swallowing difficulties, social limitations, self-esteem effects, and daily activity impact.
• BEDQ and EHAS Questionnaires: Food frequency and consumption patterns, choking and reflux episodes, and healthcare adaptation measures.
• Questionnaire completion dates and times.
• Questionnaire scores and calculated results.

3.3 Device and Technical Data

• Push notification token: A unique identifier used to send you reminders about pending questionnaires.
• Device platform: Whether you use Android or iOS, used to deliver notifications correctly.

3.4 Data We Do NOT Collect

• We do not access your location, camera, microphone, contacts, photos, or calendar.
• We do not collect browsing history or usage analytics.
• We do not use advertising identifiers.

4. How We Use Your Data

We use your data exclusively for the following purposes:

Purpose	Data Used	Legal Basis
Enable access to the App	Voucher code, name	Performance of agreement with your healthcare provider
Administer clinical questionnaires	Health data, questionnaire responses	Explicit consent; scientific research purposes
Send questionnaire reminders	Push notification token, device platform	Legitimate interest (treatment adherence)
Clinical monitoring by your healthcare team	All collected data	Healthcare provision; explicit consent
Biomedical research on EoE	Anonymized/pseudonymized health data	Scientific research (GDPR Art. 9(2)(j))
System administration	Personal data, technical data	Legitimate interest (service operation)

5. Health Data — Special Protections

Health data is classified as special category data under the EU General Data Protection Regulation (GDPR). We process your health data based on:

• Your explicit consent, obtained through your healthcare provider before using the App.
• Purposes of preventive or occupational medicine, medical diagnosis, and provision of health care (GDPR Art. 9(2)(h)).
• Scientific research purposes (GDPR Art. 9(2)(j)), with appropriate safeguards.

Your health data is treated with the highest level of confidentiality and is only accessible to authorized healthcare professionals and administrators involved in your care or in the associated research.

6. Data Sharing

6.1 Third-Party Service Providers

We use the following third-party service providers to operate the App:

Provider	Purpose	Data Shared
Supabase (supabase.com)	Cloud database hosting	All data stored in the App
Expo (expo.dev)	Push notification delivery	Push notification tokens, device platform

These providers act as data processors on our behalf and are bound by data processing agreements. They do not use your data for their own purposes.

6.2 Data We Do NOT Share

• We do not sell your personal or health data.
• We do not share your data with advertisers.
• We do not share identifiable data with any parties other than your healthcare team and the service providers listed above.

6.3 Legal Obligations

We may disclose your data if required by law, regulation, or court order.

7. Data Retention

We retain your data for the following periods:

Data Type	Retention Period
Personal data (name, email, phone)	For the duration of your participation in the clinical program, plus 5 years after your last interaction with the App, or as required by applicable healthcare regulations.
Health data (questionnaire responses)	For the duration of the research study, plus 15 years following completion, in compliance with biomedical research regulations (Spanish Law 14/2007 on Biomedical Research).
Push notification tokens	Until you uninstall the App or revoke notification permissions.
Technical logs (notification delivery logs)	12 months from the date of creation.

After the applicable retention period, your data will be securely deleted or irreversibly anonymized.

8. Data Security

We implement appropriate technical and organizational measures to protect your data, including:

• All data transmitted between the App and our servers is encrypted using HTTPS/TLS.
• Database access is restricted through role-based access controls.
• Administrative access requires authenticated credentials.
• Our cloud infrastructure provider (Supabase) maintains industry-standard security certifications.

While we take reasonable steps to protect your data, no method of electronic transmission or storage is 100% secure. We cannot guarantee absolute security.

9. Your Rights

Under the GDPR and applicable Spanish data protection law (LOPDGDD), you have the following rights:

• Right of Access: You can request a copy of all personal and health data we hold about you.
• Right to Rectification: You can request correction of inaccurate data.
• Right to Erasure ("Right to be Forgotten"): You can request deletion of your personal data. See Section 10 below for how to exercise this right.
• Right to Restriction of Processing: You can request that we limit how we process your data.
• Right to Data Portability: You can request your data in a structured, machine-readable format.
• Right to Object: You can object to processing based on legitimate interest.
• Right to Withdraw Consent: You can withdraw your consent at any time without affecting the lawfulness of prior processing.

To exercise any of these rights, contact us at support@rc-bits.com.

We will respond to your request within one month. In certain circumstances, this period may be extended by two additional months, in which case we will inform you.

You also have the right to lodge a complaint with the Spanish Data Protection Agency (AEPD) at www.aepd.es.

10. How to Request Data Deletion

You can request the deletion of your personal and health data at any time by:

1. Contacting us by email at support@rc-bits.com with the subject line "Data Deletion Request — Cuestionarios Disfagia". Include your full name and the medical center associated with your account so we can locate your records.
2. Contacting your healthcare provider who enrolled you in the program, who can submit the deletion request on your behalf.

Upon receiving your request:

• We will verify your identity.
• We will delete or anonymize your personal data and health data within 30 days.
• We will confirm the deletion to you in writing.
• Push notification tokens associated with your device will be removed.

Uninstalling the App removes locally stored data (voucher code) from your device but does not delete your data from our servers. To delete server-side data, you must submit a deletion request as described above.

11. Children's Privacy

The App is not intended for use by children under the age of 16. We do not knowingly collect personal data from children. If you believe a child has provided us with personal data, please contact us and we will take steps to delete it.

12. International Data Transfers

Your data is stored on servers operated by Supabase. If data is transferred outside the European Economic Area (EEA), it is protected by appropriate safeguards such as Standard Contractual Clauses (SCCs) approved by the European Commission.

13. Changes to This Privacy Policy

We may update this Privacy Policy from time to time. We will notify you of material changes by updating the "Last updated" date at the top of this policy. We encourage you to review this policy periodically.

14. Contact Us

If you have any questions or concerns about this Privacy Policy or our data practices, please contact us: