GDPR Compliance Policy
How REACH supports compliance with the EU General Data Protection Regulation.
1.Scope
This GDPR Compliance Policy applies where Stratech Ventures Private Limited processes personal data of individuals in the European Economic Area, the United Kingdom or Switzerland, or where a Client Organisation subject to the GDPR uses REACH. It should be read with our Privacy Policy.
2.Controller and Processor Roles
For patient data uploaded to REACH, the Client Organisation is the controller and Stratech Ventures is the processor, acting only on the Client Organisation’s documented instructions. For our own account, billing and marketing data, Stratech Ventures is the controller.
3.Data Processing Agreement
We offer a Data Processing Agreement to Client Organisations that incorporates the requirements of Article 28 GDPR, including confidentiality, security, sub-processor controls, assistance with data subject requests, breach notification and deletion or return of data at the end of the service.
4.Lawful Basis
Where we act as controller, we rely on performance of a contract, legitimate interests, legal obligations or consent, as appropriate. Health data is special category data; Client Organisations are responsible for identifying a valid Article 9 condition before uploading it to REACH.
5.Data Subject Rights
Individuals have the right to access, rectify, erase, restrict or object to processing of their personal data, the right to data portability, and the right to withdraw consent. Where we are processor, we forward requests to the relevant Client Organisation and assist it in responding. Requests where we are controller can be sent to info@reach-care.net.
6.Automated Decision-Making
REACH does not make decisions that produce legal or similarly significant effects on patients based solely on automated processing. AI-assisted scoring and routing are subject to human review under our AI governance tiers.
7.Sub-Processors
We use carefully selected sub-processors for hosting, communications, support and analytics. Each is bound by written data protection terms. A current list is available to Client Organisations on request, and we will give notice of material changes.
8.International Transfers
Where personal data is transferred outside the EEA or UK to countries without an adequacy decision, including India, we rely on the European Commission’s Standard Contractual Clauses or other lawful transfer mechanisms, with supplementary measures where appropriate.
9.Security and Breach Notification
We implement appropriate technical and organisational measures as described in our Security Policy. We will notify affected Client Organisations of a personal data breach without undue delay so they can meet their 72-hour notification obligations.
10.Records and Assessments
We maintain records of processing activities and will provide reasonable assistance to Client Organisations with data protection impact assessments and consultations with supervisory authorities.
11.Complaints
If you have concerns about how your data is handled, contact us first at info@reach-care.net. You also have the right to lodge a complaint with the data protection supervisory authority in your country of residence.
12.Contact
Questions about this GDPR Compliance Policy can be sent to info@reach-care.net.