Data Protection & Privacy Policy

1. Data Controller and Contact

The designated Data Protection Officer (DPO) is Oli Munns, Co-Founder of Respira Health. Email: data@respirahealth.org

All participant requests regarding data access, correction, or deletion should be directed to this contact.

2. Lawful Purpose and Consent

Personal data will be collected for the purposes of evaluating the feasibility, acceptability, safety, and effectiveness of the WhatsApp-based pulmonary rehabilitation programme. This includes measurement of health outcomes (e.g. symptom burden, functional capacity, quality of life, life satisfaction), engagement metrics, and participant and clinician feedback to inform current programme design and future scaling.

It also includes related future research, such as retrospective analysis across programme cohorts, academic publications and presentations, and sharing anonymised or de-identified data with academic, clinical, or funding partners to advance pulmonary rehabilitation research and practice.

Explicit informed consent covering this full scope of use, including future research use of anonymised or de-identified data, will be obtained from all participants before any data collection. Consent will include the purpose of data use, voluntary participation, and rights of withdrawal.

3. Data Collection and Minimisation

Only data necessary for the programme’s objectives will be collected, including demographic details, clinical indicators, engagement metrics and any feedback. Data collection will be conducted in a manner that minimises the use of personally identifiable information, except where explicitly disclosed and consented to, as in Section 5.

4. Data Storage and Security

Data will be securely stored and processed using the following systems:

• Turn.io (WhatsApp Business API), hosted on Google Cloud (Europe), ISO 27001 certified.
• Respira Health servers and databases hosted on Google Cloud Project and Google Workspace (United States / Europe).

All systems employ encryption, password protection, and restricted access to authorised personnel only. Access to identifiable data will be limited to specific staff bound by confidentiality agreements or Memoranda of Understanding (MoUs).

5. WhatsApp Community Group

Participants may optionally join a WhatsApp group as part of the programme, without affecting access to other components. Before joining, participants are informed via an explicit opt-in step that their phone number will be visible to other group members and Respira Health staff (whose numbers will equally be visible), that only staff can post, and that participants should not contact one another outside the group.

Participants may leave at any time; those who withdraw will be removed by the team, and groups are deactivated upon programme completion. Phone numbers visible within the group are treated as personal data under this policy and the DPDP Act (2023), and must not be used outside the group. However, messages and phone numbers already visible to other members remain on their devices beyond Respira Health's control, and full deletion cannot be guaranteed. WhatsApp group data is also subject to Meta's own data processing terms and international data flows, independently of Section 6.

6. Cross-Border Data Transfer

Participant data may be processed and stored outside India (in Europe and the US) for the purposes described in Section 2, including programme evaluation and research. Data will be handled in accordance with the DPDP Act (2023) and applicable international privacy standards.

7. Data Retention and Deletion

Identifiable participant data will be retained for a period of five (5) years following participation to enable data validation and reporting. After this period, all identifiers will be permanently deleted or anonymised, and only aggregated, de-identified data will be preserved for research records.

8. Participant Rights

Participants have the right to:

• Access their personal data
• Request correction of inaccuracies
• Withdraw consent and request data deletion
• Receive information on data use and sharing.

Requests can be submitted at any time via email to data@respirahealth.org.

9. Data Breach Management

In the event of a data breach, Respira Health will notify the Data Protection Board of India and affected participants without delay, providing details of the nature, extent, and likely impact of the breach. A detailed follow-up report, including remedial measures taken, will be submitted to the Data Protection Board within seventy-two (72) hours of becoming aware of the incident, or such longer period as the Board may permit. An internal investigation will be conducted to identify the cause, impact, and corrective actions.

10. Data Sharing and Secondary Use

Anonymised or aggregated participant data may be used for related research purposes, including retrospective analysis, academic publication, and sharing with clinical, academic, or funding partners, without seeking further consent, provided this is consistent with the purposes described in Section 2. Identifiable participant data will not be sold or shared with third parties for commercial or unrelated purposes. Any use of identifiable data for a purpose materially different from those described in this policy, or sharing with a new third party not named here, will require fresh participant consent.

11. Compliance and Oversight

This policy aligns with the requirements of the Digital Personal Data Protection Act (2023), the ICMR National Ethical Guidelines (2023), and applicable hospital ethics committee standards. Respira Health commits to upholding the highest standards of transparency, confidentiality, and participant rights throughout the study.