Privacy Policy

1. Introduction

Vård Digital Health Ltd ("we," "our," or "us") is committed to protecting your privacy and personal data. This Privacy Policy explains how we collect, use, disclose, and safeguard your information when you visit our website vardhealth.com, use our services, or interact with us regarding investment opportunities.

We are registered in Ireland (Company Registration Number: 748115) and comply with the General Data Protection Regulation (GDPR) and Irish Data Protection Acts.

2. Information We Collect

2.1 Information You Provide Directly

When you interact with us, we may collect:

• Contact Information: Full name, email address, phone number, postal address
• Investment Inquiry Data: Potential investment amount, messages, residency status, risk acknowledgment
• Investor Information: Investment amount, shareholding details, tax residency, PPS number, date of birth, nationality, ID documents, proof of address, source of funds declaration
• KYC/AML Documentation: Identity verification documents, financial information as required by law
• Communication Data: Any information you provide when contacting us via email, phone, or forms
• IP Address on Form Submission: When you submit a meeting request, enquiry, or contact form, we record your IP address alongside your submission for spam prevention, fraud detection, and abuse monitoring

2.2 Information Collected Automatically

When you visit our website, we automatically collect:

• Usage Data: Pages visited, time spent on pages, links clicked, referring website
• Device Information: Browser type and version, operating system, device type
• IP Address: Your IP address is logged when you submit website forms and may be used to determine general geographic location for security and fraud prevention purposes
• Cookies and Tracking: As described in our Cookie Policy (Section 9)

4. How We Use Your Information

We use your information for the following purposes:

• Investment Processing: To evaluate, process, and manage investment inquiries and investor relations
• Communication: To respond to your inquiries, provide updates, and send important notices
• Legal Compliance: To comply with KYC/AML requirements, tax regulations, and other legal obligations
• Service Improvement: To understand how our website is used and improve our services
• Marketing: With your consent, to send you information about our products, services, and investment opportunities
• Security: To protect against fraud, unauthorised access, and other security threats

5. Legal Basis for Processing

Under GDPR, we process your personal data based on:

• Consent: You have given clear consent for us to process your personal data for specific purposes (e.g., marketing communications)
• Contractual Necessity: Processing is necessary for a contract we have with you (e.g., investment agreements)
• Legal Obligation: We must process your data to comply with the law (e.g., KYC/AML, tax reporting)
• Legitimate Interests: Processing is in our legitimate business interests (e.g., fraud prevention, website analytics), provided your rights don't override these interests

6. Data Sharing and Disclosure

We may share your information with:

• Service Providers: Third-party vendors who assist with website hosting, analytics, email services, document storage, and payment processing
• Regulatory Authorities: Revenue Commissioners, Companies Registration Office, Enterprise Ireland, and other regulatory bodies as required by law
• Investors and Partners: With your consent, we may share information with co-investors or strategic partners
• Business Transfers: In the event of a merger, acquisition, or sale of assets, your data may be transferred to the acquiring entity

We do not sell your personal data to third parties.

7. Data Retention

We retain your personal data only for as long as necessary to fulfill the purposes outlined in this Privacy Policy, unless a longer retention period is required or permitted by law.

• Investment Data: Retained for the duration of your investment plus 7 years for tax and regulatory compliance
• KYC/AML Documentation: Retained for 5-7 years after the end of the business relationship as required by Irish AML regulations
• Inquiry Data: Retained for up to 2 years if no investment is made, then securely deleted
• Website Analytics: Aggregated and anonymized data may be retained indefinitely

8. Your Rights Under GDPR

Under GDPR, you have the following rights:

• Right to Access: Request a copy of the personal data we hold about you
• Right to Rectification: Request correction of inaccurate or incomplete data
• Right to Erasure: Request deletion of your data (subject to legal obligations)
• Right to Restriction: Request limitation on how we process your data
• Right to Object: Object to processing based on legitimate interests
• Right to Data Portability: Receive your data in a structured, machine-readable format
• Right to Withdraw Consent: Withdraw consent for data processing at any time
• Right to Lodge a Complaint: File a complaint with the Data Protection Commission (Ireland)

To exercise any of these rights, please contact us using the details in Section 13.

9. Cookies and Tracking Technologies

We use cookies and similar tracking technologies to enhance your browsing experience and analyse website traffic. Cookies are small text files stored on your device.

Types of Cookies We Use:

• Essential Cookies: Necessary for the website to function properly (e.g., security, navigation)
• Analytical Cookies: Help us understand how visitors use our website (e.g., Google Analytics)
• Functional Cookies: Remember your preferences and personalise your experience

You can control cookies through your browser settings. However, disabling cookies may affect website functionality. By using our website, you consent to our use of cookies as described in this policy.

10. Data Security

We implement appropriate technical and organizational measures to protect your personal data against unauthorized access, alteration, disclosure, or destruction. These measures include:

• Encryption of data in transit and at rest
• Secure cloud storage with access controls
• Regular security assessments and updates
• Staff training on data protection
• Restricted access to personal data on a need-to-know basis

However, no method of transmission over the internet is 100% secure. While we strive to protect your data, we cannot guarantee absolute security.

11. International Data Transfers

Your personal data is primarily stored within the European Economic Area (EEA). If we transfer data outside the EEA, we ensure appropriate safeguards are in place, such as:

• Standard Contractual Clauses approved by the European Commission
• Transfers to countries with adequate data protection levels
• Your explicit consent for specific transfers

12. Links to Other Websites

Our website may contain links to third-party websites. We are not responsible for the privacy practices or content of these external sites. We encourage you to review their privacy policies before providing any personal information.

13. Contact Us

If you have questions about this Privacy Policy, wish to exercise your data protection rights, or have concerns about how we handle your personal data, please contact us:

Data Protection Officer: For data protection inquiries, you may also contact our DPO at the above address.

14. Changes to This Privacy Policy

We may update this Privacy Policy from time to time to reflect changes in our practices, technology, legal requirements, or other factors. We will notify you of material changes by:

• Posting the updated policy on our website with a new "Last Updated" date
• Sending you an email notification (if you have provided your email address)

Your continued use of our website and services after changes are posted constitutes your acceptance of the updated Privacy Policy.

15. Complaints

If you are not satisfied with how we handle your personal data, you have the right to lodge a complaint with the Irish Data Protection Commission: