These terms describe how screenme.science processes personal data on behalf of an organisation that runs a screening programme. They supplement our Privacy Policy and apply where a participant takes part through an employer, school, kindergarten, university, course or other programme.
1. Our role
Where a participant takes part through a programme, the organisation running that programme is the controller of the personal data and decides what screening is run and why. screenme.science acts as their processor and processes the data only on their documented instructions.
Where an individual uses screenme.science on their own, without belonging to a programme, screenme.science is the controller and our Privacy Policy applies in full instead of these terms.
2. What we process, and why
Categories of data: account details (name, email); the screening recording; still images taken from it, including the participant's face and the test device; the reference photograph the participant enrolled; the test result and outcome; and technical and log data.
Categories of data subject: participants enrolled in the controller's programme, and the coordinators who administer it.
Purposes: verifying that a screening was performed by the invited participant, issuing a timestamped record, and making the programme's status available to its coordinators.
Special category data: the face comparison processes biometric data for the purpose of uniquely identifying a person, and screening results are health-related data.
3. Consent is the controller's responsibility
The controller is responsible for establishing a lawful basis for the processing it instructs, including obtaining the participant's explicit consent to the face check under Article 9(2)(a) GDPR, and for informing participants about it.
Where the participant is a child, the controller is responsible for obtaining consent from the person holding parental responsibility, and for the arrangements that require an adult to be present during the screening.
We collect the participant's own confirmation of consent in the app at the time of each screening, and record which version of the consent text was shown. That record supports the controller's obligation; it does not replace it.
4. Sub-processors
We engage sub-processors in the following categories:
Cloud storage, for recordings, still images and screening records. This storage is not currently restricted to the European Union.
Processing of the recording and still images to verify a screening, including the face check.
Payment processing. It receives no screening data.
The current list of sub-processors is available to the controller on request, and we will inform the controller before adding or replacing one.
Where a sub-processor processes data outside the European Economic Area, the transfer is made under the European Commission's standard contractual clauses.
5. Deletion
On termination of the agreement with the controller we delete the personal data we hold on their behalf, or return it, at the controller's choice, except where we are required to retain it by law.
Retention periods during the agreement are set out in section 6 of our Privacy Policy. A participant who withdraws consent to the face check has their reference photograph deleted without their account being closed.
6. Signed agreement
A signed data processing agreement under Article 28 GDPR is available on request. Contact us using the details below.
Contact
For a data processing agreement, a list of current sub-processors, or questions about these terms, contact us at privacy@screenme.science.
Last updated: September 2026