CONFIDENTIAL : The information in this document is strictly confidential. You may not copy it in any form or by any mechanical or electronic means, forward it, disclose it, or use any or all of it without prior written approval from Ad Scientiam.

This Privacy Policy describes how Ad Scientiam collects, uses, shares, and processes your personal information in connection with the MSCopilot® Application, and the rights you have in this regard. If you have questions, please contact us.

Ad Scientiam shall act as the data controller for patient data, upon creation of their account, as long as they are not paired with a healthcare professional

If you decide to pair with a healthcare professional, your healthcare professional will be the data controller and Ad Scientiam will serve as data processor, acting on instruction from your healthcare professional. In such cases, we are not responsible for the data protection and security practices of the healthcare professionals using our product, which may differ from those set out in this privacy policy, and we do not have any control over the data.

We collect and process personal data for various purposes, including the following:

• Provision of the MSCopilot® Product:
• Reporting
• Audience measurements
• Notifications, newsletter, etc.

Your data collected through the MSCopilot® application may also be reused for research purposes in the health sector. For more information, you can visit the following website at any time:

• https://privacy.adscientiam.com/fr/transparence for French speakers
• et https://privacy.adscientiam.com/en/transparence for English speakers

The data is collected either directly from you when you use the application, through your device, possibly through our contractors and service providers, or through the healthcare professional you are paired with.

• Administrative identification data (last name, first name, email address, etc.)
• Application login data (login credentials, etc.)
• Health-related data (disease characteristics, height and weight, comorbidities and risk factors, etc.)
• Data relating to your personal and professional life (family situation, level of education)
• Data issued from use of the MSCopilot® application (digital test results, and raw data)
• Data from your smartphone (model, operating system type and version, and screen dimensions)
• Audience measurement data (date and time of the access, session duration, pages visited, and browsing path, etc.)

If you contact us by email, especially to exercise your rights, other data may be collected, in particular your identification document or any other information you deem it necessary to send us.

Your data may be accessible to the following people:

• Specially trained Ad Scientiam employees within the limits of their respective assignments, solely for carrying out the purposes of this policy;
• If you accept, the medical team that cares for you through provision of the MSCopilot® Product, allowing your doctor to monitor your disease
• The employees of legally authorized healthcare or oversight authorities;
• In the event of a dispute, authorized employees of our insurer;
• Any of the service providers with whom we have contracts (for more information, see the list of contractors in Annex 1)
• Ad Scientiam’s data protection officer in cases where you contact them to exercise your rights or submit a complaint.

Your pseudonymized data may also be shared with third parties for research in the health sector.

Ad Scientiam will store your data for the entire period during which the MSCopilot® Application is provided.
If you do not use application for two years or if you request that your data be deleted, your data will be archived for ten years in compliance with the medical device regulations applicable to Ad Scientiam.

Your healthcare professional will also store your data in compliance with the requirements applicable to them. Typically, in France, patient data must be stored by healthcare professionals or organizations for 20 years from the date of the last treatment.

The hosting provider’s servers are located in the European Union.

However, in order to provide services, Ad Scientiam may use service providers who may transfer your personal data outside the European Union, and in particular to New Zealand or the United States. Ad Scientiam has verified that all recipients of your data located outside the European Union ensure a sufficient level of personal data protection.

Furthermore, for the vision test, we use the text transcription modules that are already integrated into your smartphone: the voice recording will thus be transferred either to Apple if you use an Apple device, or to Google or the phone’s manufacturer if you use an Android device (depending upon your smartphone settings). Only the voice recording will be sent to them; no other data about you will be transferred. Since the servers used by Apple, Google, or your smartphone manufacturer are located throughout the world, your voice recordings may be transferred outside the European Union. Special consent will be requested if this is the case.

Under certain conditions you have certain rights, in particular:

• The right to access your data, especially to verify its accuracy;
• The right to rectify, supplement, or update it;
• The right to request erasure of your data;
• The right to restrict processing of your data, meaning to temporarily block the use of your data;
• Data portability rights, meaning to request that it be sent to you in a structured and machine-readable format, in order to transmit it to another data controller;
• Depending on the circumstances, the right to object to the processing of your data. To do this, go to the application settings to manage your preferences.
• The right to request deletion of your account at any time;
• The right to submit a claim to the competent data protection authority if, after having contacted us, you believe your rights have not been respected.

For more information or to exercise your rights, you may:

• first, contact the healthcare professional you are paired with on the application,
• then contact Ad Scientiam by email at the following address: privacy@adscientiam.com

Ad Scientiam : Ad Scientiam (AdS), a simplified joint-stock company with a capital of €13,405.00 registered in the Paris Trade and Companies Register under number 795 083 336, with its registered office located at 38 rue Dunois, 75647 Paris Cedex 13.

Data Protection Officer: the person responsible for ensuring that processing operations comply with the requirements of the GDPR within the organization that has appointed them.

Business Associate: under HIPAA regulations, a natural or legal person that performs certain functions or activities involving the use or disclosure of protected health information on behalf of a covered entity, or that provides services to such entity. This definition only applies to patients residing within the United States of America.

Personal Data: any information concerning an identified or identifiable physical person as defined in Article 4.1 of the GDPR.

Health Data: data on the past, present, or future physical or mental health of a physical person (including the provision of healthcare services) that reveals information on the health status of that person, as defined in Article 4.15 of the GDPR.

HIPAA : the “Health Insurance Portability and Accountability Act” of 1996, a United States federal law that establishes data security and privacy requirements for organizations that use and disclose patient health information. This law only applies to Ad Scientiam when users of the application are patients residing in the United States of America.

Data Controller: the organization (natural or legal person) that determines the purposes and means of processing, i.e., the objective of the processing and how it is carried out, as defined in Article 4(7) of the GDPR. The personal data processing controller is subject to several obligations under the GDPR: in particular, it must implement physical and organizational measures to protect data against any loss of confidentiality, integrity, or availability.

GDPR: dshall mean the General Data Protection Regulation (EU) 2016/679 of the European Parliament and of the Council of April 27, 2016, on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC.

Data Processor: the natural or legal person (company or public body) that processes personal data on behalf of another organization (the “controller”), in the context of a service or provision of services, as defined in Article 4(8) of the GDPR.

Processing:any operation or set of operations performed on personal data, by any means (such as collection, recording, organization, storage, adaptation, alteration, retrieval, consultation, use, disclosure by transmission, dissemination, or otherwise making available, or alignment), as defined in Article 4(2) of the GDPR.

Transfer:TAny dissemination, copying, or movement of personal data for the purposes of processing in a country outside the European Union.

In compliance with the European General Data Protection Regulation (GDPR) applicable to Ad Scientiam as a French company, there are two primary roles in processing personal data:

• The data controller is the person who determines the purposes and method for processing your personal data
• The data processor is the person processing personal data on behalf of the data controller They act under the data controller’s authority and upon their instructions.

Depending upon the purposes for which your data is processed, Ad Scientiam may have either role when you use the MSCopilot® application.

Once you have created your account through the application, and in order to take full advantage of the software medical device created by Ad Scientiam, you will be offered the opportunity to pair with a healthcare professional. This will make it possible to view information collected by the application and the biomarkers produced by the primary care doctor who is monitoring your disease.

Therefore:

• Ad Scientiam shall act as the data controller for patient data, upon creation of your account, if you are not paired with a healthcare professional
• If you decide to pair with a healthcare professional, your healthcare professional will be the data controller, and Ad Scientiam will serve as data processor, acting on instruction from your healthcare professional. In such cases, we are not responsible for the data protection and security practices of the healthcare professionals using our product, which may differ from those set out in this privacy policy, and we do not have any control over the data.

For all other purposes listed in the section below (“Why does Ad Scientiam process your personal data?”), Ad Scientiam will serve as the data controller.

Whether acting as data controller or data processor, Ad Scientiam shall take appropriate measures to ensure the protection and privacy of the personal data it holds or that it processes in compliance with applicable laws.

Your pseudonymized (and potentially de-identified) data may be:

• reused by Ad Scientiam to improve its solutions and products, verify the performance and security of its medical devices, create new medical devices or digital biomarkers, develop AI systems, and in general, improve medical knowledge.
• shared with Ad Scientiam’s partners, and in particular, institutions, universities, and pharmaceutical partners. If the information shared is still considered to be personal data, these partners will then be responsible for their own processing and must comply with all applicable data protection regulations.

Within this framework, upon launching the application, you will be asked whether or not you wish to have your personal data reused or shared for these purposes. You may also object to processing of your data for these purposes at any time by going to the application settings, then “My preferences,” then “My consent” and checking “I refuse” in the “Data reuse” section. You must then click the “Save” button at the bottom of the page to apply the changes. Objection to this processing will not affect the use of the MSCopilot® application or the provision of care by your healthcare professional. Despite your objection, your data may be reused for these purposes if the processing is carried out as part of Ad Scientiam’s legal obligations, and in particular its obligations stemming from medical device regulations.

To obtain information about this processing:
- A notice will be sent to your email address, if you agree to receive email or push notifications from Ad Scientiam;
- You may also visit the following website at any time: https://privacy.adscientiam.com/fr/transparence for French speakers, and https://privacy.adscientiam.com/en/transparence for English speakers. The website will be updated each time Ad Scientiam or one of its partners plans to reuse your pseudonymized data in a way that requires new processing of your personal data. The posting of projects on the website constitutes notice of this reuse of data and, accordingly, no additional individual information letter will be sent to you for each new data reuse project. It will be regularly updated based on studies involving your personal data, and we therefore recommend that you consult it periodically to stay informed about the processing of your data.

When you navigate in the application, Ad Scientiam places cookies on your device (computers, smartphone, tablet, etc.). These cookies are only intended as audience measurements for our Product (to measure performance, identify browsing problems, optimize technical performance or ergonomics, estimate required server power, analyze content viewed), and only to produce anonymous statistical data solely for Ad Scientiam as publisher of the MSCopilot® Product. We ensure that the audience measurement service provider does not use the collected data for its own purposes.

Your data may be accessible to the following people:

• Specially trained Ad Scientiam employees within the limits of their respective assignments, solely for carrying out the purposes of this policy;
• If you accept, the medical team that cares for you through provision of the MSCopilot® Product, allowing your doctor to monitor your disease
• The employees of legally authorized healthcare or oversight authorities;
• In the event of a dispute, authorized employees of our insurer;
• Any of the service providers with whom we have contracts (for more information, see the list of contractors in Annex 1)
• Ad Scientiam’s data protection officer in cases where you contact them to exercise your rights or submit a complaint.

Additionally, as part of healthcare studies, research, and analyses we may conduct (for more information, see the section “Can your personal data be reused for other purposes?” above), we may share your data with third parties other than those listed above, and in particular:

• industrial partners, researchers, or academics to conduct studies;
• contractors other than those listed in Annex 1.

In this context, we will endeavor to share only coded data (i.e., no directly identifying data will be disclosed), unless this is strictly necessary for the conduct of the study. You will be informed of each person who may receive your directly identifying data via our transparency portal (https://privacy.adscientiam.com/fr/transparence or https://privacy.adscientiam.com/en/transparence).

Ad Scientiam’s hosting provider’s servers are located in the European Union. This service provider is certified as a “Health Data Hosting Provider” by the ANS (French National Agency for Digital Healthcare).

In order to provide services, Ad Scientiam may also use service providers who may transfer your personal data outside the European Union, in particular:

• The data collected for audience measurement purposes will be transferred to New Zealand, a country whose legislation has been recognized by the European Commission as ensuring an adequate level of protection for personal data.
• Data collected on anomalies within the application may be transferred to the United States, where, because the service provider has taken steps to comply with the “data protection framework,” it is considered to provide an adequate level of personal data protection.

Lastly, as part of the vision test, you will be asked to pronounce the characters that appear on the screen. To determine whether the spoken character corresponds with the one displayed on the screen, your voice will be recorded and then transcribed in text format. To do this, we use the text transcription modules that are already integrated into your smartphone: the voice recording will thus be transferred either to Apple, if you use an Apple device, or to Google or your telephone’s manufacturer if you use an Android device (depending on your smartphone settings). Only the voice recording will be sent to them; no other data about you will be transferred. Once the recordings have been transcribed, Ad Scientiam will receive them in text format to ensure the accuracy of your response.
Since the servers used by Apple, Google, or your smartphone manufacturer are located throughout the world, your voice recordings may be transferred outside the European Union, including to countries where you cannot exercise your rights to data protection. For this reason, you will be asked for your consent. If you refuse to allow your voice recordings to be transferred, you will not be able to complete the vision test. Additionally, Apple, Google, and the manufacturer of your smartphone are required to implement appropriate guarantees to protect your data during these transfers.

We take all required precautions, in particular organizational, technical, and physical measures, to prevent the accidental or illicit destruction, loss, alteration, or unauthorized disclosure of the personal data we process or use.
Additionally, each Healthcare Professional who accesses your personal data (with your consent) must guarantee its security and confidentiality.

Although we follow state-of-the-art practices to protect your information, no method of storage or transmission is 100% secure. You are solely responsible for protecting your password, limiting access to your devices, and logging out of the application after your sessions. In particular, we remind you to be sure to:

• keep your login credentials secret
• ensure that access to your smartphone or computer is properly secured, potentially using a password or any other means (facial recognition, fingerprint, etc.) to unlock the device.

Under certain conditions you have certain rights, in particular:

• The right to access your data, especially to verify its accuracy;
• The right to rectify, complete, or update it: to do so, you can modify your data directly by going to “My medical profile”: where you can modify the information on your profile, pathology, and treatment. If you wish to modify other data, you can send an email to the Ad Scientiam Data Protection Officer at the address listed in “Contact;”
• The right to request that your data be deleted: to do so, please delete your account, under the terms set out above for withdrawing your consent to Ad Scientiam’s processing of your health data;
• The right to restrict processing of your data, meaning to temporarily block the use of your data;
• Data portability rights, meaning to request that it be sent to you in a structured and machine-readable format, in order to transmit it to another data controller;
• And depending upon the case:
  

  - The right to withdraw your consent at any time, especially for the following purposes:

  • The provision of the MSCopilot® Product and the collection of your personal health data: if you withdraw your consent for this purpose, we will no longer be able to provide the MSCopilot® application to you. Go to the application settings, then go to the “My Account” tab and request that your account be deleted. However, deleting your account will not delete your personal data. In fact, due to medical device regulations applicable to the MSCopilot® Product, Ad Scientiam is required to store some of your personal data for ten years. Thus, from the moment you delete your account, your data will be archived in compliance with the regulations in force. On the other hand, no new data will be collected from you, and the archived personal data will no longer be used for any purposes other than to meet the legal obligations applicable to Ad Scientiam.

  • Notifications, newsletter, etc.: to do this, go to application settings, then “My Preferences,” then “My Consent” and check “I refuse” in the “Notifications, newsletter, and contact for studies” section. You must then click the “Save” button at the bottom of the page to apply the changes;

  - Or the right to object to processing of your data for the following purposes:

  • Audience measurements: to do this, send an email to the following address: privacy@adscientiam.com ;

  • Reuse of your data for other research: to do this, go to application settings, then “My Preferences,” then “My Consent” and check “I refuse” in the “data reuse” section. You must then click the “Save” button at the bottom of the page to apply the changes. Your objection will not apply to research that has already been started with your data.

If you believe your rights have not been respected after contacting us, you also have the right to submit a claim to the competent data protection authority. Specifically, since Ad Scientiam is a French company, send claims to the Commission Nationale de l’Informatique et des Libertés:(French National Data Protection Commission):

• By written letter: Commission nationale de l’informatique et des libertés, Service des plaintes, 3 Place de Fontenoy, TSA80715, 75334 PARIS CEDEX 07 ;
• or online: https://www.cnil.fr/fr/plaintes.

For more information and to exercise your rights, contact Ad Scientiam by email at the following address: privacy@adscientiam.com .

In this case, you must provide identification, the right you wish to exercise from among those listed above, and the personal data you wish to access, or that we need to rectify, update, or delete.

When necessary, or in the event of reasonable doubt as to your identity, we may ask you to provide proof of identity, such as a copy of an identity document (identity card or passport) or any other document enabling us to verify your identity.

Know that the personal data collected as part of exercising your rights will be stored for five years from the last exchange between Ad Scientiam and you.

You can contact your healthcare professional, who is the data controller. At the request of the healthcare professional, Ad Scientiam may assist them in following up on requests sent by you.

The MSCopilot® Product is intended for use by adults and their healthcare professionals.

Since the MSCopilot® Product is intended for persons aged eighteen (18) years or older who are capable of entering into binding obligations under applicable law, we do not knowingly collect personal data from minors. If we unintentionally collect personal data from someone under the age of eighteen (18), we will take all necessary measures to delete the personal data in question as soon as possible, in compliance with current laws.

This Privacy Policy describes how your medical data may be used or disclosed and how you may have access to this information. Please read carefully.

This section specifies how we use and disclose your medical information in accordance with HIPAA regulations. This is in addition to the information already specified throughout this Privacy Policy.

Ad Scientiam acts as a business associate (as defined in HIPAA regulations) for the doctor responsible for monitoring your disease. Therefore, this section describes how Ad Scientiam uses and shares your data. Your healthcare professional may use and share this information for other purposes: if you have questions, contact them immediately.
In general, how do we use or share your health data?

We use or share your health data in the following ways:

• To provide the MSCopilot® Product and to allow the healthcare professional you have selected, with your consent, to monitor your disease through the application.
  Example: When you use the application and if you are paired with a healthcare professional, the data collected will be shared and made available to that healthcare professional so that they can monitor the evolution of your disease.
• To improve the MSCopilot® Product and, in particular, to improve the artificial intelligence systems used to calculate digital biomarkers, correct bugs and application crashes, and improve your user experience.
  Example: We use health data to correct application bugs in the vision test.
• To invoice for our services
  We may use and share your health information to bill and obtain payment for the services we provide to you through the MSCopilot® Product, either from you or from health insurance entities.
  Example: We send your data to your health insurance provider to obtain payment for our services.

Can we use or share your health data for other purposes?

We are authorized or required to share your data in other ways - in general to contribute to public wellbeing, as well as public health and research. We must meet a number of legal requirements before we can share your information for these purposes.

For more information: www.hhs.gov/ocr/privacy/hipaa/understanding/consumers/index.html.

• For public health and safety: We may share your health data in certain situations such as:

  - Disease prevention

  - Contributing to product recalls

  - Reporting adverse reactions to our product as a medical device

• To conduct research: We may use or share your data to conduct research in the health sector. We will only use your health data in the following cases:

  - If your data has been de-identified in compliance with HIPAA regulations. In this case, your data will no longer be considered PHI.

  - Or if you have provided specific authorization to reuse your data for a specific study or project.

• To comply with the law: We will share data about you if so required by federal or local laws, including with the Department of Health and Human Services if it seeks to verify our compliance with federal privacy law.
• To respond to lawsuits and legal action: We may share your health data in response to legal or administrative injunctions, or in response to a court summons.

Under HIPAA regulations, you have certain specific rights. In such cases, we invite you to contact the healthcare professional monitoring you through the application, and who you are paired with, directly. Because Ad Scientiam acts as a “business associate” of your healthcare professional, the latter is the entity best able to answer your questions or respond to your requests to exercise your rights.

We are bound by law to preserve the privacy and security of your health data.

We will not use or share your information other than in the ways described in this Privacy Policy, unless you give us written authorization. In such cases, you may change your mind at any time.

In accordance with HIPAA, we undertake to return or destroy your protected health information (PHI) at the end of our contractual relationship with your healthcare professional, unless deletion is impossible due to legal obligations; this is notably the case because of data retention requirements arising from medical device regulations applicable to the MSCopilot® Product. In this case, your data will be stored securely and used only to fulfill legal obligations.

If you are a California resident, you have special rights under the California Consumer Privacy Act (CCPA), as amended by the California Privacy Rights Act (CPRA).

In particular, California law grants California residents certain rights, including rights to know what data is collected and to access it, learn how we process personal data, request its deletion or rectification, and refuse to share your personal data with third parties for advertising purposes. Additionally, we confirm that you will not be subject to any discrimination (and in particular, you will not be refused services) by us for having exercised these rights. To exercise these rights, see the section “How to contact us” above.

In addition, as a company subject to the CCPA, we will not sell your personal data. However, we may share your data with third parties, and in particular with:

• Our authorized service providers only if they have accepted our contractual limitations on storage, use, and disclosure of this personal data
• Healthcare professionals treating you as part of the medical monitoring of your disease, if you decide to pair with a healthcare professional using the MSCopilot® Product
• Entities that may be called upon to process your data for health studies, research, or analyses

Furthermore, we undertake not to combine your personal data with other data in our possession, except in cases permitted by law (security, fraud detection, compliance).

For more information, see the section “Who do we share your personal data with?” above.

We may update this Privacy Policy to reflect changes resulting from modifications to our practices, the technologies used, or the legal requirements applicable to us.

Where applicable, we will update the “effective date” listed below the “Privacy Policy” title.

If we make a significant update, we may inform you before the update takes effect, for example by contacting you directly or by sending notifications through our application. Where required by applicable law and to the extent possible, we may also ask for your consent to these changes.

We encourage you to regularly review this privacy policy to stay informed about how we collect, process, and share your personal data.