ANSARA PHARMACARE DATA PRIVACY POLICY

V1.0 July 2026

Last updated: July 1, 2026

PREAMBLE – PURPOSE OF THE PRIVACY POLICY

1. This personal data privacy policy (hereinafter the “Policy”) is intended to describe clearly and concisely the conditions under which ANSARA PHARMACARE, a simplified joint-stock company with share capital of EUR 355,000, registered with the Lille Métropole Trade and Companies Register under number 880 319 454, whose registered office is located at 14 rue du Vieux Faubourg, 59800 Lille (FRANCE) (hereinafter “ANSARA PHARMACARE” or “we”), which publishes the ANSARA web application (hereinafter the “Application”) accessible at https://www.ansara.care/ or at any URL that may replace it, processes personal data (hereinafter “Personal Data”) relating to any natural person using the Application (hereinafter the “Users”).

For the purposes hereof, the term “User(s)” means the holder of an ANSARA account as well as, where applicable, their relatives, whether minor children or adults, whose profile they manage within ANSARA PHARMACARE (hereinafter the “Relative(s)”).

The Personal Data Privacy Policy therefore governs any processing of Personal Data carried out by ANSARA PHARMACARE in connection with making the Application available.

The Policy is intended to inform you about the use and protection of your Personal Data by ANSARA PHARMACARE when it acts as Data Controller.

Indeed, when ANSARA PHARMACARE processes Users’ Personal Data, we are subject to the regulations in force relating to the protection of personal data.

Accordingly, ANSARA PHARMACARE is subject to Regulation (EU) 2016/679 of the European Parliament and of the Council of April 27, 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data (the “General Data Protection Regulation” or “GDPR”), the amended French Data Protection Act of January 6, 1978, the recommendations and guidance of the French Data Protection Authority (CNIL), the guidelines of the European Data Protection Board (EDPB), and any other legal or regulatory provision that may supplement and/or replace them (hereinafter collectively, the “Applicable Regulations”).

2. For the purposes hereof, terms beginning with a capital letter in this Privacy Policy have the meaning expressly defined herein or assigned to them by the Applicable Regulations.

ARTICLE 1 – IDENTITY OF THE DATA CONTROLLER: WHO ARE WE?

Within the meaning of the Applicable Regulations, the Data Controller is the legal entity (company, etc.) or natural person that determines the purposes and means of data processing, i.e., the objective of the processing and how it is carried out.

ANSARA PHARMACARE develops and publishes the Application and provides services to healthcare professionals and their patients, in particular to enable and facilitate communication between them when they do not speak the same language.

The Application allows you to access various services, including, in particular, creating your User account, managing profiles for your minor children and/or adults for whom you are responsible (hereinafter your “Relatives”), entering and storing your health information and that of your Relatives within the Application (hereinafter your “Digital Health Notebook”), recording your care requests and, where applicable, sharing them with a healthcare professional (“Healthcare Professional”), and conversing during a medical consultation in your original language with a Healthcare Professional while benefiting from an instant translation service to facilitate access to healthcare (hereinafter the “Services”).

ANSARA PHARMACARE acts as Data Controller of your Personal Data when it acts on its own behalf and decides the purposes for which your Personal Data is used, for example when you create your User account or when you use the Application.

However, when you interact with a healthcare professional during a consultation, that healthcare professional is responsible for collecting and processing your Personal Data. In this case, the Healthcare Professional acts as Data Controller and ANSARA PHARMACARE may act as Data Processor for your Healthcare Professional.

ARTICLE 2 – WHAT CATEGORIES OF DATA ARE COLLECTED AND PROCESSED BY ANSARA PHARMACARE?

The Personal Data processed by ANSARA PHARMACARE comes from different sources.

2.1. Direct Collection of Your Personal Data by ANSARA PHARMACARE

your Personal Data is primarily collected directly from you, in particular when you provide it to ANSARA PHARMACARE, including when you use the Application (creation of an account or profiles, use of the various Services available within the Application, etc.) or during any interaction or exchange with us.

In order to enable you to use the Services of the Application, we collect and process your Personal Data.

ANSARA PHARMACARE applies by default the principles of data minimization and protection of Personal Data in the performance of its services (“privacy by design” and “privacy by default”). Consequently, only Personal Data that is relevant, adequate and limited to what is necessary in relation to the purposes for which your Data is processed is collected.

2.2. Indirect Collection of Your Personal Data from Third Parties

your Personal Data may also be collected indirectly, i.e., when it is not collected directly from you by ANSARA PHARMACARE, but is provided by a third party or obtained from other sources.

This is particularly the case when a User holding an ANSARA PHARMACARE account creates and manages, within the Application, a profile for one of their Relatives or invites a Relative to join their Family Space. In this context, some of your Personal Data may be entered and transmitted to ANSARA PHARMACARE by that User.

When creating or managing the profile of an adult Relative, the User holding the account declares and acknowledges that they have first obtained the adult Relative’s express agreement to the creation and management of their profile and to the entry of their Personal Data within the Application. The User determines, under their responsibility, the Personal Data they wish to enter and, where applicable, share, including with a Healthcare Professional, and undertakes to process or share only Personal Data for which they have the necessary authorizations.

The adult Relative may, at any time, withdraw their agreement and request that management of their profile by the User holding the account and/or the entry or sharing of their Personal Data be terminated. They may also contact ANSARA PHARMACARE directly to request that they take over management of their profile.

When creating and managing the profile of a minor Relative, the User holding the account declares and acknowledges that they are the minor’s legal representative or have the necessary authorizations to create and manage the profile, enter the minor’s Personal Data and, where applicable, share it, including with a Healthcare Professional. The User undertakes to take into consideration the minor Relative’s views according to their age and degree of maturity.

Upon reaching the age of majority, the Relative may take over management of their profile or authorize the User holding the account to continue managing it and accessing the associated Personal Data. In the absence of such authorization, the User holding the account is no longer authorized to enter, modify or share the Personal Data of the Relative who has reached the age of majority.

The arrangements for terminating profile management, taking over a profile by a Relative, and managing access to Personal Data are specified in ANSARA’s General Terms of Use.

As a general rule, the User holding the account remains at all times responsible for the Data they choose to enter and share when managing a Relative’s profile.

2.3. Depending on the purposes for which your Personal Data is collected by ANSARA PHARMACARE, we process in particular the following categories of Personal Data concerning you:

Data relating to your identity: title, last name, first name, gender, profile photograph;
Data relating to the identity of Relatives when a Family Space is created (identity, email address of your family members, profile photographs of profiles in the Family Space);
Data relating to the management of Users’ access rights to a Family Space (including Relatives): profiles they may access; settings for access authorizations/revocations;
The User’s contact details and those of their Relatives when a Family Space is created (email address, telephone number);
Data comprising your Digital Health Notebook and that of your Relatives (minor children or adults) when you have entered it in the Application, such as your date of birth, sex, height, weight, health information, including allergies, conditions, surgical and medical history, treatments, vaccinations and their dates, medical devices used, information relating to pregnancy and breastfeeding, responses to questionnaires made available in the Application, and medical documents provided, such as prescriptions, X-rays, ultrasound scans, test results, etc.;
Data relating to your preferences for use of the Services (language, measurement system, etc.);
Data relating to your care requests that You record in the Application, including your Health Data (date, patient concerned, reason for the request, type of request, answers to automated questionnaires concerning your medical history, medical documents and photographs provided, history of your requests);
Data relating to the sharing of your care requests with a Healthcare Professional, including sharing keys, the Data you decide to share with that Healthcare Professional concerning your care requests, and technical data enabling care requests to be shared;
Data relating to your conversations via the instant messaging module with Healthcare Professionals on the Application, including your care requests and the Health Data you wish to share with the Healthcare Professional, it being specified that this Data is not stored in your ANSARA PHARMACARE space and is deleted at the end of the discussion;
Data relating to transactions that you carry out in order to access the Application or the Services;
Data relating to your use of the Application (connection and usage logs, IP address);
Browsing history on the Application when you have consented to cookies and tracking technologies being placed on your browser (see our Cookie Policy);
Data relating to your requests and your communications with ANSARA PHARMACARE in connection with use of the Application (support, assistance requests, etc.).

Failure to provide certain data makes it impossible to provide certain Services available on the Application. Accordingly, only fields marked with an asterisk (*) on forms relating to your account or to your requests on the Application are mandatory; other information that you provide when using the Application is entirely at your discretion.

2.4. The exhaustive list of categories of Personal Data processed is set out in Article 3 of the Policy.

ARTICLE 3 – WHAT ARE THE PURPOSES OF OUR PERSONAL DATA PROCESSING / THEIR LEGAL BASES AND RETENTION PERIODS?

ANSARA PHARMACARE carries out the following data processing activities in connection with its activities and the provision of its Services:

Name of Personal Data processing activity	Purpose(s) of the Personal Data processing	Categories of Personal Data	Legal basis for the Personal Data processing	Personal Data retention period
Creation and management of User accounts	Enable the creation and management of Users’ accounts on the Application.	For each User and, where applicable, each Relative: - Data relating to the User’s identity, contact details (email address, telephone number), date of birth, gender (sex), title, profile photograph, and preferences for use of the Services. - Password (encrypted), Account Data: date and time of account creation and deletion.	Performance of the contract (acceptance of the General Terms of Use)	For as long as the account is active. Deletion two years after the last login of the User concerned OR Deletion upon termination of the account by the User. Where profile records have been created by the User on behalf of Relatives, deletion of a User account results in deletion of the associated Relative profile record. Where a Relative is linked to several User accounts, deletion of one User account will not result in deletion of the Relative profile record from the other User accounts to which the Relative is linked.
Creation and management of the Digital Health Notebooks of Users and their Relatives in the Application’s Family Space	Enable the creation, completion, updating and management of the digitized health notebooks of each User, including Relatives registered in the Application’s Family Space.	Data relating to the account and identity of the User and the Relative concerned. Data relating to the Relative invited to join the Family Space (identity, contact details, photograph of the Relative). Settings for access rights / authorizations / revocations of access for each adult member of the Family Space (including the User who created the Family Space). Data relating to requests made for each profile (date, nature of the request, responses to questionnaires, data shared with Healthcare Professionals). Data completed for each profile, including health information (identity, age, date of birth, sex, height, weight, health information, including allergies, conditions, surgical and medical history, treatments, vaccinations, medical devices used, information relating to possible pregnancies and breastfeeding, responses to questionnaires made available on the Application, and medical documents provided, such as prescriptions, X-rays, ultrasound scans, test results, etc.).	Performance of the contract as regards creation of the account Consent for data to be completed/provided	For as long as the account is active. The User may delete or modify a profile in their personal space at any time. Deletion two years after the last login of the User concerned OR Deletion upon termination of the account by the User.
Informing Relatives (adult relatives of the User) when a User creates a profile on their behalf	Inform the Relative that a profile has been created by a User to whom the Relative has entrusted management of their data and primarily enable the Relative to: - manage, complete, update and delete the Data in their profile and the data contained in the Digital Health Notebook; - configure access rights to their profile and authorizations to share care requests with Healthcare Professionals; - where applicable, object to creation of their profile by a User or to the processing of certain Data concerning them.	Data relating to the Relative concerned (identity, photograph, contact details, title, etc.). Data completed in the profile of the Relative concerned, including health information, where applicable. Data relating to management of the profile by the Relative concerned (validation of profile creation, objection to profile creation, etc.). Data relating to the profiles to which the Relative concerned has access within the Family Space (access rights, sharing authorizations, revocation of an authorization, etc.). Where applicable, Data relating to an objection to creation of a Profile within the Family Space and/or an objection to sharing profile data with the User who created the Family Space.	Legitimate interest	For the period required to send the notification, until the Relative objects to creation of their profile. The Relative concerned may delete or modify their profile on the Application at any time. Deletion two years after the last login of the User concerned OR Deletion upon termination of the account by the User.
Inviting Relatives (adult relatives of the User) to create a profile and join the Family Space	Invite the adult Relative to join the Family Space and primarily enable them to: - create a profile and complete their Data and the data contained in the Digital Health Notebook; - configure access rights to their profile and authorizations to share care requests with Healthcare Professionals; - where applicable, decline the invitation to create a profile and join the Family Space.	Data relating to the Relative concerned (identity, photograph, contact details, title, etc.). Data completed in the profile of the Relative concerned, including health information, where applicable. Data relating to management of the profile by the Relative concerned (creation of the profile, objection to profile creation, etc.). Data relating to the profiles to which the Relative concerned has access within the Family Space (access rights, sharing authorizations, revocation of an authorization, etc.). Where applicable, Data relating to the absence of creation of an invited Profile and refusal to join the Family Space.	Legitimate interest	- If the invited Relative does not create an account within 90 days of the invitation, the Relative’s Data is deleted at the end of this period and the invitation is deactivated. - If the invited Relative accepts the invitation and creates a profile within the Family Space: The Relative concerned may delete or modify their profile on the Application at any time. Deletion two years after the last login of the User concerned. OR Deletion upon termination of the account by the User.
Creation and management of care requests by Users and/or their Relatives	Creation of a care request (reporting symptoms) by the User for themselves or their Relative in order to prepare for a medical consultation. Description of the request using the Chat Bot (or conversational assistant) made available within the Application.	Data relating to the User or Relative concerned (identity, information contained in the profile of the person concerned) and selection of the pathway (e.g., I wish to report symptoms, an emergency, search for a product/medication, other need). Data relating to the care request and/or the health of Users and their Relatives using this service, including health information (date, patient concerned, description of the care request based on the pathway, photographs and/or file to be provided to the Healthcare Professional, responses to questions from the conversational assistant based on the care pathway selected by the User, health documents provided by the User, Health Data). History of your care requests and those of your Relatives according to the access-right settings.	Consent	The User may delete or modify a care request in their personal space at any time. Until the care request is deleted by the User. If the User does not delete it: Deletion two years after the last login of the User concerned OR Deletion upon termination of the account by the User.
Transmission of Users’ and/or their Relatives’ Data to Healthcare Professionals in connection with medical consultations	During the medical consultation, ensure transmission to the Healthcare Professional of the selected Data relating to the Relative’s and/or User’s care request. Manage and archive requests in the User space.	Data relating to the identity of the User or Relative concerned by the request. Data relating to the care request, including health information (date, patient concerned, description of the care request based on the pathway, photographs and/or file to be provided to the Healthcare Professional, responses to questions from the Chat Bot based on the care pathway selected by the User, health documents provided by the User, Health Data). Data selected by the User or Relative concerned from the information completed in their profile for transmission to the Healthcare Professional concerned, including Health Data. Data relating to transmission of the request to the Healthcare Professional (sharing key, sharing-key expiration date, QR CODE, etc.).	Consent	For the period necessary to transmit the care request and the information it contains OR For 6 months from the date the care request and Users’ Data are transmitted. The User may delete or modify a request in their personal space at any time. Deletion two years after the last login of the User concerned OR Deletion upon termination of the account by the User.
Recording, written transcription and translation of Users’ oral exchanges with Healthcare Professionals	During a consultation or exchange with a Healthcare Professional: - Enable Users to communicate with Healthcare Professionals: record exchanges between the Healthcare Professional and the User (patient); - Provide a written transcription of oral exchanges in the original language of the User and the Healthcare Professional; - Provide an accurate translation of their exchanges into the language of the Healthcare Professional and the User, directly within the conversational assistant.	Data relating to the identity of the User or Relative concerned by the discussion. Data relating to exchanges with the Healthcare Professional, including Health Data.	Consent	Only during the conversation between the User and the Healthcare Professional. Automatic deletion of the exchange history at the end of the discussion with the Healthcare Professional.
Management of subscriptions to and sending of the ANSARA newsletter	Manage subscriptions to the ANSARA newsletter and send the newsletter to subscribers.	Data relating to the identity of the data subject, contact details, and data relating to viewing of newsletters.	Consent	Until consent is withdrawn or 3 years after the last contact with the data subjects.
Management of tracking pixels	Use of tracking pixels (or any equivalent tracking technology) in your email messages, newsletters, transactional emails and cart reminders for the following purposes: Analysis of email open rates to measure and optimize campaign performance by personalizing message content or adapting the sending frequency or communication channel (email, SMS, push notification, etc.).	Data relating to viewing of emails and recipient engagement: recipient identity and email address, technical identifier associated with the message, open status, date and time opened, IP address, device and browser information and, where applicable, approximate location inferred from the IP address.	Consent	Until consent is withdrawn or for a maximum period of 13 months from collection of the tracking event, whichever occurs first. At the end of this period, the data is deleted or anonymized.
Management of transactions carried out by Users on the Application	Manage payments made by Users to access the Application or the Services.	Data relating to the Client’s identity, the payment methods used and the transaction carried out.	Performance of the contract	For the duration of the contractual relationship.
Identification of potential fraud in connection with payments made on the Application	Identify potential cases of fraud committed by Users in connection with a payment made on the Application (fraudulent claims, etc.).	Data relating to the User and the attempted fraud.	Legitimate interest	5 years from collection.
Management of unpaid amounts	Record unpaid amounts owed by Users and follow up with them until payment is recovered.	Data relating to the User’s identity, transaction-related data, contact details, data relating to the payment incident, and Data relating to the actions taken and debt-recovery follow-up.	Performance of the contract	If the unpaid amount is settled: deletion of information relating to the unpaid amount within 48 hours. If the unpaid amount is not settled: 2 years from the occurrence of the unpaid amount (limitation period for actions against consumers, Article L.218-2 of the French Consumer Code).
Preparation of audience measurement statistics on the Application (cookies)	Prepare audience measurement statistics on the Application using cookies placed on users’ devices.	Data relating to the data subject’s visit to the Application.	Consent	Maximum of 13 months from placement.
Accounting	Maintain the Data Controller’s accounting records in compliance with applicable legal provisions.	Data relating to the User’s identity and contact details, order data and transaction data.	Legal obligation	Active database: 10 years from the invoice issue date (French Commercial Code). Intermediate archiving: 10 years from the close of the relevant financial year (Article L.123-22 of the French Commercial Code).
User support management	Handle Users’ assistance or support requests relating to use of the Services available on the Application.	Data relating to the identity and contact details of the User who submitted the assistance or support request. Data relating to the data subject’s assistance or support request (date, content, etc.). Where applicable, Data voluntarily provided by the User to the support service (with the User’s consent), including Health Data (information contained in the User’s profile or support request, screenshots, etc.).	Performance of the contract	Active database: for the period necessary to process the assistance or support request. Where applicable, Health Data provided by the User is retained only for the period necessary to process their request.
User support management	Archive assistance requests for evidentiary purposes and to defend ANSARA’s rights in the event of a claim or dispute.	Data relating to the identity and contact details of the User who submitted the assistance or support request. Data relating to the data subject’s assistance or support request (date, content, etc.). Where applicable, Data voluntarily provided by the User to the support service (with the User’s consent), including Health Data (information contained in the User’s profile or support request, screenshots, etc.).	Legitimate interest	Intermediate archiving: Data relating to the User’s request may be archived beyond a period of 3 years from the User support request. Archiving for the entire ordinary-law limitation period of 5 years provided for by Article 2224 of the French Civil Code. Deletion of Health Data not required as evidence before archiving.
Monitoring use of the Application and Services for security purposes	Analyze use of the Application and Services in order to ensure their security and detect, prevent and address security vulnerabilities, unauthorized access attempts, fraudulent use or abnormal technical behavior, including behavior associated with the use of bots. Prevent and combat cyber risks and maintain the security of the Application.	Identification and account-related Data: User identifier, account identifier and identifier of the profile concerned. Connection and session logging Data: IP address, date and time of connection, timestamp data, connection and activity logs, actions performed within the Application. Technical and device-related Data: device type, operating system, browser type and version, technical identifiers and session-related data. Data relating to use of the Application and Services: frequency and volume of requests, features used, sequences and frequency of actions performed, login attempts and abnormal technical events or behavior.	Legitimate interest	1 year from collection of the Data.
Preparation of commercial statistics	Perform commercial analyses and statistics (number and types of Users, types of Services used within the Application).	Data relating to User types and the Services used by Users.	Legitimate interest	Active database: for the period necessary to achieve the purpose of the statistics OR Until the right to object is exercised. Thereafter: retention of anonymized data (aggregated statistics).
Conducting satisfaction surveys	Conduct satisfaction surveys among Users.	Data relating to the User’s identity and their opinion or feedback.	Consent	For the period necessary to achieve the purpose of the survey OR Until the right to object is exercised or consent is withdrawn.

ARTICLE 4 – WHO MAY ACCESS YOUR PERSONAL DATA?

4.1. Access by ANSARA PHARMACARE to Your Personal Data

As a general rule, your Personal Data is accessible only to the ANSARA PHARMACARE teams responsible for providing the Application, subject to the provisions below.

your Personal Data is confidential, secured and hosted in accordance with current industry standards. Only persons duly authorized by ANSARA PHARMACARE by reason of their duties may access your Personal Data, except where transmission of your Personal Data is required by a mandatory legal provision or by a duly authorized judicial or governmental authority.

4.2. Access by ANSARA PHARMACARE’s Data Processors to Your Personal Data

4.2.1. ANSARA PHARMACARE may subcontract the performance of certain services necessary for the provision of its services.

Within the strict scope of the purposes referred to in Article 3, your Personal Data may be transmitted to our Data Processors for processing and solely in accordance with ANSARA PHARMACARE’s specific instructions.

In this context, these third-party companies may process your Personal Data for a specific purpose, provided that appropriate confidentiality and security safeguards are maintained for your Personal Data.

In accordance with the Applicable Regulations, these Data Processors have entered into a written agreement with ANSARA PHARMACARE to ensure the security, confidentiality, retention and processing of your Personal Data solely in accordance with our instructions and under the conditions provided for by the Applicable Regulations.

Accordingly, a Data Processor is not authorized to:

Retain your Data beyond completion of the entrusted service;
Process your Personal Data in a manner other than that defined by ANSARA PHARMACARE.

4.2.2. The following companies, acting as Data Processors solely on the specific instructions and under the control of ANSARA PHARMACARE, may therefore access your Personal Data for the following purposes:

SENDINBLUE, a simplified joint-stock company with registered office at 9-17 rue Salneuve, 75017 Paris (France), registered with the Paris Trade and Companies Register under number 498 019 298, providing services enabling automatic emails to be sent to Users of the Application. SENDINBLUE has entered into a Data Processing Agreement with ANSARA, available at: https://www.brevo.com/legal/termsofuse/;
OVH, a simplified joint-stock company with registered office at 2 rue Kellermann, 59100 Roubaix (France), registered with the Lille Métropole Trade and Companies Register under number 424 761 419, responsible for hosting Data processed by ANSARA PHARMACARE through the Application. OVH has entered into a Data Processing Agreement with ANSARA, available at: https://www.ovhcloud.com/fr/terms-and-conditions/contracts/;
RIX, a simplified joint-stock company with registered office at 34 rue Jean Broquin, 69006 Lyon (France), registered with the Lyon Trade and Companies Register under number 882 702 319, responsible for hosting and managed services for the Application. RIX has entered into a Data Processing Agreement with ANSARA, available at: https://www.rix.fr/confidentialite/;
CLOUDFLARE, Inc., a company governed by U.S. law with registered office at 101 Townsend St., San Francisco, CA 94107 (United States), providing services that secure Users’ connection to the Application. CLOUDFLARE has entered into a Data Processing Agreement with ANSARA, available at: https://www.cloudflare.com/fr-fr/cloudflare-customer-dpa/;
FUNCTIONAL SOFTWARE, Inc. (SENTRY), a company governed by U.S. law with registered office at 45 Fremont Street, 8th Floor, San Francisco, CA 94105, responsible for monitoring errors that you may encounter on the Application. FUNCTIONAL SOFTWARE, Inc. (SENTRY) has entered into a Data Processing Agreement with ANSARA, available at: https://sentry.io/legal/dpa/;
STRIPE LLC, a company governed by U.S. law providing an online payment and billing solution integrated into the Application for payments made by Users. STRIPE has entered into a Data Processing Agreement with ANSARA, available at: https://stripe.com/fr/legal/dpa;
GLADIA, a simplified joint-stock company with registered office at 6B rue du Bas Village, 35510 Cesson-Sévigné (France), providing a written transcription service for your audio recordings (Speech-to-text), enabling you to communicate with the Healthcare Professionals of your choice on the Application. GLADIA has entered into a Data Processing Agreement with ANSARA, available at: https://www.gladia.io/data-process-agreement;
MISTRAL AI (LE CHAT), a simplified joint-stock company with registered office at 15 rue des Halles, 75001 Paris (France), registered with the Paris Trade and Companies Register under number 952 418 325, providing an artificial intelligence solution used in connection with chatbots implemented on the Application. MISTRAL AI has entered into a Data Processing Agreement with ANSARA, available at: https://legal.mistral.ai/terms/data-processing-addendum.

4.2.3. Hosting of Your Health Data

your Personal Data, and in particular your Health Data, is hosted within the European Economic Area.

In accordance with the Applicable Regulations and the provisions of the French Public Health Code, ANSARA PHARMACARE uses providers holding “Health Data Host” (“HDS”) certification for the relevant hosting activities to host your Health Data.

HDS certification is based on compliance with the certification standard developed by the French Digital Health Agency and approved by the minister responsible for health. Its purpose is, in particular, to strengthen the protection, confidentiality, integrity and availability of hosted Health Data.

For this purpose, ANSARA PHARMACARE uses, in particular, the following HDS-certified providers:

4.3. Access by Healthcare Professionals to Your Personal Data

Certain Services of the Application allow you to communicate with Healthcare Professionals of your choice and to transmit your Personal Data to them, including your Health Data. you therefore choose the Data that you transmit to them, in particular by selecting the information that may be communicated to them when creating a request on the Application or in connection with your communications with them.

The Healthcare Professionals you consult therefore have access only to the Data that you agree to transmit to them and do not have access to your entire profile on the Application.

When the Healthcare Professionals concerned collect your Personal Data through the Application, they are considered Data Controllers for the processing they carry out in connection with handling your request and the acts they may perform.

For any request relating to the processing of your Personal Data by Healthcare Professionals with whom you have communicated through the Application, you may therefore contact them directly.

In this respect, ANSARA PHARMACARE informs Healthcare Professionals of their obligation to process your Data in accordance with the Applicable Regulations when they access your request through the Application.

Finally, it is specified that ANSARA PHARMACARE does not archive your instant conversations with Healthcare Professionals, as such conversations are not archived in your ANSARA space.

4.4. Possible Transfer of Your Personal Data Outside the European Economic Area (EEA)

The categories of Personal Data referred to in Articles 2 and 3 of the Policy may be transferred outside the European Economic Area (EEA), in particular when you access the Application or use the Services in a country located outside the EEA.

ANSARA PHARMACARE limits the circumstances in which your Personal Data may be transferred outside the EEA and carefully selects its providers, in particular by ensuring that they have implemented appropriate safeguards allowing your Data to be transferred outside the EEA in accordance with the Applicable Regulations.

your Personal Data may in particular be transferred outside the EEA in the following cases:

When ANSARA PHARMACARE uses the services of CLOUDFLARE, which secure your connection to the Application, in particular when you access the Services from a country located outside the EEA. CLOUDFLARE has access only to Data relating to your connection to the Application. If your Personal Data is transferred to a country that has not been the subject of an adequacy decision by the European Commission within the meaning of Article 45 of the GDPR, the transfer of your Personal Data is governed by appropriate safeguards in the form of Standard Contractual Clauses entered into with CLOUDFLARE, available at: https://www.cloudflare.com/trust-hub/gdpr/.
When ANSARA PHARMACARE uses the services of SENDINBLUE (BREVO), which enable automatic emails to be sent to Users of the Application. SENDINBLUE has access only to your contact details (identity, email) and the content of automatic emails sent by ANSARA PHARMACARE. If your Personal Data is transferred to a country that has not been the subject of an adequacy decision by the European Commission within the meaning of Article 45 of the GDPR, the transfer of your Personal Data is governed by appropriate safeguards in the form of Standard Contractual Clauses entered into with SENDINBLUE, available at: https://www.brevo.com/fr/legal/termsofuse/.
When ANSARA PHARMACARE uses the services of FUNCTIONAL SOFTWARE, Inc. (SENTRY), which enable monitoring of potential errors that may affect the Application. FUNCTIONAL SOFTWARE, Inc. (SENTRY) has access only to Data relating to incidents or errors that you encounter on the Application. If your Personal Data is transferred to a country that has not been the subject of an adequacy decision by the European Commission within the meaning of Article 45 of the GDPR, the transfer of your Personal Data is governed by appropriate safeguards in the form of Standard Contractual Clauses entered into with SENTRY, available at: https://sentry.io/legal/dpa/.
When ANSARA PHARMACARE uses the services of STRIPE, which enable online payment on the Application. STRIPE has access only to the information enabling you to complete transactions on the Application (banking information and transaction-related information). If your Personal Data is transferred to a country that has not been the subject of an adequacy decision by the European Commission within the meaning of Article 45 of the GDPR, the transfer of your Personal Data is governed by appropriate safeguards in the form of Standard Contractual Clauses entered into with STRIPE, available at: https://stripe.com/fr/legal/dta.
When ANSARA PHARMACARE uses the services of MISTRAL AI, which enable implementation of the chatbots available on the Application. If your Personal Data is transferred to a country that has not been the subject of an adequacy decision by the European Commission within the meaning of Article 45 of the GDPR, the transfer of your Personal Data is governed by appropriate safeguards in the form of Standard Contractual Clauses entered into with MISTRAL AI, available at: https://legal.mistral.ai/terms/data-processing-addendum.

ARTICLE 5 – WHAT RIGHTS DO YOU HAVE REGARDING YOUR PERSONAL DATA?

5.1. List of Your Rights

Depending on the legal basis relied upon for each Personal Data processing activity, the rights that you may exercise may vary.

you will find below the list of rights you may exercise depending on the legal basis relied upon for each Personal Data processing activity (source table: CNIL):

	Right of access	Right to rectification	Right to erasure	Right to restriction of processing	Right to data portability	Right to object
Consent	Yes	Yes	Yes	Yes	Yes	Withdrawal of consent
Contract	Yes	Yes	Yes	Yes	Yes	No
Legitimate interest	Yes	Yes	Yes	Yes	No	Yes
Legal obligation	Yes	Yes	No	Yes	No	No
Public interest	Yes	Yes	No	Yes	No	Yes
Vital interests	Yes	Yes	Yes	Yes	No	No

Right to Information About the Processing of Your Personal Data

ANSARA PHARMACARE takes care to provide you with easily accessible, clear, concise and understandable information about the conditions under which your Personal Data is processed.

Information relating to the Processing of your Personal Data is provided to you when it is collected or, where your Data has not been collected directly from you, under the conditions provided for by the Applicable Regulations.

In this respect, you are informed in particular of:

The identity of the Data Controller(s);
The nature of the Personal Data Processing activities implemented;
The purpose of the Processing of your Personal Data;
Whether the Personal Data to be provided to ANSARA PHARMACARE is mandatory or optional;
The recipients of your Personal Data;
your rights regarding your Data and how you may exercise them;
Any transfers of data to a country located outside the European Economic Area.

The Policy also contains all information required by the Applicable Regulations.

Right of Access

The right of access enables you to obtain from any Data Controller:

Confirmation as to whether or not the Data Controller holds data concerning you, as well as the data on which ANSARA PHARMACARE relied to make a decision and the sources of such data;
A copy of such data;
Certain information relating to the characteristics of the processing (purposes pursued, intended retention periods, identity of recipients or categories of recipients, etc.).

The right of access applies to Personal Data concerning you that is processed by ANSARA PHARMACARE, whether collected directly from you or indirectly from third parties, including a User who created or managed your profile on the Application.

In accordance with the Applicable Regulations, the right to obtain a copy of your Personal Data must not adversely affect the rights and freedoms of others, including trade secrets, intellectual property rights, the right to privacy or the confidentiality of correspondence.

Where disclosure of certain information is likely to adversely affect the rights and freedoms of a third party, ANSARA PHARMACARE takes the necessary measures to reconcile your right of access with the rights and freedoms of that third party and may, in particular, redact information concerning that third party before providing you with a copy of your Personal Data.

Right to Rectification

The right to rectification enables you to:

Correct inaccurate data;
Complete data in relation to the purpose of the processing.

Right to Erasure

The right to erasure enables you to request deletion of your data if:

It is no longer necessary in relation to the purpose pursued;
It has been unlawfully processed;
It must be erased in order to comply with a legal obligation provided for by European Union law or the law of the Member State to which the Data Controller is subject;
Consent is the legal basis and is withdrawn;
The data subject has objected to the processing and there are no overriding legitimate grounds for the processing, or the data is processed for direct marketing purposes.

This right may be excluded in a limited number of cases. In particular, it must not conflict with:

Exercise of the right to freedom of expression and information;
Compliance with a legal obligation;
Use of data where it concerns a public interest in the area of public health;
Use of data for archiving purposes in the public interest, scientific or historical research purposes, or statistical purposes;
The establishment, exercise or defense of legal claims.

Right to Object

If the processing is based on legitimate interest, you have the right to object to further processing of your data on grounds relating to your particular situation.

The Data Controller must then stop processing this data unless there are compelling legitimate grounds for processing the data concerned or the data is necessary for the establishment, exercise or defense of legal claims.

Although the right to object may, in certain cases, result in deletion of your data, such deletion is neither automatic nor systematic.

Right to Restriction of Processing

The right to restriction of processing supplements the exercise of other rights: when you exercise your right to object or your right to rectification, the Data Controller has a period of time in which to respond.

During this period, you may request that ANSARA PHARMACARE freeze the data concerned and not use it during that period.

Right to Data Portability

The right to data portability enables you to request:

Retrieval of your data;
Transfer of your data to an organization of your choice, subject to two conditions:
the data is processed by automated means;
the processing is based on the data subject’s consent or on performance of a contract.

Right to Withdraw Your Consent

If the processing is based on your consent, you have the right to withdraw it at any time.

Right to Set Instructions Concerning Your Data After Your Death

you have the right to set instructions concerning the retention, erasure and disclosure of your Personal Data after your death. These instructions may be registered with a trusted third party certified by the CNIL or directly with the Data Controller concerned.

Right to Lodge a Complaint With a Supervisory Authority (CNIL)

If, despite ANSARA PHARMACARE’s efforts to preserve the confidentiality of your data and protect your privacy, you believe that your rights have not been respected, you may lodge a complaint with the French Data Protection Authority (Commission Nationale de l’Informatique et des Libertés – CNIL), www.cnil.fr.

5.2. How to Exercise Your Rights

These rights may be exercised upon a simple request from you, subject to providing proof of your identity by any means.

Where there is reasonable doubt as to the identity of the data subject, ANSARA PHARMACARE may request any document that can prove your identity, for example in order to prevent identity theft.

Exercise of all these rights is free of charge. However, reasonable fees may exceptionally be charged in certain cases involving exercise of the right of access (for example, when an additional copy is requested).

To exercise your rights or if you have any questions regarding the Processing of your Personal Data, you may contact the Data Controller (ANSARA PHARMACARE) as follows:

By email: dpo@ansarapharmacare.com

The Data Controller undertakes to respond to you as soon as possible and, in any event, no later than one month from receipt of your request. Where necessary, this period may be extended by two months, taking into account the complexity and number of requests submitted to the Data Controller. In such case, you will be informed of the extension and the reasons for the delay.

ARTICLE 6 – SECURITY AND CONFIDENTIALITY OF YOUR PERSONAL DATA

In accordance with the Applicable Regulations, the Data Controller implements appropriate technical and organizational measures to ensure a level of security appropriate to the risk. These measures are defined taking into account the state of the art, implementation costs, and the nature, scope, context and purposes of the processing, as well as risks of varying likelihood and severity to the rights and freedoms of natural persons.

ANSARA PHARMACARE applies strict data confidentiality measures in order to prevent data from being altered, damaged, destroyed or disclosed to unauthorized third parties.

For example:

Management of data processing by third parties and use of Data Processors providing security safeguards appropriate to the risk and holding certifications required by law or regulation;
Securing and restricting access to its premises;
Traceability and restriction of access to Data;
Securing its information system.

ARTICLE 7 – CHANGES TO THE PRIVACY POLICY

The Personal Data Privacy Policy may be amended or supplemented at any time, in particular in order to comply with any legislative, regulatory or case-law development, interpretation by supervisory authorities, or change in the Personal Data processing activities carried out by ANSARA PHARMACARE. In the event of changes, such changes will apply as soon as the updated Policy is posted online and under the conditions provided for by the Applicable Regulations.

ARTICLE 8 – GOVERNING LAW AND DISPUTES

The Privacy Policy is governed by French law.