CONNECTDROP – Protection of Personal Data

Biocorp Production (the« Company») has developed and is the publisher of the CONNECTDROP® mobile Application and takes privacy and the protection of persona! data very seriously. The Company ensures the confidentiality and security of your persona! data and complies with the applicable regulations, namely:

• The French Data Protection Act n° 7817 of 6th January 1978 ;
• EU Regulation 2016/679 on the protection of natural persons with regard to the processing of persona! data. and on the free movement of such data, of 27th April 2016, referred to as the GDPR.

The purpose of this Privacy Policy is to inform Users of the CONNECTDROP® mobile Application as well as possible of the way in which the Company protects the persona! data it collects in the context of the use of the CONNECTDROP® mobile Application and of the commitments made by the Company to ensure that Users’ persona! data is respected.

By continuing to use the mobile Application, the User acknowledges that they have read the terms of this Privacy Policy.

In this context, the User acknowledges that they take sole responsibility for the recording and accuracy of the data entered within the mobile Application, and that they undertake to take all necessary precautions, in particular in terms of security of access to their equipment or smartphone, so such data is not made accessible to unauthorised third parties. The Company cannot be held responsible for the access by such a third party to the data entered in the mobile Application in the event of negligence on the part of the User.

Usage data collected by the CONNECTDROP® mobile Application:

• Date and time of pairing of the Application with the Device;
• Date and time of the Application’s connection to the Device;
• Date and time of choosing a treatment;
• Date and time of retrieval by the Application of each instillation recorded by the Device;
• Date and time of access to the details of each tile (number of instillations, time interval, bottle position);
• Date and time of access to Treatment and Bottle management;
• Date and time the report was generated;
• Date and time of access to the “Tutorial” videos;
• Date and time of access to the user manual;
• Date and time of the notification “congratulations you are taking your treatment well”;
• Date and time of the notification “nothing has been recorded for 3 days”;
• Date and time of reauthentication;
• Date and time of retrieving the lost password.

WHO HAS ACCESS TO YOUR PERSONAL DATA?

The Company undertakes to comply with current regulations on the protection of collected personal data and ensures that your personal data, whether directly or indirectly identifiable, is only accessible to authorised persons, including the following persons:

Who has access to your directly identifiable personal data?

• The Data Protection Officer (DPO) designated by the Company in the event that you contact him (see “How can you exercise your rights” for details of how to contact the DPO), and the Company itself if necessary for the management of right by the DPO;
• The Company in exercising certain of your rights.

Who has access to your indirectly identifiable personal data?

• The Company, including its hosting provider, under strict conditions of security and confidentiality with restricted access;
• The Company’s staff whose participation is necessary to process the data;
• The persons responsible for analysing usage data relating to the CONNECTDROP® Mobile Application and the Device;
• The persons responsible for regulatory affairs with the relevant authorities.

• With your consent, the data collected by the Mobile Application may be reused, under strict conditions of security and confidentiality, in particular their hosting providers, for the purpose of carrying out a research study related to the use of the Device and the Mobile Application, promoted by the Laboratoires Théa S.A.S. For more information on this subject, we invite you to consult the information given by your healthcare professional when you were enrolled in the study.

YOUR RIGHTS OVER YOUR PERSONAL DATA

You have several rights regarding the processing of your personal data. These rights include the following:

• Access: you have the right to request access to your personal data;
• Correction: you have the right to request the correction of incomplete or inaccurate personal data that we hold about you;
• Deletion: in certain circumstances, you have the right to ask us to delete or erase your personal data. There are, however, exceptions where we may refuse a request for deletion, such as where said personal data is necessary regarding compliance with French law or if it is relevant to claims;
• Restriction: you have the right to ask us to suspend the processing of certain personal data about you, in particular if you wish us to establish their accuracy;
• Objection: you have the right to challenge the fact that we process personal data on the grounds of legitimate interest (or the interest of third parties). However, we may be authorised to continue to process your personal data on the basis of our compelling legitimate interests or where it is justified by legal claims;
• Use of your personal data after your death: you have the right to determine how your personal data will be used after your death.

You also have the right to file a complaint with a personal data protection supervisory authority: in France, the Commission Nationale de l’Informatique et des Libertés (CNIL).

HOW CAN YOU EXERCISE YOUR RIGHTS?