PERSONAL DATA PROTECTION POLICY

CareCall SAS (hereinafter " CareCall ", " we " or " our ") publishes a service for managing patient communications, call management, and medical appointments (hereinafter, the " Service ").

This Policy describes how CareCall collects, uses, discloses, and processes your personal data in connection with the Service when you:

• subscribe to a subscription or use the Service as a healthcare professional (hereinafter a " Professional ");
• access our Service as a patient or future patient of a Professional (hereinafter a " Patient "); and/or
• access our website (https://tennor.fr/) (hereinafter the " Site ") as a user (hereinafter a " User ").

We kindly ask you to read this Policy explaining to you how your personal data is used by CareCall in connection with the Services and the Site, and how to exercise your rights in this regard. This Policy supplements the General Terms of Use of the Site and the General Terms of Service, as well as any document or information notice referring to this Policy.

If needed, you can ask all your questions directly to CareCall by sending a message to the following address: contact@carecall.ai.

1. WHO IS RESPONSIBLE FOR PROCESSING YOUR PERSONAL DATA?

• CareCall, as the publisher of the Site, is the data controller of Users' personal data collected within the framework of the administrative, operational, and commercial management of the Site.
• CareCall, within the framework of the management of the commercial, pre-contractual and contractual relationship with Professionals, is the data controller for Professionals' personal data.
• CareCall, within the framework of the provision of Services subscribed by Professionals and made available to Patients, is data processor for Professionals and processes Patients' personal data, including any health personal data, under the instruction and on behalf of these Professionals.
• Professionals are data controllers for Patients' personal data, collected as part of the Services and which populate appointment books and patient files maintained by and under the responsibility of Professionals. The Services do not constitute an electronic patient record software.

2. WHAT PERSONAL DATA MAY BE PROCESSED BY CARECALL?

2.1 Personal data processed by CareCall as data controller

➚ Personal data of Users collected during Site use

All data entered on the Site by a User or when a User communicates with CareCall via the Site, namely:

Some of this data is mandatory, others are optional. The mandatory or optional nature of the personal data to be provided is indicated at the time of collection. If you refuse to provide the mandatory data requested, CareCall will be unable to process your request.

➚ Personal Data of Professionals Processed dans le cadre de la gestion de la relation commerciale et de la gestion du support avec les Professionnels

2.2 Données personnelles traitées par CareCall en tant que sous-traitant des Professionnels ➚ Données personnelles des Patients collectées dans le cadre des Services

• Données personnelles des Professionnels utilisateurs collectées dans le cadre des Services

3. POURQUOI CARECALL UTILISE VOS DONNÉES PERSONNELLES ?

CareCall traite vos données personnelles uniquement pour les raisons suivantes :

3.1 Finalités de traitement des données personnelles par CareCall en tant que responsable de traitement

3.2 Finalités de traitement des données personnelles par CareCall en tant que sous-traitant des Professionnels

Les données personnelles des Patients ne sont traitées par CareCall que pour le compte des Professionnels et CareCall n'utilise pas ces données pour des finalités qui lui seraient propres.

4. QUI PEUT AVOIR ACCÈS À VOS DONNÉES PERSONNELLES ?

Dans le cadre de l'accès, la consultation, la navigation et l'utilisation du Site et des Services, vos données personnelles peuvent être communiquées aux destinataires suivants :

5. VOS DONNÉES PERSONNELLES SONT-ELLES TRANSFÉRÉES EN DEHORS DE L'UNION EUROPEENNE/L'ESPACE ECONOMIQUE EUROPÉEN ?

Vos données sont stockées et traitées au sein de l'Union européenne (UE).

Dans le cas des rappels de rendez-vous, le numéro de téléphone portable du patient peut être transféré temporairement hors Union européenne pendant soixante (60) minutes, en cas d'envois de confirmation ou de rappels de rendez-vous par WhatsApp.

Nous garantissons qu'aucune donnée à caractère personnel de santé n'est stockée définitivement en dehors de l'Union européenne.

6. COMMENT CARECALL PROTÈGE VOS DONNÉES PERSONNELLES ?

CareCall has implemented technical and organizational measures to protect your personal data, particularly against potential breaches that could lead, accidentally or unlawfully, to the destruction, loss, alteration, unauthorized access to, or disclosure of your personal data. These measures ensure an appropriate level of data security and take into account the state of the art, implementation costs in relation to the risks, and the nature of the data to be protected.

CareCall also guarantees that its staff members and all other persons involved in processing your personal data comply with the internal measures and procedures implemented to protect your personal data. In this context, CareCall's practices are regularly reviewed and updated to ensure the confidentiality of personal data. In particular, data processed within the framework of the Service is hosted in France on Microsoft Azure infrastructure, certified as a health data host (HDS), in accordance with Article L. 1111-8 of the Public Health Code.

If you find a vulnerability or wish to report a security incident, we invite you to send a message to contact@carecall.ai.

7. HOW LONG IS YOUR PERSONAL DATA RETAINED?

Generally, your personal data will only be retained for the period necessary to achieve the purposes for which it was collected or to comply with legal or regulatory requirements. With the following exceptions:

• data processed on behalf of Professionals is retained for the periods stipulated in the contract concluded with these Professionals ;
• connection and browsing data are retained for thirteen (13) months.

Beyond these periods, data processed by CareCall as data controller is retained for:

8. WHAT ARE YOUR RIGHTS REGARDING YOUR PERSONAL DATA?

In accordance with personal data protection regulations, you have the following rights regarding your personal data, except in cases of limitation:

• a right of access to your personal data allowing you to obtain clear, transparent and understandable information on how CareCall uses your personal data and on your rights (as provided in this Policy), as well as a copy of your personal data.
• a right to rectification of your personal data allowing you to obtain the modification of your personal data if they are outdated, inaccurate or incomplete.
• a right to object to the processing of your personal data when it is based on CareCall's legitimate interest. Thus, CareCall will cease processing, unless there are legitimate and compelling grounds that override your interests, rights and freedoms, such as compliance with a legal obligation or the establishment, exercise or defense of a legal claim.
• a right to temporary restriction of the processing of your personal data, particularly with a view to carry out verifications, namely:

➚ when you contest the accuracy of your information, for a period enabling us to verify their accuracy;

➚ if the processing is unlawful and, instead of requesting their erasure, you prefer to restrict their use;

➚ if CareCall no longer needs the data for processing but they remain necessary for you to establish, exercise or defend a legal claim;

➚ if you object to the processing in application of your right to object, during the verification period intended to confirm that CareCall's legitimate grounds override yours.

• a right to withdraw your consent at any time for the purposes for which we collected your consent.
• a right to data portability of your personal data allowing you to receive the personal data you have provided to us, in a structured, commonly used electronic format, and that they are transmitted to a third party if technically feasible. This right is not exercised in all circumstances, it only applies provided thatit meets all the following conditions :

➚ it relates solely to your personal data, excluding all anonymous data or data of third parties;

➚ it does not adversely affect the rights and freedoms of CareCall (in particular business secrecy) or third parties (in particular intellectual property rights);

➚ it does not adversely affect the rights and freedoms of third parties, particularly those of CareCall (in particular business secrecy or intellectual property rights);

➚ it concerns personal data processed by automated means (paper files are therefore not concerned);

➚ the processing is based on your consent or the performance of a contract concluded with CareCall (to verify this, please refer to section 3 of this policy).

• a right to erasure of your personal data (or right to be forgotten) when one of the following reasons applies:

➚ you object to the processing of your personal data and there is no compelling legitimate reason justifying the continuation of this processing (such as CareCall's obligation to retain certain documents containing personal data);

➚ you object to commercial prospecting operations;

➚ you decide to withdraw your consent on which the processing is based;

➚ when your personal data is no longer necessary for the initial purposes for which it was collected or for another type of processing;

➚ the use of your data does not comply with applicable legal or regulatory provisions.

• a right to define directives, either general or specific, regarding your personal data in the event of your death (for example, their deletion or transmission to any person of your choice). You can revoke your directives at any time.

In certain circumstances, CareCall may ask you to request specific information, to confirm your identity and ensure the exercise of your rights. This is a security measure to ensure that personal data is not disclosed to a person who is not entitled to receive it.

For any questions and to exercise your rights, you can directly send a message to the following address: dpo@carecall.ai or send a letter to the following postal address: 81 Boulevard Saint Michel 75005 Paris

If necessary, you can lodge a complaint with the French Data Protection Authority (CNIL) via its website or by mail to 3, place de Fontenoy - TSA 80715 - 75334 PARIS CEDEX 07.

9. POLICY UPDATE

This Privacy Policy is precisely dated and may be amended and updated by CareCall at any time, particularly in the event of changes to the Website or Services or applicable regulations. Therefore, we recommend that you regularly consult this Privacy Policy.