Privacy Policy, Nutricheck

1. Introduction

Nutricheck attaches fundamental importance to the protection and security of personal data. The confidentiality of such data and respect for privacy are among its priority commitments.

Nutricheck undertakes to protect personal data in accordance with applicable law, in particular Regulation (EU) 2016/679 of 27 April 2016, known as the "General Data Protection Regulation" (GDPR), and the French Data Protection Act (Law 78-17 of 6 January 1978, as amended).

Nutricheck's aim is to go beyond mere legal obligations by establishing a privacy policy grounded in ethics, transparency and security. For this reason, since the launch of its Solution, Nutricheck continuously ensures that it meets its personal data obligations and implements reinforced measures to protect its Users' data, including their health and wellness data.

Personal health data collected through the Nutricheck platform is hosted by an HDS-certified host (Hébergeur de Données de Santé, health data host), in accordance with the requirements of the French Digital Health Agency (ANS). This certification is intended to guarantee a high level of security in the processing of personal data in the health field.

Nutricheck also ensures that its practices comply with the reference frameworks and recommendations published by the French Data Protection Authority (CNIL).

2. Definitions

In this personal data protection policy (hereinafter the "Policy"), the terms identified below with a capital letter have the following meaning, whether used in the singular or the plural:

Unless otherwise stated, the terms defined in this Policy have the same meaning as those defined in the GTU.

3. Purpose of this Policy

The purpose of this Policy is to inform Users and Guests of the manner in which Nutricheck processes, protects and secures Personal Data in connection with the use of its Solution and Services.

It sets out how Nutricheck, together with, where applicable, the Laboratories and Partners involved in the service chain, collect, process, store, use and, where relevant, share Users' Personal Data, including Health-Related Personal Data, in compliance with the Applicable Data Protection Regulations.

This Policy sets out in particular:

• the types of Personal Data collected and processed;
• the purposes for which such Data is used;
• the legal bases justifying such processing;
• the retention periods of the Data;
• the security measures implemented;
• the rights available to Users over their Data;
• the procedures for exercising those rights.

The Policy applies to any natural person using the Solution, whether a User holding a Nutricheck Account, a Guest, or a representative of a Partner or Laboratory.

It forms an integral part of the GTU applicable to the Solution. It may be amended, updated or supplemented at any time by Nutricheck, in particular to take account of developments in the regulations, case law or CNIL recommendations. In the event of a substantial amendment, Nutricheck will inform Users by any appropriate means.

We invite you to read this Policy carefully and to refer to it regularly.

4. Capacity as Controller

In connection with the provision of its Solution and the performance of its Services, Nutricheck acts, as a matter of principle, as Controller of Users' Personal Data.

Nutricheck thus determines the purposes and means of the processing relating in particular to:

• the creation and management of the Nutricheck Account;
• the delivery and analysis of results, the generation of the profile, indicators and scores, and the production of wellness and prevention recommendations;
• the integration and processing of data from the Connected Devices that the User chooses to connect;
• the sending of information, notifications or alerts as part of monitoring and prevention;
• the technical operations necessary for the functioning, security and improvement of the Solution.

Nutricheck may, in certain cases, act as Processor, on behalf of a Partner or a Laboratory that alone determines the purposes and means of a processing operation, under the conditions described in Section 6.2. In that case, Nutricheck acts solely on the documented instructions of the relevant Controller, in accordance with Article 28 of the GDPR.

Nutricheck takes all appropriate measures to ensure the protection and confidentiality of the Personal Data it processes, whether acting as Controller or as Processor. It complies with the reference frameworks adopted by the CNIL, in particular those relating to health data.

5. Necessity of collection and processing

The use of the Solution and the Services offered by Nutricheck necessarily entails the collection and processing of certain Personal Data, including, in some cases, Health-Related Personal Data.

To enable the User or the Guest to access their analysis results, generate a personalized profile, benefit from wellness recommendations or access the Services, Nutricheck or its Partners and Laboratories must process Personal Data strictly necessary for the proper functioning of the Solution.

Such Data may be:

• provided directly by the User (for example when creating the Account, completing questionnaires, or uploading documents or results);
• generated automatically in connection with the use of the Solution (for example indicators, scores, recommendations, browsing logs);
• received from a Connected Device that the User has authorized to share its data;
• transmitted by a Partner or a Laboratory with the User's authorization.

Without such collection, access to the essential features of the Solution, such as the delivery of results, analysis or recommendations, would be technically impossible or legally non-compliant.

By using the Solution, the User acknowledges that the processing of their Personal Data is necessary for the performance of the Services offered and for achieving the purposes described in this Policy. The failure to provide certain Personal Data may prevent Nutricheck from responding to a request or from providing all or part of the Services.

6. Processing of Personal Data

7. Data from connected devices and third-party applications

Nutricheck allows the User to connect, on a strictly optional basis, certain connected devices and third-party applications for tracking physical activity and wellness (for example Garmin, Google Fit, Apple Health, Fitbit, Withings, Oura or any equivalent service), in order to enrich their profile and refine the analyses and recommendations offered by the Solution. This connection is never mandatory and is not necessary to access the essential features of the Solution.

Prior authorization and User control. Access to the data of a Connected Device is activated only after the User's express authorization, by means of the secure authentication mechanism made available by the relevant provider (OAuth protocol). The User chooses the categories of data they wish to share and may, at any time, revoke this authorization, without affecting the lawfulness of the processing carried out before the withdrawal.

Categories of data concerned. Subject to the authorizations granted and the categories actually shared by the User, Nutricheck may receive from the Connected Device data such as physical activities and workout sessions, heart rate and heart rate variability, sleep, stress level, energy and recovery indicators, maximal oxygen uptake, respiration rate, oxygen saturation, energy expenditure, daily activity summaries, as well as location data and the GPS tracks associated with activities where the User chooses to share them. Nutricheck collects only the data necessary for the purpose for which the User has activated the connection.

Purposes. The data from Connected Devices is used exclusively to provide the User with a consolidated view of their data, to contextualize and put their results into perspective, to personalize the content, monitoring indicators and wellness and prevention recommendations offered by the Solution, and to enable longitudinal monitoring over time. The location data and GPS tracks may also be correlated with environmental data from third-party sources, in particular air quality indices (fine particulate matter PM10 and PM2.5, ozone), in order to offer the User prevention and wellness recommendations that take into account their environmental exposure. Location data is used for this sole purpose and is not subject to any other tracking of the User's movements. The User may enable or disable the sharing of their location independently of the other categories of data. This data is not used for any diagnostic purpose.

Legal basis. The processing of data from Connected Devices relies on the User's express consent (Article 6(1)(a) of the GDPR and, with respect to data relating to health or physical wellness, Article 9(2)(a) of the GDPR). The User may withdraw their consent at any time.

Controller. Nutricheck acts as Controller of the data from Connected Devices that it receives and processes in order to provide the Solution to the User. The provider of the Connected Device remains independently responsible for the processing it carries out in connection with its own services. The User's use of those services is governed by the privacy policy of the relevant provider.

No sale and no advertising. Nutricheck does not sell or rent the data from Connected Devices, does not use it for any advertising purpose, and does not transfer it to any third party for that third party's own purposes. This data is processed solely to provide the Solution to the User, in accordance with the purposes described above.

Security and hosting. The data from Connected Devices benefits from the same security measures as all Personal Data processed by Nutricheck and is hosted, where it constitutes health data, by an HDS-certified host located in the European Union.

Retention period. The data from Connected Devices is retained for as long as the connection remains active and the User's Account exists. It is deleted, or irreversibly anonymized, upon disconnection of the relevant source or deletion of the Account, subject to applicable legal retention periods.

Disconnection and deletion. The User may at any time disconnect a data source from their Nutricheck Account and from their account with the relevant provider. Disconnection stops any further receipt of data. The User may also request the deletion of the data already collected under the conditions set out in Section 12.

International transfers. Where a provider of a Connected Device is established outside the European Economic Area, in particular in the United States, the receipt of data by Nutricheck may involve a transfer outside the European Economic Area. Such a transfer takes place only where it benefits from an appropriate level of protection, in the following order of priority: (i) an adequacy decision of the European Commission, in particular the EU-US Data Privacy Framework where the provider is validly certified thereunder; (ii) failing that, the European Commission's Standard Contractual Clauses or any other instrument recognized by the Applicable Data Protection Regulations; (iii) as a residual basis, a derogation provided for in Article 49 of the GDPR. The data received is stored within the European Union.

Compliance with providers' terms. Nutricheck's use of data from Connected Devices is carried out in accordance with the applicable terms and requirements of each provider, in particular, with respect to Garmin, the Garmin Connect Developer Program Agreement.

8. Retention periods

Nutricheck retains Personal Data only for the period strictly necessary to achieve the purposes for which it was collected, in accordance with the principles of the GDPR and in compliance with applicable legal, regulatory or contractual obligations.

The Personal Data processed is retained in active use for the entire duration of use of the Solution and the Services, and thereafter, as the case may be, either permanently deleted, or irreversibly anonymized for research or statistical purposes, or archived in an intermediate archive under reinforced security conditions where retention is required by law or for the establishment, exercise or defense of a legal claim.

Data retained in active use:

Data retained in an intermediate archive (secure archiving):

At the end of these periods, the Personal Data is permanently deleted or anonymized, unless a legal obligation to retain it for longer applies, a competent authority so requests, or retention is necessary for the defense of a legal claim.

9. Processors and recipients of Personal Data

Each User remains in control of their Personal Data. Nutricheck does not freely dispose of it and makes no use of it that is not provided for in this Policy.

In accordance with Article 28 of the GDPR, Nutricheck may use Processors, that is, technical or specialized service providers acting on its behalf under a strict contractual relationship. These Processors act only on Nutricheck's instructions and are subject to contractual obligations of security, confidentiality and compliance equivalent to those of Nutricheck.

10. Users' commitments to protect Personal Data

The Personal Data to which the User has access through the Solution, in particular Health-Related Personal Data, is covered by respect for privacy and confidentiality. Accordingly, the User undertakes to act in a responsible and ethical manner and in compliance with the legislation in force on the protection of personal data.

Each User undertakes to:

• respect the integrity and confidentiality of the Personal Data to which they have access through the Solution, whether it concerns them or a third party who has authorized access to their data;
• not record, copy, extract, misappropriate, transfer or disclose all or part of the Personal Data obtained through the Solution, except with the prior, express and written authorization of the data owner or the competent authority, and only to the extent strictly necessary for the performance of the Services;
• inform Nutricheck immediately in the event of unauthorized access, fraudulent use or suspected security incident relating to the Personal Data.

Where a Partner or a Laboratory acts as Controller, it is responsible for complying with the formalities and obligations provided for by the Applicable Data Protection Regulations, informing the data subjects of the processing of their Personal Data, ensuring the effective exercise of their rights, and notifying, where applicable, any Personal Data breach to the CNIL and to the data subjects under the conditions provided for by law. Nutricheck accepts no liability in the event of non-compliance, by a Partner or a Laboratory, with its own obligations as Controller.

11. Security of Personal Data

Nutricheck implements and continuously maintains a set of appropriate technical and organizational measures to guarantee a level of security appropriate to the risk inherent in its Personal Data processing activities, and in particular in respect of Health-Related Personal Data. These measures are intended to ensure the confidentiality, integrity, availability and resilience of the systems and data, and to prevent any unauthorized, accidental or unlawful access, use or disclosure.

12. Users' rights

In accordance with the Applicable Data Protection Regulations, and in particular Regulation (EU) 2016/679 of 27 April 2016 (GDPR), each User or Guest has a set of rights over the Personal Data concerning them. These rights may be exercised at any time, under the conditions described below.

13. Capacity and minors

The Nutricheck Solution and the associated Services are, as a matter of principle, intended for persons aged 18 years or over who are capable of entering into obligations in accordance with the legislation applicable in their country of residence.

Minors, or protected adults under a regime of guardianship, curatorship or judicial protection, must obtain the prior and express consent of their legal representative before creating an Account or transmitting Personal Data through the Solution.

Should Nutricheck find that an Account has been opened or used in breach of this rule, the necessary measures may be taken, including the suspension or deletion of the Account, after verification.

Where a minor is concerned by a test, an assessment or a recommendation carried out by the Solution, their data is collected, processed and made accessible only under the responsibility of their legal representative. Unless a legal obligation provides otherwise, Nutricheck may, in the context of a request made by a legal representative, inform the latter of the categories of Personal Data processed and enable them to exercise the rights provided for in Section 12 over that data.

14. Conditions of application of the Policy

This Policy applies from its date of publication and is binding on any User, Guest or any other person accessing or using the Solution or the Services offered by Nutricheck.

Nutricheck reserves the right to amend, supplement or update this Policy at any time, in particular to take account of any legislative, regulatory, case-law, technical or organizational development. In the event of a substantial amendment significantly affecting Users' rights, Nutricheck undertakes to inform Users by any appropriate means (email, notification within the Solution, alert banner) and to enable them, where applicable, to express their refusal or to withdraw their consent, where such consent is required.

The User acknowledges and accepts that only the version in force on the day of their access to the Solution or their use of the Services is authoritative. It is the User's responsibility to consult the Policy regularly, available online from the dedicated page of the https://nutricheck.eu website or from the interface of their Account. In the event of disagreement with an updated version of the Policy, the User may at any time request the deletion of their Account and the erasure of their Personal Data, under the conditions set out in Section 12.

15. Cookie management

When browsing the Solution or using the Services, cookies and other trackers may be placed or read on the terminal of the User or the Guest (computer, smartphone, tablet), subject to their consent, where such consent is required.

A cookie is a text file that may be stored in a dedicated area of the User's terminal when accessing an online service. It enables its issuer to identify the terminal in which it is stored, for the duration of the cookie's validity.

16. Other provisions

17. Contact

For any question relating to this Policy, to the exercise of your rights, to the reporting of a breach or to any difficulty relating to the processing of your Personal Data, you may contact Nutricheck by email at dpo@nutricheck.eu, or by post at: Nutricheck SAS, Data Protection Officer, 87 rue de la Salicorne, 34470 Pérols, France.

You also have the right to lodge a complaint with the competent supervisory authority: Commission nationale de l'informatique et des libertés (CNIL), 3 Place de Fontenoy, TSA 80715, 75334 Paris Cedex 07, France, www.cnil.fr.