PRIVACY POLICY

Table of Contents

1. PREAMBLE

2. DEFINITIONS

3. PERSONS CONCERNED

4. PURPOSES AND LEGAL BASIS FOR THE COLLECTION AND PROCESSING OF DATA

5. DATA RECIPIENTS

6. DATA RETENTION PERIOD

7. CONFIDENTIALITY AND SECURITY OF DATA

8. THIRD PARTY WEBSITES

9. RIGHTS OF INDIVIDUALS

10. EXERCISE OF RIGHTS

11. INTERNATIONAL DATA TRANSFERS

12. AMENDMENTS AND MODIFICATIONS TO THIS POLICY

13. CONTACT INFORMATION

1. PREAMBLE

This privacy policy concerns the relation between MYBRAIN TECHNOLOGIES, a simplified joint-stock company, registered in the Nanterre Trade and Companies Register and whose registered office is located at 28 allée Hoche, 92130 Issy-Les-Moulineaux, France (hereinafter called « myBrain Technologies »), and any person benefiting from or wishing to benefit from the services offered by myBrain Technologies as part of the Q+Acquisier/Q+ Médical products and services and the myBrain Tech Platform.

myBrain Technologies offers the Q+Acquisier/Q+ Medical products and services and the myBrain Technologies Platform (hereinafter  called « the Services« ), which are based on the EEG analysis process to create virtual representations of human behavior in real-life conditions.  The Services are described and accessible at the URL https://mybraintech.com (hereinafter called « the Website« ) and on its mobile application Acquisier Android and IOS (hereinafter called « the Application« ).

The Website is published by myBrain Technologies.

myBrain Technologies has duly appointed a DPO who can be contacted as detailed below:

DPO Service

50 avenue Claude Vellefaux,

75010 Paris

legal@mybraintech.com 

2. DEFINITIONS

For the purposes of interpreting and executing this Policy, the terms used below are defined as follows:

« Customer »: refers to the person benefiting or wishing to benefit from the services offered by myBrain Technologies, the term Customer including the potential Customer; 

« Personal data » or « Data »: refers to any information that directly or indirectly identifies a natural person, such as name, first name, e-mail, postal address, telephone, etc; 

« Health data »: refers to personal data concerning the physical or mental health, past, present or future, of a natural person that reveals information about the state of health of this person. This category of data includes: those which are health data by nature (e.g. medical history, illnesses, care provided, results of examinations, treatments, handicap); those which, because of their cross-referencing with other data, become health data in that they make it possible to draw a conclusion about a person’s state of health or risk to health (e.g. ability to engage in a sporting activity); and finally those that become health data because of their destination (i.e. the use that is made of them at the medical level).

This definition includes, for example, data relating to the physiological or biomedical state of a person;

« Data Protection Officer » or « DPO »: refers to the person in charge of advising and controlling the Data Controller in terms of personal data protection. In this case, the DPO of myBrain Technologies can be reached at legal@mybraintech.com;

« Experimenter »: refers to a person designated by the Customer in charge of collecting and processing certain Data in the context of the Services;

« Project »: refers to a set of benefits and Processing ordered by the Customer from myBrain Technologies as part of the Services to which it has subscribed;

« Data Controller »: refers to the person, department or organization that determines the purposes and means of the processing of Personal Data; 

« Services »: refers to all the services, products and benefits accessible via the Website and/or the Application;

« Website »: refers to the site accessible at the following URL address https://mybraintech.com;

« Subcontractors »: refers to the natural or legal person who processes Personal Data on behalf of the Data Controller, on its instructions and under its authority;

« Subjects »: refers to the persons who volunteer to participate in a Project ordered by the Customer;

« Processing »: refers to any operation on Personal Data, including but not limited to recording, collecting, organizing, storing, adapting or modifying, retrieving, consulting, using, communicating by transmission, dissemination or any other form of making available, reconciling or linking, as well as blocking, erasing or destroying;

« User »: refers to any person using the Services.

3. PERSONS CONCERNED

myBrain Technologies, in its capacity as Data Controller, may process the Personal Data of the following categories of individuals:

• Internet users browsing the Website;
• Users;
• Customers and staff/collaborators of the Customer;
• Subjects.

4. PURPOSES AND LEGAL BASIS FOR THE COLLECTION AND PROCESSING OF DATA

4.1. The Personal Data of Customers, Users and Experimenters are collected and processed by the Data Controller on the basis of the execution of the contract between myBrain Technologies and the Customer, the purpose of which is the ordering of Projects and the provision of Services. 

The User and Experimenter may at any time withdraw their consent and exercise their rights with respect to their Data by contacting the Customer or the DPO of myBrain in accordance with the conditions set forth in this Policy.

In this contractual framework, the Data requested from the Customers is necessary for the conclusion and execution of the contract between myBrain Technologies and the Customers, and the lack of communication of this Data may prevent the formation of the contract.

4.2. The Personal Data of the Subjects is used by myBrain Technologies for specific, explicit and legitimate purposes and is collected by the Experimenters from the Subjects with the consent of the latter (legal basis of the Subjects’ Data Processing).

The purposes of the Subjects’ Data Processing are determined by the Customer for each Project. The experimenter communicates to the Subjects these purposes and all useful information on the methods of Processing and the exercise of the Subjects’ rights to their Data.

myBrain Technologies retains and processes the Subjects’ EEG Data at the end of the contract with the Customer for the exclusive purpose of training myBrain Technologies’ algorithms/artificial intelligence and in a format that does not allow the identification of the Subjects.

The Subjects’ Data collected by the Experimenter and processed by myBrain Technologies as part of the Services is Pseudonymous Data and is not directly identifying.

Some of the Processing is carried out in the context of scientific research. These Processings are based on the consent of the individuals and on research protocols that comply with the regulations.

The Subject may withdraw his or her consent and exercise his or her rights to his or her Data at any time by contacting the Customer/Experimenter, in the case of data held and processed by the Customer.

In the case of data processed by myBrain Technologies, the latter does not hold any identifying Data relating to the Subjects and therefore cannot respond to their requests to exercise their rights. It is therefore not obliged to process additional data for the sole purpose of responding to requests to exercise the rights of the persons concerned.

Finally, myBrain Technologies processes certain Data for the purpose of complying with legal or regulatory obligations (in the area of accounting) or for the legitimate interests it pursues (as part of the improvement of its products and services and for satisfaction surveys, product evaluation, communication and commercial prospecting).

5. DATA RECIPIENTS

The Personal Data collected by myBrain Technologies may be destined for the following persons depending on the processing:

• The Customer and its authorized personnel;
• To the persons designated as Experimenters, if different from the Customer’s personnel;
• myBrain Technologies’ personnel authorized to process Data;
• Subcontractors of myBrain Technologies;
• To research partners and joint processors of myBrain Technologies, if any;
• To partners and/or research providers and joint processors of the Customer;

Some Personal Data may be disclosed to legally authorized authorities to meet legal or regulatory obligations.

6. DATA RETENTION PERIOD

myBrain Technologies only keeps Data for as long as is strictly necessary to achieve the purposes of the Processing. This retention period being based on the circumstances of the Processing and the instructions of the Customer.

With regard to Data relating to Users, Experimenters and the Customer, when processed for the purpose of managing customer files and commercial prospecting: they may be kept for commercial prospecting purposes for a period of three (3) years from the end of the commercial relationship or the last contact with the Customer.

Data relating to the Subjects may be kept for up to ten (10) years from the end of the contract with the Customer for the exclusive purpose of training algorithms and in a format that does not allow the Subjects to be identified.

Data of a commercial and accounting nature may be kept for up to ten (10) years concerning information necessary for invoicing, by virtue of a legal obligation incumbent on myBrain Technologies.

7. CONFIDENTIALITY AND SECURITY OF DATA

myBrain Technologies is committed to guaranteeing the security of the Processing of Personal Data.

To this end, myBrain Technologies takes technical and organizational measures to ensure a level of security appropriate to the risks associated with the Processing.

The Data collected and processed by myBrain Technologies are hosted (LNE approval certificate for OVH: 35608-2).

8. THIRD PARTY WEBSITES

The Website may contain links, including hyperlinks, and/or offers from partners to third-party websites.

myBrain Technologies has no control over the content of third-party websites or the practices of such third parties with respect to the protection of the Personal Information they may collect and declines any responsibility for such content. It is your responsibility to inform yourself about the privacy policies of such third parties.

9. RIGHTS OF INDIVIDUALS

Subjects’ rights to their Data must be exercised directly with the relevant Customer insofar as myBrain Technologies does not process any identifying Data about Subjects.

In accordance with Articles 11.2 and 12.2 of the General Data Protection Regulation (GDPR), the purposes for which myBrain Technologies processes Subjects’ Data do not require the identification of the persons concerned. The articles of the GDPR relating to the exercise of the rights of individuals therefore do not apply to myBrain Technologies.

Nevertheless, Subjects may send their requests to exercise their rights to myBrain Technologies: DPO Service, 50 avenue Claude Vellefaux, 75010 Paris or legal@mybraintech.com. myBrain Technologies will forward them to the Customer concerned as soon as possible.

In accordance with the regulations in force, Customers, Users and Experimenters have the following rights to their Data, which they may exercise under the conditions provided below:

• Right of access

Customers, Users and Experimenters have a right of access to obtain information on the existence of a Processing and its methods.

They also have the right to obtain a copy of their Data.

• Right of rectification

Customers, Users and Experimenters may request myBrain Technologies to rectify their Data, particularly if it is out of date.

• Right to object

Customers, Users and Experimenters have the right to object at any time, for reasons related to their particular situation, to the Processing of their Personal Data. This right applies unless myBrain Technologies or the Customer has a legitimate and compelling reason to continue the Processing.

Customers, Users and Experimenters have the right not to be subject to a decision based exclusively on automated processing, including profiling, producing legal effects concerning them or significantly affecting them in a similar way.

• Right to erase Data (or « roght to be forgotten »)

Subject to the regulations in force, and in particular the exceptions (e.g. with regard to the conservation necessary to respect a legal obligation), Customers, Users and Experimenters may request the deletion of their Personal Data:

• When Personal Data is not or is no longer necessary for the purposes for which it was collected or otherwise processed;
• When the Customer, User or Experimenter withdraws the consent on which the processing is based and no other legal basis for the processing exists;
• When the Customer, User or Experimenter believes that the processing of his/her Personal Data constitutes unlawful processing;
• When the Personal Data must be erased by virtue of a legal obligation provided for by the law of the Union or the law of the Member State to which myBrain Technologies is subject, namely France;
• Where the Customer, User or Experimenter has objected to the Processing of Data and myBrain Technologies has no legitimate or compelling reason to refuse the request.
  
  
• Right to limit Processing

Customers, Users and Experimenters may obtain from myBrain Technologies the limitation of Processing when any of the following apply:

• Where the accuracy of the Personal Data is disputed, and for a period of time that allows myBrain Technologies to verify the accuracy of the Data;
• When the Processing is unlawful and the Customer, User or Experimenter objects to the deletion of his or her Data and instead demands the limitation of the Processing;
• When the Data is no longer necessary for the purposes for which it was collected, but the Customer, User or Experimenter needs it for the establishment, exercise or defense of legal claims;
• When the Customer, User or Experimenter objects to the Processing being based on the legitimate interest of myBrain Technologies, during the verification as to whether the legitimate motives pursued by myBrain Technologies prevail over those of the data subject.
  
  
• Right to file a complaint with a supervisory authority

If Customers, Users and Experimenters feel that their rights are not being respected, they have the right to file a complaint with the Commission Nationale Informatique et Libertés (CNIL) in France.

• Right to decide what to do with the Data after Death

Customers, Users and Experimenters have the right to organize the fate of their Data after death by adopting general or particular directives.

10. EXERCISE OF RIGHTS

For requests to exercise their rights, Customers, Users and Experimenters are invited to contact directly the relevant department of the Customer or, failing that, the DPO of myBrain Technologies who will forward the requests to the Customer:

DPO Department, 50 avenue Claude Vellefaux, 75010 Paris or legal@mybraintech.com.

myBrain Technologies undertakes to forward requests as soon as possible.

11. INTERNATIONAL DATA TRANSFERS

The Personal Data collected and processed are stored in France.

However, it is possible that, in the context of some of its missions, myBrain Technologies’ Data may be transferred to Subcontractors located outside the European Union. In order to protect the privacy and Personal Data of Users and Customers, myBrain Technologies makes every effort to select partners who offer guarantees of security and confidentiality and to establish contractual relationships that meet the regulatory standards, particularly at the European level.

12. AMENDMENTS AND MODIFICATIONS TO THIS POLICY

myBrain Technologies reserves the right to change this Policy. In the event of a change to the Policy, myBrain Technologies will send an email to the Customers informing them of the change. 

In any case, it is recommended that you consult the Privacy Policy regularly.

13. CONTACT INFORMATION

myBrain Technologies can be contacted according to the contact details indicated in the Legal Notice of the Website (https://mybraintech.com/legals-notices/).

The DPO can be reached at the following postal address Service DPO, 50 avenue Claude Vellefaux, 75010 Paris and at the following e-mail address legal@mybraintech.com. 

Document updated on June 23, 2022