Information Notice pursuant to art. 13 Regulation (EU) 2016/679 on 27th April 2016

GENERAL PRINCIPLES OF DATA PROCESSING

Your Personal Data will be processed lawfully, fairly and in a transparent manner; will be collected for specified, explicit and legitimate purposes and processed in a manner that is not incompatible with such purposes; they will be adequate, relevant and limited to what is necessary in relation to the purposes for which they are processed, accurate and up-to-date; they will be processed with the utmost confidentiality, mainly with electronic and automated means, and stored both electronically and on paper, and on any other type of suitable means, in accordance with the principles of the General Data Protection Regulation, the requirements given by the supervisory authority and, in any case, in such a way as to ensure adequate level of security, including protection, with adequate technical and organizational measures, from non-authorized or unlawful processing, or even accidental loss. Data will be stored in a manner that permits the identification of the data subjects for the extent strictly necessary to the achievement of the purposes for which they were processed.

Data processing will be performed through collection, recording, organization, storage, consultation, processing, modification, selection, extraction, comparison, use, interconnection, blocking, communication, cancellation and destruction and will be carried out by the data controller, data processor and persons authorized to process data.

IDENTITY AND CONTACT DETAILS OF THE DATA CONTROLLERS

Data Controller is Alira Health SAS, 12 rue Charlot, 75003 Paris, France and its Affiliates (“Alira Health”).

For the purposes of exercising the rights provided for in the GDPR, and for any request relating to your personal data, you may contact the Data Controller by sending a communication to the e-mail address: [email protected]

Alira Health and its affiliates have put in place a co-controlling agreement for the purpose of marketing treatment, available at: www.alirahealth.com

PURPOSES AND LEGAL BASIS OF DATA PROCESSING

Your personal data will be processed by Alira Health for the purposes of managing the event organised by the company.

The data processing is lawful pursuant to Art. 6, letter a) when required, and letter b) of the European Regulation 679/2016.

Alira Health will take photos during the event and may ask to take photos of you.

If you consent, Alira Health may use, publish and distribute your photos as follows, in any countries of the world, to promote communication and dissemination of the services and image of Alira Health through publication on its website, on social channels (LinkedIn, Twitter), in company presentations and on the company’s advertising material (brochures, advertisements).

RECIPIENTS OR CATEGORIES OF RECIPIENTS OF PERSONAL DATA

Personal data acquired by the undersigned company may be communicated within the company and be known by the persons tasked with data processing in compliance with the applicable data protection law.

The audience may include without limitations employees and business partners of Alira Health, as well as Healthcare professionals.

TRANSFER OF PERSONAL DATA TO THIRD COUNTRIES

Your Images may be transferred to or accessible from countries which are not regarded by the competent data protection authorities as providing adequate protection for personal data. In this case Alira Health will implement the appropriate measures in order to guarantee the compliance to the applicable data protection law

PERIOD OF STORAGE OF PERSONAL DATA

Personal data provided will be processed by the undersigned company for the purposes previously specified; they will be stored for the time necessary to achieve the aforementioned purposes, but in any case, not longer than 2 years, and in any case until the data subject withdraws consent to the processing of the data.

RIGHTS GRANTED TO THE DATA SUBJECT

Data Subjects are entitled to obtain access to personal data from the Data Controller, for free and without any limitation to third parties’ rights and freedoms. Particularly, they have the right to receive confirmation of whether or not their own personal data are being processed, and to receive the following information: a) the origin of the personal data, in case they were not collected from the data subject; b) the categories of personal data; c) the purpose and modality of treatment; d) the existence of an automated process, profiling included, and in that case the logic applied, the importance and any expected consequence of such processing for the data subject; e) updating or rectification; f) the deletion or limitation of the processing of their data (anonymization, blocking of unlawful data processing, including those whose storage is not required in relation to the purposes for which they were collected or then processed); g) the recipients or the categories of recipients to whom personal data have been or will be communicated, especially if they belong to international organizations or third countries (in the latter case, the data subject has the right to be informed of the existence of adequate guarantees pursuant to article 46 relating to data transfer); h) when possible, the expected period of storage of personal data or, in case it is not possible, the criteria used in order to determine such period.

Data Subjects have the right to withdraw their consent to data processing and to oppose data processing. Anyhow, the withdrawal of consent to data processing shall not affect the lawfulness of data processing based on the consent given before its withdrawal.

Data subjects also have the right to data portability.

RIGHT TO LODGE A COMPLAINT

Data subjects have the right to lodge a complaint to the Supervisory Authority.

MANDATORY OR OPTIONAL NATURE OF DATA COMMUNICATION

The communication of your personal data is optional. The refusal to communicate them may prevent the company from pursuing some of the purposes specified in this information notice.

EXISTENCE OF AN AUTOMATED DECISION-MAKING PROCESS

The undersigned company does not use any automated decision-making process.