Update 18.11.2024

PERSONAL DATA PROTECTION POLICY

MUSIC CARE is a simplified joint-stock company (SAS) registered in the Paris Trade and Companies Register under number 505 386 425, with its head office at 7 rue Popincourt, 75011 Paris, represented by its President Mr. Stéphane Guétin (hereinafter the “Company” or "MUSIC CARE"). The term "MUSIC CARE" used hereinafter refers to the Company as well as any affiliated company, subsidiary and/or branch, French and/or foreign, as well as their successors and/or any company succeeding to their rights with respect to this document.

MUSIC CARE is the publisher of the websites www.music.care, www.sound.care, www.u-sequence.com (hereinafter the "MC Site(s)").

MUSIC CARE's activities include music publishing and production on one hand, and research, development, and commercialization of therapeutic and wellness digital solutions combining music and neuroscience on the other hand.

MUSIC CARE is the creator and publisher of an innovative digital service titled "MUSIC CARE"™, which has CE marking as a Type 1 Medical Device aimed at supporting the treatment of certain physical and/or neurological conditions such as pain, anxiety, stress, depression, sleep disorders, hyperactivity and reduce their harmful effects without or with less medication. MUSIC CARE is also the creator and publisher of other digital services dedicated to wellness and relaxation through music titled "SOUND CARE"™ and/or "U SEQUENCE"™. These services all include a catalogue of unique musical works, specially designed for and published by MUSIC CARE, according to specific technical prescriptions developed by MUSIC CARE based on more than 150 scientific studies and research. They also include patented data analysis tools to optimize service efficiency and personalize the experience (hereinafter "MC Solutions"). MC Solutions are currently sold by MUSIC CARE in the form of a web application accessible on MC Sites and/or a mobile digital device application for smartphones and/or tablets accessible from standard application download platforms (hereinafter "MC App" or "Application").

MC Solutions and all MUSIC CARE services are marketed to individuals via App Stores and/or on MC Sites, and to professionals through quotes issued by MUSIC CARE directly or via MUSIC CARE third-party partners (hereinafter "MC Partner(s)"). MUSIC CARE also offers in some cases associated and/or additional services such as listening device rental and/or training.

MUSIC CARE provides its customers an After-Sales Service available via email: contact@music-care.com or via phone at +33 (0)9 52 03 03 34 from 9am to 12:30pm and from 2pm to 5pm from Monday to Friday (hereinafter "the Customer Service").

Article A. GENERAL CONDITIONS FOR THE PROTECTION OF YOUR PERSONAL DATA

MUSIC CARE processes personal data in accordance with the applicable legal provisions and in particular the French Data Protection Act n°78-17 of January 6, 1978 in its current version and the EU Regulation 2016/679 known as "RGPD" (hereinafter together "Applicable Regulation").

Legal terms used herein with their first letter capitalized shall have the meanings set forth in the RGPD and in particular as follows:

Personal Data: any information relating to an identified or identifiable natural person; an "identifiable natural person" is one who can be identified, directly or indirectly, in particular by reference to an identifier such as a name, an identification number, location data, an online identifier, or to one or more factors specific to his/her physical, physiological, genetic, mental, economic, cultural or social identity (hereinafter “Personal Data”)

Controller: the natural or legal person, public authority, agency or other body which alone or jointly with others determines the purposes and means of the processing of personal data; where the purposes and means of such processing are determined by Union law or by the law of a Member State, the Controller or the specific criteria for its nomination may be laid down by Union or Member State law.

Processor: the natural or legal person, public authority, agency or other body that processes personal data on behalf of the Controller.

Processing: any operation or set of operations which is performed on personal data or on sets of personal data, whether or not by automatic means, such as collection, recording, organization, structuring, storage, adaptation or alteration, retrieval, consultation, use, disclosure by transmission, dissemination or otherwise making available, alignment or combination, restriction, erasure or destruction.

Health Data: personal data related to the physical or mental health of a natural person, including the provision of health care services, which reveal information about their health status.

MUSIC CARE has appointed the external company NEOSHEILD as its Personal Data Protection Officer (hereinafter "DPO"). The DPO is the person to contact for any question regarding your Personal Data and to exercise your rights. They can be reached at the following postal address: MUSIC CARE - DPO 7 rue Popincourt - 75011 Paris (France) or by email: dpo@music. care

The Personal Data for which MUSIC CARE is the Controller mainly concerns its customers, the users of its services and products, its prospect clients, partners and employees.

The Personal Data concerned are essentially identification and location data (name, telephone numbers, email, addresses.) as well as, in the case of individual subscribers only, Health Data (such as the user's pain level, ongoing treatment, etc.).

Payments made on the MC Site are processed and secured by external payment management solutions operated by third-parties in accordance with their own terms and conditions of sale and use, which are separate from those of MUSIC CARE. MUSIC CARE does not have access to, nor does it store any banking data.

Each Processing for which MUSIC CARE is responsible for pursues its own purpose as described below.

Failure to provide the required Personal Data may prevent MUSIC CARE from fulfilling the purpose(s) for each Processing.

MUSIC CARE protects Personal Data through physical and technological measures to ensure their security, confidentiality, integrity and availability, in accordance with the Applicable Regulation.

The recipients of this Personal Data are MUSIC CARE, its employees and subordinates and in some necessary instances external professional partners bond by a contract with MUSIC CARE to guaranty confidentiality and achieve the purpose of each Processing as stated herein.

Some recipients may be located outside the European Union and in the United States in particular. Transfers in this context operate in compliance with the current EU-US applicable legal framework. These recipients guarantee the same level of protection of Personal Data as MUSIC CARE.

Individuals have the right to request from MUSIC CARE access, rectification, erasure, restriction, portability of their Personal Data according to the conditions and procedures set by Applicable Regulation.

They also have the right to object, at any time and without any justification required, to the use of their Personal Data for marketing purposes.

To exercise one or more of these rights, please contact the DPO using the contacts above.

Individuals also have also the right to file a complaint with a national supervisory authority, such as the French Data Protection Authority (CNIL).

Article B. SPECIFIC CONDITIONS FOR THE PROTECTION OF YOUR PERSONAL DATA IN THE FOLLOWING CASES:

When you fill out the "Contact" page of the MC Site

The Personal Data you provide are processed by MUSIC CARE on the legal basis of Article 6 §1 f) of the GDPR for the purpose the legitimate interest of the Controller to effectively handle and answer any question/comment stated in the “message” field of this page.

These Personal Data are retained by MUSIC CARE for the duration of processing your request/message and then deleted within thirty (30) days maximum.

When you agree to receive newsletters and/or commercial offers from MUSIC CARE

When on the MC Site or App, you check either of the following boxes :

☐ I would like to receive newsletters from MUSIC CARE. My data will be used in accordance with its Data Protection Policy for three (3) years following my last contact with MUSIC CARE or until I object to this use by clicking on the corresponding link in MUSIC CARE’s communications or upon request to the DPO at the aforementioned coordinates.

AND/OR

☐ I would like to receive commercial offers from MUSIC CARE. My data will be used in accordance with their Data Protection Policy for three (3) years following my last contact with MUSIC CARE or until I object to this use by clicking on the corresponding link in MUSIC CARE’s communications or upon request to the DPO at the aforementioned coordinates.

you expressly consent to your Personal Data being processed by MUSIC CARE for commercial and marketing purposes.

The Personal Data provided is processed by MUSIC CARE on the legal basis of your consent (Article 6 §1 a) of the RGPD) in order to send you:

in the 1er case, information on MUSIC CARE’s activities;

and/or

in the 2nd case, commercial offers related to MUSIC CARE’s activities.

These Personal Data will be retained for three (3) years following your last contact with MUSIC CARE or until you object to either and/or both of these uses by clicking on the corresponding link in MUSIC CARE's communications, or by sending a simple written request to the DPO using the contacts above.

The withdrawal of your consent will not affect the lawfulness of the Processing prior to the date of such withdrawal. Nevertheless, it will prevent MUSIC CARE from satisfying the aforementioned purposes.

When you subscribe to a MUSIC CARE service and create a user Account on the MC Site

When you create a personal account on the MC Site (hereinafter "the Account"), the Personal Data you provide is processed by MUSIC CARE on the legal basis of Article 6 §1 b) of the GDPR, to fulfill its pre-contractual or contractual obligations towards you.

These Personal Data are retained by MUSIC CARE for the entire duration of activation of your Account as well as for 6 (SIX) years after its closure.

When you use MUSIC CARE’s services from a NON-PROFESSIONAL individual Account

In order to provide you with the services associated to your individual Account and, in particular, the possibility of enjoying all the benefits of the MC Solution, when you use the MC Solution on the MC Site or the MC App, MUSIC CARE asks you to indicate your levels of pain, anxiety, sleep or other variables before and after listening to its music and, depending on the type of subscription, your possible pathologies, symptoms and treatments, etc. This is Health Data that MUSIC CARE processes with the utmost care and in full compliance with the Applicable Regulation, for the sole purpose of providing you with the services associated with your Account and as a result optimize and personalize your user experience.

MUSIC CARE also uses this Health Data for scientific and medical research applied to the development of MUSIC CARE's therapeutic services in a totally anonymous manner and without any possibility of any individual identification.

This Health Data is processed by MUSIC CARE with your consent on the legal basis of Article 9§2 a) of the GDPR when you check the box :

☐ I agree that my Health Data will be processed by MUSIC CARE in accordance with its Personal Data Protection Policy for the entirety of the duration of my Account and two (2) years following its termination except if I object to this use before by clicking on the corresponding link in MUSIC CARE’s communications or by simple written request to the DPO at the aforementioned coordinates.

This Health Data is retained by MUSIC CARE for the duration of your Account and for a maximum of two (2) years following its termination.

You can withdraw your consent to this Processing of your Health Data at any time by simple written request to the DPO.

Withdrawal of your consent will not affect the lawfulness of the Processing prior to the date of such withdrawal. Nevertheless, it will prevent MUSIC CARE from satisfying the aforementioned purposes.

When you contact MUSIC CARE's Customer Service

The Personal Data you provide when you contact MUSIC CARE's Customer Service are processed by MUSIC CARE:

on the legal basis of Article 6 §1 b) of the RGPD in execution of its contractual obligations and of Article 6§1 c) of the RGPD in execution of its legal obligations, in particular with regard to French Consumer law, and this, solely to answer your requests/complaints related to your use of MUSIC CARE’s services;

and on the legal basis of Article 6 § 1 c) of the RGPD in execution of its legal obligations, in particular with regard to health regulations and potential pharmacovigilance compliance.

These Personal Data are retained by MUSIC CARE for the entire duration of your use of MUSIC CARE's services as well as for six (6) years after its termination.

When you communicate your contact information to MUSIC CARE during a conference or an in-person meeting

The Personal Data that you communicate to MUSIC CARE are processed on the legal basis of Article 6 §1 f) of the GDPR for the purpose of MUSIC CARE’s legitimate interest to provide you with the need or answer to your question in this context.

These Personal Data are retained by MUSIC CARE for the time necessary to respond to your need or answer in this context. If you do not proceed with the creation of a MUSIC CARE User Account, this Personal Data will then be deleted within thirty (30) days maximum after your need and/or question is answered.

When you do a training provided by MUSIC CARE

When you use a training program provided by MUSIC CARE online or in-person, the Personal Data you provide is processed by MUSIC CARE on the legal basis of Article 6 §1 b) of the RGPD, to fulfill its pre-contractual or contractual obligations towards you regarding MUSIC CARE’s provision of services related to this training.

These Personal Data are retained by MUSIC CARE for the entire duration of the provision of its services for this training. If you do not create a MUSIC CARE Account at the end of this training, your Personal Data will be deleted within thirty (30) days maximum after the date of the end of the training.

When you subscribe to a MUSIC CARE commercial offer reserved for PROFESSIONAL clients

At the time of purchase, MUSIC CARE may need to collect Personal Data from its professional clients, particularly relating to its employees. All such Personal Data is then processed by MUSIC CARE on the legal basis of Article 6§1(b) of the GDPR, to meet its pre-contractual or contractual obligations to the client regarding the provision of its services. This Personal Data is retained by MUSIC CARE for the entire duration of the client's contractual relationship with MUSIC CARE as well as for six (6) years after its termination.

In this framework, no transfer of Personal Data of which the client is the Controller should happen. In the eventuality such transfer should become necessary, a separate agreement compliant with Applicable Regulation will be concluded.

When you use MUSIC CARE’s services through a PROFESSIONAL Account

In the framework of MC Services for Professionals, access to MUSIC CARE services by the end user (the client’s patient and/or customer) operates in a completely generic and ANONYMOUS way that does not allow identification of any individual patient and/or service user. No Personal Data and/or Health Data of the patient and/or end user is processed by MUSIC CARE in this context.