Privacy Policy and Use of Personal Data

Data controller and Data Protection Officer

The data controller is EZYGAIN SAS, whose registered office is at 47 rue Marcel Dassault, 92100 Boulogne-Billancourt, France.

EzyGain has appointed a Data Protection Officer (DPO): Jean-Baptiste Martin, who can be contacted by email at legal@ezygain.com.

What data is collected by our applications, and why?

Personal data

This data is what the therapist deems necessary for monitoring the patient, or data that the patient provides themselves via the application forms or customer portal: name, first name, gender, height, weight, medical conditions, comments. This data is necessary for tracking the patient's performance. Certain data such as weight or height are necessary for the functioning of certain exercises.

Exercise data

During an exercise, several types of data are recorded:

• Data from connected devices: for example, weight and speed data if the EMA gait rehabilitation treadmill is connected, or speed data if it is the EzySense.
• Scores, assessments, analyses

Diagnostic data

Data related to the functioning of connected devices is recorded for diagnostic purposes, preventive maintenance, and troubleshooting. For the EMA treadmill, this may include data on motor usage time, intensity, temperature of electronic boards… This data is not linked to the patient.

Navigation data

IP address, type of device and browser, operating system, connection dates… This data is collected for security purposes. It may be used to identify any fraudulent access to the account.

Where is the data stored?

Data collected via the application is stored locally on the device the application is used on (tablet, phone or computer). If this device is connected to the Internet, the data is synchronised with a server. This server is hosted by AZNetwork, a certified HDS (Health Data Host) provider, in France.

Who has access to the data?

The patient and the therapist

• Via the application or customer portal
• The user can modify or delete their data themselves

EzyGain and its hosting provider

• EzyGain does not use the patient's personal data
• Technical staff of EzyGain and of the hosting provider can access the server, solely for maintenance purposes
• EzyGain has access to certain anonymised data, with the aim of:
  • Improving algorithms for gait, balance, and movement analysis
  • Guiding future developments through, for example, usage statistics of different exercises

How long is the data retained?

Data is retained for the whole duration of the contractual relationship between EzyGain and its customer, then for 10 years after it ends. It is then deleted.

What measures are in place to ensure the security of your data?

User side (patient or therapist)

• Strong password required (at least 8 characters, including numbers and uppercase letters)
• Two-factor authentication via SMS, email, or providing data from the connected treadmill
• Communication with the server is encrypted with HTTPS

Access to the server

• EzyGain technical staff access the server only via a secure connection (VPN + SSH).
• Access to the server is logged and monitored.

Data collected by this website

When you browse this website or use its forms, EzyGain collects the data described below. For each purpose, you will find the data concerned, the legal basis for the processing (Article 6 GDPR) and the retention period.

Contact forms and job applications

Answering your requests for information, a demo or a quote, reviewing your application, whether in response to a job offer or speculative, and following up on our relationship.

Data

Name, email address, phone number, country, message and, for job applications, CV and cover letter.

Legal basis

Our legitimate interest in answering the requests sent to us and, where applicable, steps taken at your request prior to entering into a contract (Article 6(1)(f) and 6(1)(b) GDPR).

Retention period

5 years from your last contact with EzyGain.

Newsletter

Sending you our news, events and product updates. You sign up on a form provided by our service provider Brevo.

Data

Email address, name.

Legal basis

Your consent (Article 6(1)(a) GDPR). Every email contains an unsubscribe link.

Retention period

Until you unsubscribe.

Audience measurement

Understanding how the website is used in order to improve it, with Google Analytics 4.

Data

Pages viewed, interactions with the website, where the visit came from, type of device and browser, approximate location, identifiers stored in cookies.

Legal basis

Your consent, collected through the cookie banner (Article 6(1)(a) GDPR).

Retention period

Cookies: 13 months maximum. Audience measurement data: 14 months.

Video playback

The website's videos are hosted on YouTube and embedded in privacy-enhanced mode (youtube-nocookie.com).

Data

No cookie is set until you play a video. When you play one, YouTube (Google) receives, in particular, your IP address and information about your device and browser.

Legal basis

Your consent, given by starting the video (Article 6(1)(a) GDPR).

Retention period

Set by Google, under its own privacy rules.

Cookies

A cookie is a small file stored on your device when you visit a website. This website only sets audience measurement cookies after collecting your consent through the cookie banner. If you refuse them, none of these cookies is set.

Your choice (acceptance or refusal) is kept in your browser's local storage, not in a cookie, so that we do not ask you again on every visit.

You can change your mind at any time through the "Cookie settings" link in the footer, or with the button below. If you withdraw your consent, audience measurement stops. You can also delete cookies in your browser settings.

Recipients and processors

Your data is intended only for the EzyGain teams authorised to process it. It is never sold. It may be shared with the following service providers, to the extent necessary for their task:

• AZNetwork: hosting of the application data, as a certified HDS (Health Data Host) provider, in France.
• Amazon Web Services: website hosting, and sending of the emails generated by the forms through Amazon SES, in the United States.
• Brevo: newsletter management and sending, in the European Union.
• Google: audience measurement (Google Analytics).
• YouTube (Google): video playback.

Some of these providers may process data outside the European Union, in particular in the United States. These transfers are covered by the EU–US Data Privacy Framework and/or by the European Commission's standard contractual clauses.

What are your rights and how can you exercise them?

In accordance with the provisions of Regulation (EU) 2016/679, known as the General Data Protection Regulation (GDPR), you have the following rights regarding your data:

• Right of access and inquiry: You have the right to request information on what data EzyGain holds about you.
• Right to rectification and erasure: You have the right to correct your data and request its deletion.
• Right to restriction of processing: You have the right to request that the processing of your data be restricted, for example while its accuracy is being checked or while your objection is being considered.
• Right to object: You have the right to object to EzyGain using your data for legitimate reasons. The consequences of your objection depend on the purpose for which your objection is communicated to us; for certain purposes, your refusal may prevent us from providing the requested service or performance.
• Right to data portability: You have the right to request EzyGain to retrieve your personal data in an electronic format.
• Right to withdraw your consent: Where the processing is based on your consent (newsletter, cookies), you can withdraw it at any time, without affecting the lawfulness of the processing carried out before its withdrawal.

All of these rights can be exercised directly with EzyGain, by email at the following address: legal@ezygain.com, or by post at the following address:

You also have the right to lodge a complaint with the French data protection authority, the Commission nationale de l'informatique et des libertés (CNIL): www.cnil.fr.