En Eternity Healthcare Assistant App Privacy Policy
Version effective as of March 30, 2026
Deep IoTech, a simplified joint-stock company registered with the Trade and Companies Register of Grasse under number 983 689 274, whose registered office is located at ALPHA SOPHIA ANTIPOLIS, Rue Pierre Laffitte, 06410 Biot, France (“ Deep IoTech ”, or « we », « our », « us ”), is committed to paying particular attention to the protection of your personal data.
This privacy policy (“ Privacy Policy ”) applies to all users of the Eternity Healthcare Assistant application (the “ Application ”), including third parties referred to in Article 9.3 of the General Terms of Use (GTU) (“ you »).
The purpose of this Privacy Policy is to inform you about how we collect, store, and use your personal data. The Privacy Policy may be modified, supplemented, or updated at any time, in particular to reflect any legal, technical, or commercial developments. You will be informed in due time of any such changes.
The Privacy Policy must be read in conjunction with the General Terms of Use (GTU) available here: [ Link ] and the General Terms of Sale (GTS), available here: [ Link ].
1. Who is responsible for processing your personal data?
Deep IoTech acts as the data controller of your personal data. This means that we determine “why” and “how” your personal data is used when you use the Application.
As the data controller, we undertake to use and protect your personal data in accordance with applicable regulations, in particular Regulation (EU) No. 2016/679 of April 27, 2016, known as the “General Data Protection Regulation” or “GDPR”, and Law No. 78-17 of January 6, 1978 as amended, known as the “French Data Protection Act” (together, the “ Applicable Data Protection Law »).
2. What personal data do we collect, for what purposes, on what legal basis, and for how long?
Within the meaning of the Applicable Data Protection Law:
- - “Personal data” means any information that may directly identify you (such as your first and last name) or indirectly (such as your email address or your account’s unique identifier);
- - “Health data” means personal data likely to reveal information about your physical or mental health, past, present, or future;
- - “Processing” means any operation or set of operations performed on your personal data, regardless of the method used (collection, recording, organization, storage, adaptation, modification, retrieval, consultation, use, disclosure by transmission or dissemination, or any other form of making available, alignment).
By default, and except for the cases mentioned in the table below, all personal data that you generate through the Application (measurements, reports, history, reminders, profiles, etc.) are stored and processed exclusively locally on your device. This means that such personal data do not leave your device and are not transmitted to any external server, including ours.
Please note that in these circumstances, unless you choose to enable the cloud synchronization option for your data, in the event of loss, theft, or reset of your device, such data will be permanently lost and we will not be able to restore them. In cases where we process your personal data, we ensure that only relevant, adequate, non-excessive data strictly necessary for the purposes pursued are collected and processed.
Below you will find a table specifying:
- - Why we collect and use your personal data (processing purposes);
- - The legal basis justifying the processing of your personal data;
- - The categories of personal data processed;
- - How long we retain your personal data (retention periods).
| Purpose | Legal basis | Categories of data processed | Retention period |
|---|---|---|---|
Management of operating licenses : enabling us to carry out the allocation, activation, administration, monitoring and, where applicable, the renewal or deactivation of operating licenses | Performance of the contract concluded between you and Deep IoTech (Terms & Conditions). | Identification data : email address Technical identification data : temporary and unique device identifier; unique account identifier Contract-related data : license key; activation key associated with the granted license; license validity period; date and time of license activation; date and time of license expiration Logs : date and time of the last connection; IP address | For the entire duration of the contractual relationship + the applicable statutory limitation period |
User account management : enabling you to create an account and authenticate yourself in order to use the Application. | Performance of the contract concluded between you and Deep IoTech (Terms & Conditions). | Identification data : email address Technical identification/authentication data : temporary and unique device identifier Usage/habit data : possession of a Google or Apple account Logs : application version; device and OS type; date and time of the last connection; IP address | Email address: for the entire duration of the contractual relationship + the applicable statutory limitation period User activity logs: retained for a period of 7 days. |
Operation of the Application’s artificial intelligence system : enabling you to use the artificial intelligence system integrated into the Application, in particular to analyze the photograph of the screen of a non-connected medical device, extract relevant information and generate the expected results. The photographs transmitted to us are automatically pseudonymized In practice, this means that the photographs we receive do not allow us to directly identify the person who sent them: the photograph is processed without being associated with elements such as your email address or your first and last name. | Your consent + Performance of the contract concluded between you and Deep IoTech (Terms & Conditions) | Health Data : photograph of the medical device; physiological measurements shown in the photograph. | For the time necessary to generate the result by the artificial intelligence system. Once the result is generated, the data is either deleted or anonymized. |
Training of the artificial intelligence model : enabling us to train, test, evaluate and improve the performance of our artificial intelligence model. The photographs used to train the Application’s artificial intelligence model are previously anonymized so that no personal data relating to you can be included. | Your consent + Our legitimate interest and more specifically, our economic and commercial interest in improving the performance of our Application | Health Data : photograph of the medical device; physiological measurements. | For the time necessary for training the model. |
Cloud storage (HDS-certified) of your data (optional) | Your consent + Performance of the contract concluded between you and Deep IoTech (Terms & Conditions) | Technical identification data : temporary and unique device identifier; unique account identifier; unique profile identifier. Health Data : history of health data measurements; type and number of measurements performed; responses to questionnaires; generated reports. Usage data : date and time of measurement; description associated with the profile; scheduled reminders; number of profiles; description (free text field) associated with the measurement. Logs : date and time of the last synchronization; IP address; device and operating system type. | For the duration of use of the hosting service + 30 days in active database from the request for account deletion or data deletion request or license expiration, then a maximum of 15 days in technical backups before permanent deletion. |
Technical support | Performance of the contract concluded between you and Deep IoTech (Terms & Conditions). | Identification data : email address; first and last name Logs : IP address Other : content of exchanged messages | For the entire duration of the contractual relationship + the applicable statutory limitation period |
Production of technical and statistical reports | Your consent | Logs : region, device, OS, session duration, date Usage data : visited interfaces; user behavior | - User activity logs: retained for a period of 7 days. - Analytics data: retained for a period of 13 months. - Crashlytics data: retained for a period of 90 days. |
Management and monitoring of the commercial relationship; improvement of the commercial service and customer satisfaction | Our legitimate interest and more specifically, our economic and commercial interest in improving our customer service and the performance of our Application | Identification data : email address | 3 years from the end of the contractual relationship |
Newsletters and sending of commercial and marketing information | Your consent | Email address | Until withdrawal of your consent and, in any event, for a maximum period of 3 years from the last active contact. |
Litigation management : establishing the evidence necessary for the defense of our rights and the management of pre-litigation and litigation procedures Responding to requests from competent authorities | Legitimate interest of Deep IoTech in defending its rights Legal obligation | All relevant personal data depending on the event identified | Duration of the administrative or judicial procedure |
Management of your requests to exercise your rights regarding your personal data | Legal obligation | All your personal data | 3 years from the request + duration of litigation/dispute. |
3. To whom do we disclose your personal data and why?
- Our authorized internal staff
Your personal data are collected and processed by our internal teams for the purposes mentioned in Article 2 of the Privacy Policy.
Only individuals who can justify, by virtue of their position, a need to access the data are authorized to process them.
We also inform you that when you choose to enable cloud synchronization, your health data resulting from your use of the Application (measurement history, type and number of measurements, questionnaire responses, generated reports) are synchronized to a dedicated secure hosting infrastructure certified for Health Data Hosting (HDS). The synchronized data are hosted in a secure and isolated environment, so that no one, including Deep IoTech and its service providers, can access the content of your data.
- Our IT service providers
Some of your personal data may be processed by our IT service providers to ensure the operation, hosting, maintenance, and technical support services of the Application.
The hosting provider for your personal data on the HDS Cloud is OVH (registered with the Trade and Companies Register under number 424 761 419 and located at 2 rue Kellermann, 59100 Roubaix). Your data are stored in its data centers located in France. For more information on how personal data are processed by the hosting provider, we invite you to read OVH’s privacy policy available at the following address: https://www.ovhcloud.com/fr/personal-data-protection/security/.
- Other third parties
We may be required to disclose certain of your personal data to third parties, such as public authorities or our legal or professional advisors, where required by law or where we believe such disclosure is necessary to comply with an administrative or judicial procedure, respond to a claim, or protect the rights, interests, or security of Deep IoTech and/or its clients. In such cases, the disclosure is carried out in compliance with your rights, confidentially, and strictly limited to the data necessary to meet the request or the intended purpose.
4. How is your data secured?
We implement and maintain appropriate technical and organizational security measures for the Application, taking into account the nature of the personal data we process and the risks associated with such processing. These measures aim to (i) protect personal data against destruction, loss, alteration, or unauthorized disclosure, and (ii) ensure the restoration of availability and access to personal data within appropriate timeframes in the event of a physical or technical incident.
We also regularly test, analyze, and evaluate these measures to ensure that they remain effective and appropriate to the risks.
5. Are your data transferred outside the European Union?
Some of Deep IoTech’s service providers belong to groups of companies located outside the European Economic Area. As a result, some of your personal data, excluding your health data resulting from your use of the Application (which are, depending on the case, stored exclusively locally on your device or on the servers of our provider OVH located in France), may be transferred to countries outside the European Economic Area (EEA). Such transfers only take place where authorized and are carried out in accordance with the Applicable Data Protection Law.
The categories of service providers concerned include, in particular, Application maintenance providers and analytics and audience measurement service providers, to whom certain technical or usage data (e.g., information about your device and your interactions with the Application) are transmitted, as well as identity service providers, to whom the information necessary for creating or recognizing your account is transmitted when you choose to register or log in via a third-party service.
In other words, we implement the necessary measures to ensure the security of personal data during their transfer and upon receipt. We ensure in particular that data are transferred only to countries recognized by the European Commission as providing an adequate level of protection or, failing that, to recipients offering appropriate safeguards in accordance with applicable regulations, such as standard contractual clauses adopted by the European Commission.
6. What are your rights regarding your personal data?
You have the following rights regarding your personal data:
- - Withdrawal of consent : withdraw your consent to the future processing of your personal data by Deep IoTech where the processing is based on consent;
- - Right of access : obtain a copy of the personal data we hold about you;
- - Right to rectification : obtain the correction of your personal data when they are inaccurate, outdated, or incomplete;
- - Right to erasure : obtain the deletion of your personal data when they are no longer necessary for the purposes for which they were collected or if you have withdrawn your consent where processing is based solely on such consent;
- - Right to restriction of processing : obtain restriction of processing of your personal data in specific cases, for example, if you contest the accuracy of your personal data processed by Deep IoTech;
- - Right to data portability : obtain your personal data in a readable format or request that Deep IoTech transmit them to another data controller;
- - Right to object : object at any time to the processing of your personal data where such processing is based on Deep IoTech’s legitimate interest, unless we can demonstrate compelling legitimate grounds for the processing; If you are a French citizen, you may also provide general or specific instructions regarding the fate of your personal data after your death.
To exercise these rights, you may contact us by email at the following address: rgpd@deepiotech.io.
Or by postal mail at the following address: ALPHA SOPHIA ANTIPOLIS, Rue Pierre Laffitte, 06410 Biot, France
You may also lodge a complaint with the supervisory authority of the country where you are located if you have concerns about how we process your personal data. In France, you may contact the French Data Protection Authority (CNIL) via its website: https://www.cnil.fr/fr
However, we recommend that you contact us first in order to attempt to resolve your request before submitting such a complaint.