Privacy Policy

PRIVACY POLICY

Table of contents

1. PREAMBLE
2. DEFINITIONS
3. DATA SUBJECTS
4. PURPOSES AND LEGAL BASIS OF COLLECTION AND PROCESSING OF PERSONAL DATA
5. DATA RECIPIENTS
6. DATA RETENTION PERIOD
7. DATA PRIVACY AND SECURITY
8. THIRD-PARTY WEBSITES
9. RIGHTS OF USERS AND CUSTOMERS
10. EXERCISE OF RIGHTS
11. INTERNATIONAL TRANSFERTS OF PERSONAL DATA
12. CHANGES TO THIS PRIVACY POLICY
13. CONTACT DETAILS

1. Preamble

This privacy policy concerns the relationship between the simplified joint stock company MYBRAIN TECHNOLOGIES, registered on the commercial and companies Register of Nanterre and whose head office is located at 28 allée Hoche, 92130 Issy-Les-Moulineaux (hereafter "myBrain Technologies"), and any person benefiting or wishing to benefit from the services offered by myBrain Technologies. 

myBrain Technologies offers for sale the MELOMIND Program (hereafter "the MELOMIND Program"), based on the EEG (for electroencephalogram) neurofeedback process, which consists in training the natural relaxation processes of the brain in a non-intrusive way and without side effects. The MELOMIND Program is available for sale on its website accessible at the URL https://www.melomind.com (hereafter "the Website") and on its Android and IOS mobile application (hereafter "the Application").

The Website is published by myBrain Technologies.

myBrain Technologies has duly appointed a DPO who can be contacted as detailed below:

Service DPO

50 avenue Claude Vellefaux, 75010 Paris, [e-mail]   

2. Definitions

For the purposes of interpreting and executing this Policy, the terms used herein are defined as follows: 

"Customer": means the person benefiting or wishing to benefit from the services offered by myBrain Technologies, and the term "Customer" includes a potential Customer;

"Personal data" or "Data": refers to any information enabling a natural person to be identified directly or indirectly, such as surname, first name, e-mail, postal address, telephone number, etc.;

"Health data": means Personal data concerning the past, present or future physical or mental health of a natural person which reveals information about the health status of that person. Data in this category are:  those that are health data by nature (medical history, illnesses, health care services provided, results of examinations, treatments, disability, etc.), those which, because of their cross-referencing with other data, become health data in that they make it possible to drawn a conclusion about a person's health statuts or risk to health (e.g. fitness to exercise a sporting activity), and finally those which become health data because of their purpose, i.e. the use made of them for medical purposes;

"Data Protection Officer" or "DPO": means the person in charge of advising and monitoring the Controller in matters of personal data protection. In this case, the DPO of myBrain Technologies can be reached at [e-mail];

"MELOMIND Program": means the brain relaxation training solution, which includes a cover, an electroencephalogram headset and its accessories (including a pair of electrodes and a USB cable), personal and personalised access to the Application and ancillary services such as training, customer support and all the services associated with the MELOMIND Program, and a personal licence to use the Application;

"Controller": means the person, department or body which determines the purposes and means of processing Personal data, in this case myBrain Technologies; 

"Website": means the website accessible at the following URL https://www.melomind.com;

"Processor":  means the natural or legal person which processes Personal data on behalf of the Controller, on its instructions and under its authority;

"Processing": means any operation or set of operations which is performed on Personal data or on sets of Personal data, whether or not by automated means, such as collection, recording, organisation, structuring, storage, adaptation or alteration, retrieval, consultation, use, disclosure by transmission, dissemination or otherwise making available, alignment or combination, restriction, erasure or destruction;

"User": means any person connecting to and navigating the Website.

3. Data Subjects

MyBrain Technologies, as the Controller, may process the Personal data of the following categories of individuals:

• Users of the Website ;
• Customers of the MELOMIND Program.

4. Purposes and legal basis of collection and processing of personal data

Users' and Customers’ Personal data are collected and processed by the Controller on the basis of legal grounds and to the extent strictly necessary for the purposes described below.  

Personal data collected from Users and Customers and used by myBrain Technologies are for specified, explicit and legitimate purposes. 

Processing carried out on the basis of the consent of the Customers and Users are the following:

• Management of Customers’ account and settings;
• Management of Customers’ and Users’ contact and information requests;
• Use of the MELOMIND Program by Customers;
• Analysis of Customers' brain activity data in the context of the use of the MELOMIND Program, for the purpose of evaluating the cognitive processes involved in the mechanisms of relaxation, stress management, emotions, sleep, attention and relaxation through the practice of neurofeedback;
• Measures, evaluations and research work relating to these cognitive processes;
• Data analysis for product, software, data set and algorithm improvement;
• Website administration;
• Communication and prospecting campaigns relating to the products and services offered by myBrain Technologies when there is no commercial relationship between myBrain Technologies and the Customer or User.

In accordance with the regulations in force, the Processing of Data for scientific research or statistical purposes is compatible with the initial purposes of the Processing carried out by the Controller.

As a reminder, the Data processed by myBrain Technologies are subject to pseudonymisation processes. The Data used by MyBrain Technologies therefore does not allow Customers to be identified.

The User may withdraw consent at any time by contacting myBrain Technologies or their DPO as provided in this Policy.

Processing carried out on the basis of the execution of a contract concluded between myBrain Technologies and the Customers are the following:

• Management of orders and sales of the products making up the MELOMIND Program;
• Management of the services provided by myBrain Technologies; 
• Management of Customer’s complaints and after-sales service;
• Management of the technical support and the evolutionary and corrective maintenance of the applications involved in MELOMIND.

In this contractual framework, the Data requested from the Customers are necessary for the conclusion and execution of the contract between myBrain Technologies and the Customers, and the absence of communication of these Data may prevent the formation of the contract.

Finally, myBrain Technologies processes certain Data for the purpose of complying with legal or regulatory obligations (for accounting purposes) or for the legitimate interests it pursues (in the context of improving its products and services and for satisfaction surveys, product evaluation, communication and commercial prospecting relating to the products and services it offers to Customers).

The Customers and the Users have the possibility to unsubscribe, at any time, from any electronic communication by clicking on the "unsubscribe" button accessible at the bottom of each communication. 

Finally, within the framework of the processing of Customer's Data, the supply and processing of this Data are imperative for the use of the MELOMIND Headset and Program. Absence or refusal to supply the Data will not allow the Customer to use the Headset, the Program and the Application. 

5. Data Recipients

The Personal data collected by myBrain Technologies may be destined to the following persons depending on the processing: 

• myBrain Technologies’ staff authorised to process Data;
• myBrain Technologies’s Processors;
• myBrain Technologies' research partners and joint Controllers.

The Data transferred to myBrain Technologies' research partners in the context of statistical data feedback are not of an identifying nature and are subject to enhanced security measures, in particular by means of successive pseudonymisation processes. 

Some Personal data may also be communicated to authorities legally empowered to meet legal, regulatory or contractual obligations.

6. Data Retention Period

myBrain Technologies undertakes to respect the retention periods imposed by the regulations in force.  

MyBrain Technologies retains the Data only for as long as is strictly necessary to achieve the purposes of the Processing, and this retention period may be due to circumstances specific to the Processing, such as regulations requiring the retention of information for a specified period of time or the statute of limitations for legal disputes. Where a limitation period is provided for by law, the retention period may not be shorter. 

Acting as the Controller, myBrain Technologies undertakes to respect the retention periods imposed by the regulations in force, in particular with regard to the management of Customer files and commercial prospecting: Personal data may not be retained beyond the duration strictly necessary for the management of the commercial relationship. They may be kept for commercial prospecting purposes for a period of three (3) years from the end of the commercial relationship or from the last contact with the Customer or User. At the end of this three-year period, myBrain Technologies may contact its customers/prospects again to find out if they wish to continue receiving commercial solicitations. 

Business Data may be retained for a period of ten (10) years in respect of information required for billing information in accordance with a legal obligation on the part of myBrain Technologies. 

The storage of Personal data for evidentiary purposes gives rise to intermediate archiving, access to which is strictly limited. At the end of the corresponding prescription period, the Data will be destroyed or will be irreversibly anonymised so that the Persons Concerned can no longer be identified by any means whatsoever.

7. Data Privacy And Security

myBrain Technologies is committed to ensuring the security of the Processing of Personal Data.

To this end, myBrain Technologies takes technical and organisational measures to ensure a level of security appropriate to the risks associated with the Processing.

The Data collected and processed by myBrain is hosted by OVH SAS, located at 2 rue Kellermann, 59100 Roubaix. OVH is HDS-certified by the Agence Française du Numérique en Santé (ANS), which rigorously controls the practices associated with the hosting of Health Data. 

8. Third-party websites

The Website may contain links, in particular hypertext links, and/or offers from partners referring to a third party website. 

myBrain Technologies has no control over the content of third party websites or the practices of such third parties with respect to the protection of Personal data that they may collect and disclaims any responsibility for such content. It is your responsibility to inform yourself about the privacy policies of such third parties.

9. Rights of users and customers

In accordance with the regulations in force, the Users and the Customers have the following rights over their Data: 

• Right to information

myBrain Technologies undertakes to inform the Users and the Customers about the collection and use of Personal Data and thus undertakes to produce concise, transparent and accessible information on the terms and conditions of Data collection and processing. 

The information requested may be obtained by contacting the DPO by post at Service DPO, 50 avenue Claude Vellefaux, 75010 Paris or by e-mail at [e-mail].

• Right of access

The Users and the Customers have a right of access to obtain information on the existence of a Processing and its terms and conditions. 

The Users and the Customers also have the right to obtain a copy of their Data by requesting a copy from myBrain Technologies in accordance with the contact details set out below. 

• Right to rectification

The Users and the Customers may request myBrain Technologies to correct their Data, particularly when it is no longer up to date.

This right can be exercised by contacting the DPO by post at Service DPO, 50 avenue Claude Vellefaux, 75010 Paris or by e-mail at [e-mail].

• Right of opposition

The Users and the Customers have the right to object at any time, for reasons relating to their particular situation, to the Processing of Personal data concerning them.

The right of opposition is limited in particular by myBrain Technologies' legitimate interest in Processing of Personal data and other legal requirements. 

The Users and the Customers have the right not to be subject to a decision based exclusively on automated processing, including profiling, producing legal effects concerning them or affecting them significantly in a similar way.

• Right to erasure (or ‘right to be forgotten’)

Subject to the regulations in force, and in particular the exceptions (for example, with regard to storage necessary to comply with a legal obligation), the Users and the Customers may request the deletion of the Personal data relating to them:

• When the Personal data are not or are no longer necessary for the purposes for which it was collected or otherwise processed;
• When the User or the Customer withdraws the consent on which the processing is based and no other legal basis for the processing exists;
• When the User or the Customer considers that the Processing of his Personal data constitutes unlawful processing;
• When the Personal Data must be deleted pursuant to a legal obligation under European Union law or the law of the Member State to which myBrain Technologies is subject, i.e. France ;
• Where the User or the Customer has objected to the Processing of the Data and myBrain Technologies has no legitimate or compelling reason to refuse the request.

• Right to restriction of processing

The User or the Customer may obtain from myBrain Technologies a restriction of Processing where one of the following applies:

• When the accuracy of the Personal data is disputed, for a period of time that allows myBrain Technologies to verify the accuracy of the Data;
• Where the Processing is unlawful and the User or the Customer objects to the deletion of his Data and instead requests the limitation of the Processing;
• When the Data are no longer necessary for the purposes for which they were collected but the the User or the Customer needs them for the establishment, exercise or defence of legal rights;
• When the User or the Customer objects to the Processing on the basis of myBrain Technologies' legitimate interest, during the verification of whether the legitimate reasons pursued by myBrain Technologies prevail over those of the data subject.

• Right to data portability

The User or the Customer may obtain from myBrain Technologies the Data previously provided to its in a structured, commonly used, machine-readable format. 

The User or the Customer may also pass such Data to another controller or request that their Data be passed directly from myBrain Technologies to another if technically feasible. 

• Right to withdraw consent

The User or the Customer may, using the means implemented by myBrain Technologies for this purpose, withdraw their consent at any time when their Personal data are processed on the basis thereof.

Withdrawal of consent by the User or the Customer is only valid for the future, and therefore does not affect the lawfulness of the Processing carried out prior to such withdrawal. 

• Right to file a complaint with a local Data Protection Agency

If the User or the Customer considers that its rights are not respected, it has the right to lodge a complaint with a control authority, such as the "Commission Nationale Informatique et Libertés" in France. 

• Right to decide on the fate of Data after death

The User or the Customer has the right to give instructions about the use of their Data after their death. 

10. Exercise of rights

For requests to exercise rights, the User or the Customer is invited to contact the DPO directly by post at Service DPO, 50 avenue Claude Vellefaux, 75010 Paris or by e-mail at [e-mail].

myBrain Technologies may request a copy of proof of identity if necessary. The level of verification carried out by myBrain Technologies in Processing requests to exercise rights will vary depending on the nature of the request, the sensitivity of the information provided and the context in which the request is made. 

myBrain Technologies undertakes to respond to any request as soon as possible, and in any event within one (1) month of receipt of the complete application. However, this deadline may be extended by two (2) months depending on the complexity and/or number of requests. 

11. International transferts of personal data

The Personal Data collected and processed are kept in France. 

However, it is possible that Data from myBrain technologies may be transferred to Processors located outside the European Union, in particular in the United States. In order to protect the privacy and Personal data of Users and Customers, myBrain Technologies makes its best efforts to select partners offering guarantees of security and confidentiality and to establish contractual relationships corresponding to regulatory standards, particularly at the European level. 

12. Changes to this privacy policy

myBrain Technologies reserves the right to change this Policy. If the Policy changes, myBrain Technologies will send an informational email to Customers to notify them of the change.

In any event, the Users and the Customers are encouraged to regularly review the last version of the Policy available on the Website. 

13. Contact details

myBrain Technologies may be contacted in accordance with the contact details set out in the Legal notices on the Website.

The DPO can be reached at the following postal address Service DPO, 50 avenue Claude Vellefaux, 75010 Paris and at the following email address [e-mail].