Privacy Policy

We place great importance on protecting your personal data and do everything we can to safeguard it. Below you will find our commitment regarding the protection of personal data as well as our data protection policy.

1. DATA CONTROLLER IDENTITY

Personal data is collected by MENTENOVA, a SAS with capital of €10,000, registered with the Nanterre Commercial Register under number 988 917 720, with its registered office at Apartment A543, 2 rue Camille Claudel, 92360 MEUDON.

We provide our customers and users with a website and application accessible from 2026. To deliver our services, we collect personal data about individuals and companies.

In the data collection forms on the site and application, users are informed whether the data collection is mandatory or not. If a mandatory data field is not provided, we unfortunately will not be able to fulfill our services and meet our commitments.

We are committed to protecting the personal data entrusted to us. We undertake to ensure the highest level of protection for your personal data in compliance with the GDPR 'General Data Protection Regulation' Regulation (EU) 2016/679 of the European Parliament and of the Council of April 27, 2016, and the French Data Protection Act Law No. 2018-493 of June 20, 2018, enacted on June 21, 2018, which amended the Data Protection Act of January 6, 1978. For any information on the protection of personal data, you can also consult the website of the French Data Protection Authority (Commission Nationale de l'Informatique et des Libertés) www.cnil.fr.

2. DATA COLLECTED

The provision of your Personal Data may be voluntary or necessary depending on the Service used.

When certain information is essential for processing your request or executing a Service, it is indicated by an asterisk (*).

As part of its services, MENTENOVA collects and processes personal data, including sensitive data within the meaning of the GDPR (particularly Health Data), in order to enable the connection between Patients and Healthcare Professionals, and to ensure appropriate care.

2.1 Data collected from Patients

The following data may be collected:

• Identification data : title, last name, first name, postal address, year of birth, email address, telephone number
• Health data : relevant medical information, prescriptions, frequency and duration of care, care start date, availability, desired location of care (Teleconsultation or office)
• Connection and technical data : IP address, device type, technical device identifier
• Data related to Service usage : reviews, comments, complaints, customer satisfaction data
• Identity verification : copy of an identity document when necessary, particularly in case of a request to exercise a right (access, rectification, etc.)

2.2 Data collected from Healthcare Professionals

The following data may be collected:

• Identification and professional data : title, last name, first name, profession, mobile phone number, email address, billing address, SIRET number, RPPS number
• Banking and payment details : payment methods, professional bank details
• Activity-related data : availability, history of accepted care assignments, history of request responses, data related to complaints, disputes, reviews and comments related to Services, customer satisfaction data, connection data (IP address, device type, technical device identifiers), user account data
• Identity verification : copy of an identity document and professional supporting documents when necessary to verify identity and prevent impersonation

3. YOUR RIGHTS

In accordance with the French Data Protection Act Law 78-17 of January 6, 1978 as amended and the General Data Protection Regulation "GDPR", any individual using the service has the right to exercise the following rights:

How to exercise your rights

To exercise your rights, please send your request to MENTENOVA, Apartment A543, 2 rue Camille Claudel, 92360 MEUDON, indicating your last name, first name, email address and if possible your patient number, or by email: contact@mentenova.fr

Your requests must be accompanied by a copy proving your identity. We have a period of 30 business days from receipt of your request to respond. Some demanding requests may take longer, in which case the deadline will be extended and you will be informed.

If you believe your rights are not being respected, you can also file a complaint with the French Data Protection Authority (Commission Nationale de l'Informatique et des Libertés - CNIL) 3 Place de Fontenoy – TSA 80715 – 75334 PARIS CEDEX 07 or via the website: www.cnil.fr.

4. PURPOSES OF COLLECTING YOUR PERSONAL DATA AND THE LEGAL BASES ON WHICH WE RELY

Under the General Data Protection Regulation and the French Data Protection Act, MENTENOVA is only authorized to use the personal data of its users and customers if it has a valid legal basis.

The provision of your personal data is in most cases voluntary. When your information is essential for processing your requests, we indicate this with an (*).

5. WHO IS YOUR DATA TRANSMITTED TO?

To ensure optimal Platform operation and provide you with our Services, your Data may be communicated to different categories of recipients, in strict compliance with the minimization principle provided by the GDPR.

6. TRANSFERS OUTSIDE THE EU

We do not transfer your data outside the European Union. In case of policy change, this section will be modified.

7. DATA RETENTION PERIOD

MENTENOVA, in its capacity as Data Controller, applies distinct retention periods depending on the nature of the Data collected and the purpose pursued.

For processing carried out in its capacity as Data Processor on behalf of Healthcare Professionals, MENTENOVA acts only on their instructions and does not itself determine the applicable retention periods.

Below are the main periods retained by MENTENOVA:

RULES APPLICABLE TO CREDIT CARD PAYMENTS AND PROTECTION OF BANKING DATA

To ensure the security of your payments, we use the services of external providers. They guarantee secure processing of all sensitive data such as banking data and user identity, in compliance with directives and standards: DSP2, GDPR and PCI-DSS.

When payment for your order is made by credit card, our order system connects in real time with the system of our providers who collect your data and perform various checks to avoid abuse and fraud. The data is stored on our providers' servers and is never transmitted to our servers. Our providers request authorization from the bank and only transmit the transaction number to us.

To be able to debit the account during billing or credit it, our providers retain the banking data associated with the authorization number, for the time necessary to complete the transaction and process any complaints.

9. SECURITY MEASURES WE IMPLEMENT TO PROTECT YOUR DATA

As Data Controller, MENTENOVA takes all necessary precautions to preserve the security and confidentiality of your data. This includes the physical security of buildings housing our systems and computer system security to prevent external access to your data. Access to your data is limited to only those who need to know.

10. THIRD-PARTY WEBSITES AND SOCIAL NETWORKS

The Site may contain hyperlinks giving access to other websites published and managed by third parties and not by the Publisher. The Publisher cannot be held responsible directly or indirectly if said third-party sites do not comply with legal provisions.

Creating hyperlinks to the Site can only be done with the written and prior authorization of the Publisher.

We draw your attention to the social networks we use and with which you may interact to support us and/or share one of our publications. During your interaction, MENTENOVA cannot be held responsible in case of a problem. Please note that when you use these links, information about you may be collected or shared. We encourage you to consult the privacy policies and settings of the social networks you interact with, to know what information may be collected, used, or shared by these sites.

11. COOKIES & OTHER TRACKERS POLICY

MODIFICATION OF THIS DATA PROTECTION POLICY

The Company may modify this Data Protection Policy at any time. The Company will inform Users by any means of modifications made to this policy.