GENERAL TERMS OF USE

OF ECHOPEN O1®, ECHOPEN ON® AND MYECHOPEN

VERSION 6

Please read these General Terms of Use of the echOpen O1® ultrasound imaging probe, the echOpen On® application, and the MyEchOpen platform carefully before any use. By using them, you acknowledge that these General Terms of Use and the General Terms and Conditions of Sale (as defined in Article 1.3 below) form a legally binding agreement that you undertake to comply with in all respects.

1. GENERAL PROVISIONS

1.1. echOpen Factory, a French société par actions simplifiée with registered office at 1 place du Parvis de Notre-Dame, 75004 Paris, France, registered with the Paris Trade and Companies Register under number 882 017 346 (hereinafter “echOpen”, “we”, “us” and “our”), develops innovative ultrasound imaging tools.

1.2. The echOpen imaging solution comprises:

• The echOpen On® application, a digital medical device designed, operated and updated by echOpen, available on the Play Store® and the App Store® (“echOpen On®”).

• A tri-frequency portable ultrasound imaging probe echOpen O1®, a medical device developed and manufactured by echOpen, which connects to the customer’s/practitioner’s smartphone (hereinafter “you” and “your”) via the echOpen On® application to enable improved diagnostic conditions (the “Probe”) (echOpen On® and echOpen O1® are hereinafter together referred to as the “Devices”).

• Additional optional echOpen On® features for storing images collected with the Probe.

• The MyEchOpen platform, designed, operated and updated by echOpen, accessible via a web browser (computer, smartphone, tablet), providing a portal to access images and videos stored via echOpen On®, training content, and administrative account management functions (logins, passwords, profile).

The echOpen On® features for storing images collected with the Probe together with MyEchOpen are hereinafter referred to as the “Digital Services”.

1.3. These General Terms of Use (the “General Terms of Use”) govern access to and use of the Devices and, where applicable, the Digital Services.

1.4. By using the Devices and, where applicable, the Digital Services, you confirm that you unreservedly accept these General Terms of Use in their entirety and that you undertake to comply with them. You may not access or use the Devices or the Digital Services if you do not accept the terms of the General Terms of Use and the General Terms and Conditions of Sale or if you do not meet the conditions set out therein or any requirement imposed by the Applicable Laws.

2. DEFINITIONS

2.1. “Competent Authority” means any supervisory authority responsible for public health and safety and for overseeing your professional practice, including the French National Agency for Medicines and Health Products Safety (ANSM), the French National Medical Council (CNOM), and the Regional Health Agencies (ARS), or the equivalent authority in the country where you practise.

2.2. “General Terms and Conditions of Sale” or “GTCS” means the general terms and conditions governing the sale of the Probe and echOpen On® and/or the subscription to access all or part of the Digital Services, available at echopen.com/cgv.

2.3. “Agreement” means the GTCS and these General Terms of Use, including all of their appendices.

2.4. “Devices” means the echOpen O1® probe and the echOpen On® application (excluding its features for storing images collected with the Probe).

2.5. “Intellectual Property Rights” means all patents, patent applications, copyrights and related works, whether registered or not, rights (including trade secret rights) in know-how whether or not patentable or protectable by copyright, trademarks and service marks, trade names and domain names, rights in designs, rights in computer software, rights in databases and rights in data, specifications, inventions, processes, data, improvements and developments, all other intellectual property rights, together with all registrations and applications for registration of the foregoing.

2.6. “FAQ” means the drop-down menu providing instructions and answers to frequently observed questions for accessing and using all products developed and marketed by echOpen, accessible on echOpen’s website.

2.7. “Confidential Information” means all information disclosed or provided by one party to the other under this Agreement, including information relating to the disclosing party’s research, development, data and results, products, inventions, authored works, trade secrets, processes, designs, formulas, patents, patent applications and licences; business, marketing, sales, strategies, programmes and results, including costs and prices; suppliers, manufacturers, customers, market data, staff and any other confidential or proprietary information related to the performance of its obligations under the Agreement. In addition, each party’s pre-existing Intellectual Property Rights are deemed Confidential Information.

2.8. “Applicable Laws” means all laws, regulations, policies, ethical rules, codes, guidelines and any other applicable rules in force at the time you access and use the Devices and the Digital Services, including the General Data Protection Regulation, provisions of the French Public Health Code and the ethical rules applicable to you.

2.9. “Subscription Period” means the period defined in Article 2.11 of the GTCS during which you are authorised to access and use the Digital Services in consideration of payment of the Subscription Price and subject to compliance with the terms of the Agreement. The Subscription Period is one (1) year from the date the Client is provided access to the Digital Services and is tacitly renewed for successive periods of one (1) year unless terminated in writing by the Client at least one month prior to renewal (or as otherwise provided in the Quotation or the GTCS).

2.10. “Price” means the Purchase Price and the Subscription Price you must pay to echOpen in accordance with the GTCS.

2.11. “RPPS” means the Shared Register of Healthcare Professionals (Répertoire Partagé des Professionnels de Santé).

2.12. “Digital Services” means the echOpen On® features for storing images collected with the Probe as well as the services and content accessible via MyEchOpen.

2.13. “Subscription Price” means the price you must pay to echOpen in accordance with Article 4 of the GTCS to access and use the Digital Services during the Subscription Period.

2.14. “Purchase Price” means the sales price of the Devices you must pay to echOpen in accordance with Article 4 of the GTCS.

3. LICENCE

3.1. In consideration of payment of the Price, we grant you:

(i) ownership of the Probe, which you may link, for use, to one or more individual access accounts for echOpen On® and the Digital Services.

(ii) for the duration of the Agreement, a limited, revocable, personal, non-transferable and non-exclusive licence to use and access echOpen On®, subject to compliance with the terms of the Agreement and the Applicable Laws. You acknowledge and agree that the echOpen On® subscription must be taken out on an individual basis, and you undertake that no person other than you shall use your access credentials for echOpen On®.

(iii) for the Subscription Period, a limited, revocable, personal, non-transferable and non-exclusive licence to use and access the Digital Services, subject to compliance with the terms of the Agreement and the Applicable Laws. You acknowledge and agree that subscriptions to the Digital Services must be taken out on an individual basis. Accordingly, you undertake that no person other than you shall use your access credentials for the Digital Services you have subscribed to.

3.2. Nothing in the Agreement grants you any Intellectual Property Right in the Devices and the Digital Services, including the source code of echOpen On® and MyEchOpen.

4. USE OF THE PRODUCTS

4.1. After your purchase of the Devices and subscription to a Digital Services plan under the terms of the GTCS, we will activate your personal access code to access echOpen On® and the Digital Services.

4.2. You warrant that:

vi. You are either (a) a healthcare professional authorised to perform ultrasound examinations in the country where you practise, duly registered and authorised for this purpose with the local Competent Authorities (in France, this authorisation notably includes registration with the RPPS), or (b) a student pursuing studies to become a healthcare professional and authorised, as such, to perform ultrasound examinations, where applicable under the supervision of the aforementioned healthcare professional.

vii. You comply with all requirements arising from the Applicable Laws, notably the obligation to be covered by professional liability insurance for the practice for which you will use echOpen products.

4.3. Your use of the Devices must be limited to strictly professional purposes and, with respect to the echOpen On® application and the Digital Services, limited to personal use. Consequently, you are prohibited from disclosing or allowing the use of your echOpen On® and Digital Services access accounts by any person other than you.

4.4. The Probe (echOpen O1®) is a Class IIa medical device intended for point-of-care ultrasound (POCUS) imaging in adult patients to enable ultrasound imaging of organs and tissues of the human body. The echOpen On® application (excluding its features for storing images collected with the Probe) is a Class IIa medical device intended to control and display the output information of the dedicated ultrasound Probe in order to fulfil its intended use. Your use of the Devices must always be consistent with their intended purpose as described in the instructions for use and is intended to complement your current working methods and provide improved diagnostic conditions, which are performed under your sole responsibility. You acknowledge that the use of the Devices does not replace and does not independently provide the medical advice, treatment or diagnoses that you provide to your patients. It is your responsibility to ensure your safety and that of your patients and to ensure that your use of the Devices complies with all Applicable Laws, with the FAQ where needed, and with the Agreement.

4.5. Your use of the Devices and the Digital Services must comply with the requirements specified in the Agreement, the instructions for use and, where needed, the FAQ. In particular, you must not (i) sublicense, assign or otherwise transfer or share, in whole or in part, the benefit of the licences granted under Article 3.1 of the General Terms of Use, (ii) reproduce, by any means, in whole or in part, the Devices and the Digital Services, (iii) decompile, disassemble, reverse-engineer the object code or any source code of echOpen On® and MyEchOpen or directly or indirectly allow third parties to do so, (iv) correct, directly or indirectly, any malfunction of the Devices or the Digital Services without echOpen’s prior written consent, (v) lend, rent, sell or grant direct or indirect access to the Devices and the Digital Services to any third party by any means whatsoever, except as provided in the Agreement, (vi) distribute or sell the Probe, whether for consideration or free of charge, or use it to train third parties without echOpen’s prior written consent, (vii) adapt, modify, convert or improve the Devices or the Digital Services in whole or in part, (viii) use the Devices or the Digital Services in any way for the design, production, distribution or marketing of a similar, equivalent or substitute product, (ix) use the Devices or the Digital Services in a manner likely to damage echOpen’s reputation, brand image or any other right associated with the Devices or the Digital Services, (x) use the Devices or the Digital Services in a manner likely to harm patients, (xi) misuse echOpen On® or the Digital Services by knowingly introducing viruses, trojans, worms, logic bombs or any other malicious or technologically harmful material, (xii) attempt to gain unauthorised access to echOpen On® or the Digital Services, to the server on which echOpen On® or the Digital Services are hosted or to any server, computer or database connected to echOpen On® or the Digital Services.

4.6. If you breach any of the obligations set out in this Article 4, your right to use the Devices and the Digital Services shall cease immediately and echOpen shall be entitled to terminate the Agreement immediately in accordance with Article 8.2.2 of the GTCS.

4.7. You must ensure that your Internet network and your IT systems comply with the specifications provided by echOpen and/or with applicable industry standards for access to products and services of this nature. You are responsible for the installation and maintenance of the connection between your IT systems, the Devices and the Digital Services, and for any problem, delay, failure and any other loss or damage related to your network connection and/or your IT systems.

4.8. You are responsible for configuring your IT systems, electronic devices, computer programs, anti-virus software and any other platform necessary to use the Probe, echOpen On® and the Digital Services.

5. ACCESS TO ECHOPEN ON® AND THE DIGITAL SERVICES

5.1. echOpen will use its best efforts to provide you with continuous access to echOpen On® and the Digital Services and to ensure that your access is not interrupted by any event under our control.

5.2. Any maintenance or update of echOpen On® and/or the Digital Services will be notified in advance by echOpen within a reasonable period and by any means reasonably enabling you to be informed. echOpen will use its best efforts to minimise any interruption in the use of echOpen On® and/or the Digital Services during this period.

5.3. We will inform you in writing (including by email) of any event other than those covered by Article 5.2 that may have a significant impact on your access to and use of echOpen On® and/or the Digital Services, providing sufficiently detailed information to allow you to reasonably understand the situation, the downtime of echOpen On® and/or the Digital Services and the implementation of any alternative or business recovery arrangements.

5.4. At your request or at the request of any Competent Authority, we will provide you, your auditors or any Competent Authority with information, documents or records relating to the Devices or the Digital Services that may reasonably be requested for inspection by any Competent Authority.

5.5. You must immediately inform echOpen of any inspection, audit or review regarding the Devices and/or the Digital Services by a Competent Authority of which you become aware. Any response to a Competent Authority concerning the Devices and/or the Digital Services must be prepared according to echOpen’s instructions and submitted for echOpen’s prior written approval (including by email). You undertake to cooperate with any Competent Authority and to implement all measures to comply with the Competent Authority’s findings and remedy the non-compliances it identifies.

6. TERM AND TERMINATION

The term of the Agreement and termination events are provided in Article 8 of the GTCS. At the end of a non-renewed Subscription Period, you may retain restricted access to echOpen On® and/or MyEchOpen, limited to a reduced functional scope determined at echOpen’s sole discretion. Certain advanced features, including storage, image capture and sharing, presets or advanced filters, may no longer be accessible.

7. INTELLECTUAL PROPERTY

7.1. We exclusively own all Intellectual Property Rights in the Probe, echOpen On® and MyEchOpen, and in any additional module or new version thereof. You acknowledge that you have no rights in the Devices and the Digital Services, and in particular no Intellectual Property Rights, other than ownership of the Probe and the right to use echOpen On®, MyEchOpen and the Digital Services in accordance with the terms and limitations of the Agreement.

7.2. We warrant that we hold and will continue to hold throughout the term of the Agreement all rights necessary for the use of the Devices and the Digital Services and for the performance of our obligations under the Agreement.

8. PERSONAL DATA PROTECTION

8.1. In performing the Agreement, the parties must comply with all Applicable Laws on the protection of personal data. You acknowledge that, in accordance with the Applicable Laws, you are the data controller and echOpen is a processor with respect to the processing of patient personal data generated when using the echOpen On® application, under the conditions set out in Appendix 1. This means that, in this context, echOpen will only follow your instructions and, in principle, may not use patient personal data for its own purposes.

8.2. Notwithstanding the foregoing, in the context of research or with the aim of improving our services, products or algorithms, echOpen may reuse certain patient personal data for its own purposes. echOpen will then act as a data controller and will comply with applicable laws and regulations. Appendix 2 to these General Terms of Use describes the framework for the reuse of certain data, which will be carried out in compliance with the MR-004 reference methodology (Deliberation No. 2018-155 of 3 May 2018). Your acceptance of these General Terms of Use implies your full agreement to cooperate in accordance with Appendix 2, so that echOpen can meet the obligations arising therefrom.

8.3. You must never share patient personal data in public or unsecured spaces and, more generally, outside the channels and safeguards provided for in these General Terms of Use and their Appendices (notably via echOpen On® and MyEchOpen). Failing this, you may incur liability towards echOpen and your patients.

8.4. echOpen collects and processes your personal data for the management of our commercial relationship and acts for this sole purpose as data controller, under the conditions set out in Appendix 3 to these General Terms of Use.

9. MISCELLANEOUS

9.1. The General Terms of Use and the GTCS constitute the entire Agreement between the parties with respect to the subject matter hereof and supersede any prior oral or written agreement or arrangement.

9.2. Any amendment to the Agreement must, in order to be binding on the parties, be the subject of a written addendum signed by both parties.

9.3. Nothing in the Agreement shall be construed as creating an employment relationship, a joint venture or a partnership between the parties. The relationship between echOpen and you is solely that of seller and buyer, and of licensor and licensee. Neither party is a partner, agent, joint venturer or representative of the other party.

9.4. If one or more provisions of the Agreement are held to be invalid, illegal or unenforceable, in whole or in part, for any reason, all other provisions of the Agreement shall remain valid and enforceable.

9.5. Each party undertakes, at its own expense, to take out and maintain appropriate insurance in a sufficient amount to cover its liability under the Agreement. Upon request by one party, the other party undertakes to promptly provide written proof of such insurance.

9.6. The Agreement is concluded intuitu personae and you may not assign it, in whole or in part, to a third party without echOpen’s prior written consent.

9.7. Any dispute, controversy or claim arising out of or in connection with the Agreement, including concerning the validity and interpretation of the Agreement and non-contractual disputes and claims, shall be governed by and construed in accordance with French law.

APPENDIX 1 – Protection of patient personal data generated when using the echOpen On® application

1. PURPOSE

1.1. The purpose of this appendix is to set out the terms under which the processor (i.e., echOpen) undertakes to carry out, on behalf of the controller (i.e., the practitioner), the personal data processing operations defined below.

1.2. In the context of their contractual relationship, the parties undertake to comply with the applicable regulations on the processing of personal data, including Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016, applicable from 25 May 2018 (the “General Data Protection Regulation”).

2. DESCRIPTION OF THE PROCESSING SUBJECT TO SUB-PROCESSING

2.1. The processor (echOpen) is authorised to process, on behalf of the controller, the personal data necessary to provide the following service(s): use of and access to the echOpen On® application (including health data hosting).

2.2. The nature of the operations carried out on the data is as follows: collection, recording, organisation, structuring, storage and consultation.

2.3. The purpose(s) of the processing is the use of the echOpen On® application (the storage of patient personal data and the resolution of any technical issue when using the echOpen On® application).

2.4. The personal data processed primarily concern patient data:

Personal data (identification): Surname, first name, date of birth, personal identification number (or PIN). In this respect, and pursuant to the data minimisation principle, echOpen recommends that practitioners limit the personal data collected and in particular that they do not enter the patient’s NIR in the free-text field when saving images or video.

Health data (sensitive data within the meaning of Article 9 GDPR): in the form of images and/or video (so-called ultrasound loops or sequences).

Other data: metadata including technical setting data, as well as the serial number of the device used and the date the data were collected.

Concerning users (practitioners and/or healthcare students):

Personal data (identification): Title, surname, first name, professional email address.

Other personal data (account data): UID (technical identifier assigned when the “echOpen” account is created), email identifier, password.

Other personal data (professional life): RPPS, specialty, qualifications, postal address, professional phone number, serial number of the medical device purchased by the user.

The categories of data subjects are the practitioners and the practitioner’s patients.

3. PROCESSOR’S OBLIGATIONS TOWARDS THE CONTROLLER

3.1. The processor undertakes to:

i. Process the data only for the purpose(s) of the sub-processing.

ii. Process the data in accordance with the controller’s documented instructions (notably in the event of technical issues and/or the need to repair/upgrade the echOpen On® application), and retain them for the period indicated by the controller, namely 20 years from the last visit for care, unless Union or Member State law requires personal data to be kept for a different period.

iii. Where the processor considers that an instruction infringes the General Data Protection Regulation or any other Union or Member State legal provision on data protection, it must immediately inform the controller.

iv. Furthermore, where the processor is required to transfer personal data to a third country or an international organisation under Union or Member State law to which it is subject, the processor shall inform the controller of that legal obligation before processing, unless the relevant law prohibits such information on important grounds of public interest.

v. Guarantee the confidentiality of the personal data processed under this appendix.

vi. Ensure that persons authorised to process the personal data under this appendix:

have committed themselves to confidentiality or are under an appropriate statutory obligation of confidentiality;

receive appropriate training in the protection of personal data.

vii. Take into account, at the level of its tools, products, the echOpen On® application or services, the principles of data protection by design and by default.

3.2. The processor is authorised by the controller to use GPL Expert, external CISO, and OVH, a certified health data host, for health data hosting (the “sub-processor”). If other sub-processors are used thereafter, the processor must obtain the controller’s prior, specific, written authorisation.

3.3. The sub-processor shall be required to comply with the obligations set out herein on behalf of and in accordance with the controller’s instructions. It is the initial processor’s responsibility to ensure that the sub-processor provides sufficient guarantees regarding the implementation of appropriate technical and organisational measures so that the processing meets the requirements of the European Data Protection Regulation and applicable data protection law. If the sub-processor fails to fulfil its data protection obligations, the initial processor remains fully liable to the controller for the performance of those obligations by the other sub-processor.

3.4. The processor shall, where possible, assist the controller in fulfilling its obligation to respond to requests to exercise data subjects’ rights.

3.5. The processor shall notify the controller of any personal data breach within 24 hours of becoming aware of it by sending an email. This notification shall be accompanied by all useful documentation to enable the controller, if necessary, to notify the breach to the competent supervisory authority.

3.6. Where necessary, the processor may assist the controller in carrying out a data protection impact assessment and with regard to the prior consultation of the supervisory authority.

3.7. The processor undertakes to implement measures ensuring a level of security appropriate to the risk, notably secure authentication and encryption of data on smartphones and in communications. More generally, the processor implements measures to ensure the confidentiality, integrity, availability and resilience of processing systems and services on an ongoing basis, as well as measures to restore the availability of and access to personal data within appropriate timeframes in the event of a physical or technical incident, and a procedure to regularly test, assess and evaluate the effectiveness of technical and organisational measures for ensuring processing security.

3.8. At the end of the provision of services relating to the processing of such data or, at the latest, within three months of termination of the contract pursuant to Article 8 of the GTCS, the processor undertakes to destroy all personal data with written confirmation of such destruction. The return shall be accompanied by the destruction of all existing copies in the processor’s information systems, unless Union or Member State law requires personal data to be retained. Once destroyed, the processor must provide written evidence of the destruction.

3.9. The processor shall provide the controller with the name and contact details of its Data Protection Officer (DPO), if one has been appointed pursuant to Article 37 of the GDPR.

3.10. The processor declares that it keeps a written record of all categories of processing activities carried out on behalf of the controller, in accordance with Article 30 of the GDPR, including:

3.10.1. the name and contact details of the controller on whose behalf it acts, any sub-processors and, where applicable, the Data Protection Officer.

3.10.2. the categories of processing carried out on behalf of the controller.

3.10.3. where applicable, transfers of personal data to a third country or an international organisation, including the identification of that third country or international organisation and, in the case of transfers referred to in Article 49(1), second subparagraph of the GDPR, documents attesting to the existence of appropriate safeguards.

3.10.4. where possible, a general description of the technical and organisational security measures.

3.11. The processor shall make available to the controller all information necessary to demonstrate compliance with all its obligations and to allow for audits, including inspections, to be carried out by the controller or another auditor mandated by the controller, and shall contribute to such audits.

APPENDIX 2 – Use of patient personal data generated as part of a research project

Preamble

In performing these General Terms of Use and the GTCS, the practitioner is the controller and echOpen is a processor with respect to the processing of patient personal data generated when using the echOpen On® application.

As such, echOpen may not use patient personal data for its own purposes.

However, further processing by echOpen is permitted under certain conditions. echOpen then becomes the controller of this new processing.

echOpen intends to reuse certain data in the context of research not involving human participants and in the context of studies or evaluations in the field of health, in accordance with Deliberation No. 2018-155 of 3 May 2018 approving the MR-004 reference methodology.

The Parties have therefore met to agree as follows.

Authorisation for reuse in the context of a research project

In view of Article 5(b) GDPR and considering (i) the possible link between the purposes for which the personal data were collected and the purposes of the further processing envisaged, (ii) the context in which the personal data were collected, in particular with regard to the relationship between the data subjects and the controller, (iii) the nature of the personal data, in particular if the processing concerns sensitive data or personal data relating to criminal convictions and offences, (iv) the possible consequences of the envisaged further processing for the data subjects, and (v) the existence of appropriate safeguards, which may include encryption or pseudonymisation.

The practitioner authorises echOpen to reuse patient personal data for the purposes of research projects not involving human participants or within the framework of studies or evaluations in the field of health.

In the context of this relationship only, the practitioner will act as a processor and will undertake to carry out, on behalf of the controller (i.e., echOpen), the personal data processing operations defined below.

Description of the processing

3.1. The processor may process, on behalf of the controller, the personal data necessary to carry out research, studies and evaluations in the field of health that do not meet the definition of research involving human participants as defined in Article L. 1121-1 of the French Public Health Code and that are of public interest.

3.2. The nature of the operations carried out on the data is as follows: holding, collection and/or transmission of data and/or biological samples used in the context of the research, study or evaluation.

3.3. The purpose of the processing is to carry out research, studies and evaluations in the field of health that do not meet the definition of research involving human participants as defined in Article L. 1121-1 of the French Public Health Code and that are of public interest.

3.4. The personal data relating to persons included in the research that may be processed are those listed in Article 2.2.3 “Nature of personal data” of MR-004.

echOpen undertakes to collect or process only the data that are strictly necessary and relevant in light of the research objectives. Consequently, each category of data may be processed only if its processing is scientifically justified in the research protocol.

3.5. The categories of data subjects are the practitioner’s patients.

Obligations of the parties

4.1. The processor undertakes to:

Process the data only for authorised purposes and in compliance with MR-004.

Process the data in accordance with the controller’s documented instructions.

Where the processor considers that an instruction infringes the GDPR or any other Union or Member State legal provision on data protection, it must immediately inform the controller.

Implement appropriate technical and organisational measures so that the processing meets the requirements of the applicable regulations and ensures the protection of the data subject’s rights.

Not transfer personal data to a third country (outside the European Union or the European Economic Area) or an international organisation. If it were required to do so under Union or Member State law to which it is subject, the processor would inform the controller of that legal obligation before processing, unless the relevant law prohibits such information on important grounds of public interest.

Guarantee the confidentiality of the personal data processed under this appendix.

Ensure that persons authorised to process the personal data under this appendix:

have committed themselves to confidentiality or are under an appropriate statutory obligation of confidentiality;

receive appropriate training in the protection of personal data.

Take into account, at the level of its tools, processes or services, the principles of data protection by design and by default.

4.2. The processor may not engage another processor (“sub-processor”) to carry out specific processing activities unless it informs the controller in writing and obtains its consent. This information must clearly indicate the processing activities to be sub-contracted, the identity and contact details of the sub-processor and the dates of the sub-contract.

4.3. The sub-processor is required to comply with the obligations set out herein on behalf of and in accordance with the controller’s instructions. It is the initial processor’s responsibility to ensure that the sub-processor provides sufficient guarantees regarding the implementation of appropriate technical and organisational measures so that the processing meets the requirements of the European Data Protection Regulation and applicable data protection law. If the sub-processor fails to fulfil its data protection obligations, the initial processor remains fully liable to the controller for the performance of those obligations by the other sub-processor.

4.4. At the time of data collection, the processor must provide its patients with information relating to the data processing it carries out under the further processing for echOpen. The wording and format of the information shall be agreed with echOpen prior to data collection and provided to the processor as an appendix.

Wherever possible, the processor shall assist the controller in fulfilling its obligation to respond to requests to exercise data subjects’ rights.

4.5. The processor shall notify the controller of any personal data breach within 24 hours of becoming aware of it by sending an email. This notification shall be accompanied by all useful documentation to enable the controller, if necessary, to notify the breach to the competent supervisory authority.

4.6. Where necessary, the processor shall assist the controller in carrying out a data protection impact assessment and with regard to the prior consultation of the supervisory authority.

4.7. The processor undertakes to implement the following security measures, using the tools provided by echOpen, ensuring a level of security appropriate to the risk, including, inter alia, pseudonymisation and encryption of personal data, measures to ensure the confidentiality, integrity, availability and resilience of processing systems and services on an ongoing basis, measures to restore the availability of and access to personal data within appropriate timeframes in the event of a physical or technical incident, and a procedure to regularly test, assess and evaluate the effectiveness of technical and organisational measures for ensuring processing security.

In particular, the processor undertakes to provide its cooperation so that the identification of data subjects in the databases containing personal health data created for the conduct of the research by the controller can be performed only by means of an order number or alphanumeric code established in accordance with MR-004 and to the exclusion of any directly identifying personal data.

4.8. At the end of the provision of services relating to the processing of such data, the processor undertakes to destroy all personal data in its possession under the sub-contracted processing, with written confirmation of such destruction.

4.9. The processor shall provide the controller with the name and contact details of its Data Protection Officer (DPO), if one has been appointed pursuant to Article 37 of the GDPR.

4.10. The processor declares that it keeps a written record of all categories of processing activities carried out on behalf of the controller, in accordance with Article 30 of the GDPR, including:

the name and contact details of the controller on whose behalf it acts, any sub-processors and, where applicable, the Data Protection Officer.

the categories of processing carried out on behalf of the controller.

where possible, a general description of the technical and organisational security measures.

4.11. The processor shall make available to the controller all information necessary to demonstrate compliance with all its obligations and to allow for audits, including inspections, to be carried out by the controller or another auditor mandated by the controller, and shall contribute to such audits.

APPENDIX 3 – Policy on the protection of your personal data

Purpose

This personal data protection policy (the “Policy”) is intended to inform practitioner users (hereinafter “you”, “your” and “users”) of the Digital Services marketed by echOpen Factory (located at 1 place du Parvis de Notre-Dame, 75004 Paris, hereinafter “echOpen”, “we”, “us” and “our”) of how we collect and process their personal data.

By “personal data”, we mean information about you that could identify you, directly or indirectly, in the context of using the Digital Services, such as your name and contact details.

Under EU data protection law, echOpen is considered the “controller” of the personal data collected about you for the purposes listed below. This means that echOpen decides how it holds and processes personal data about you. If, after reading this Policy, you have further questions about how echOpen collects and processes your data, please contact us at the following address: dpo@echopen.com

What information do we collect about you and for what purposes do we use it?

The categories of personal data about you that we may collect, store and use are set out in the table below and, in each case, we have specified the purposes for which we use them and the “legal basis” on which we process them.

Categories of personal data

For what purpose

Legal basis

Personal data (Identification): Title, surname, first name, professional email address.

To contact the user for relationship management purposes (for example CRM, customer service, invoicing, etc.). To ensure the user is authorised to access the Digital Services.

Necessary for the performance of the GTCS. Legitimate interest of echOpen.

Account data (UID, email identifier, password).

Authentication, access to the Digital Services, support, hosting.

Performance of the GTCS. Legitimate interest.

Professional data (RPPS, specialty, qualifications, postal address, professional phone number, serial number of the purchased medical device).

Eligibility verification, relationship and technical management.

Performance of the GTCS. Legitimate interest.

MyEchOpen account creation data: name, surname, profession, email address, profile photo, description and password.

Creation and management of the MyEchOpen account, access to features, commercial relationship.

Performance of the GTCS. Legitimate interest.

MyEchOpen activity (trainings viewed/downloaded, quizzes, progress, social interactions: liked posts, users followed/followers).

Use of educational and community features.

Legitimate interest.

MyEchOpen activity related to research (quizzes, progress, UID, specialty, data related to the purchased medical device).

Research, studies and health evaluations not involving human participants as per Article L. 1121-1 of the French Public Health Code, of public interest.

Public interest.

How do we collect this information?

In general, we collect your personal data when you voluntarily enter it in response to prompts or forms placed in various locations within our Digital Services.

We also collect your email address from the emails you send to us.

With whom will the personal data be shared?

We take all necessary measures to ensure the security and confidentiality of the personal data collected. Only a limited number of authorised persons within echOpen may access it.

We may share personal data about you with third parties, for example in connection with a potential sale or restructuring of our company, or where necessary for reasons of legitimate interest (e.g., service providers helping to improve our services). We may also be required to share your data with a regulatory body or to comply with the law. We require all third parties to respect the security of your personal data and to process it in accordance with the law.

We may transfer your personal data to countries outside the EEA. If so, we will put in place appropriate safeguards such as the EU-approved standard contractual clauses.

How long do we retain your information?

Contract data: term of the Agreement plus legal limitation periods and mandatory retention periods.

Relationship data: three years from the last contact.

Anonymised data: unlimited use (notably statistics).

Your rights

You have the following rights: access, rectification, erasure, restriction, objection, portability.

How to exercise your rights: dpo@echopen.com. You may lodge a complaint with the CNIL or any competent supervisory authority.

Security

echOpen implements appropriate organisational and technical measures (secure authentication, encryption, system resilience). As no electronic transmission or storage can be completely secure, we suggest that you take precautions when communicating.

Changes

Any material change to the Policy will be notified via the Digital Services.