Privacy Policy

1. PURPOSE OF THIS POLICY

This Privacy Policy sets out how the data and privacy of Kooindaa users are protected. It applies solely to the Kooindaa application (hereinafter the "App"). It is intended to transparently explain:

• the information the User can record in the App;
• what happens to this data once it has been recorded;
• what information is, or is not, accessible to the Publisher;
• the situations in which a feature calls on a service outside the App;
• the rights available to the User.

This Policy does not apply to any online store the Publisher may operate, nor to processing linked to any purchase of products. Where applicable, these are covered by separate documentation.

2. DATA CONTROLLER

The Kooindaa App is published by:

56 KOOINDAA SASU

61 rue de Lyon

75012 Paris, France

SIREN: 109 762 195

Trade register: Paris

Email: bonjour@kooindaa.app

Hereinafter referred to as the "Publisher".

For any question relating to this Policy or to data protection, the User can contact the Publisher at the address given above.

3. THE PRINCIPLE BEHIND THE KOOINDAA APP

The Kooindaa App is built on one fundamental principle:

• Information entered by the User remains under their exclusive control.
• The App does not require creating an account with the Publisher.

As a result, data entered by the User is never transmitted to the Publisher under any circumstances, and is not centralised on infrastructure operated by the Publisher.

The Publisher:

• does not receive, collect, centralise, retain, view, or analyse the data;
• does not use it for any commercial purpose;
• does not transmit it to any third party;
• has no technical means of retrieving it remotely.

This lack of access is inherent to how the App works: it does not depend solely on a contractual commitment, but on the very architecture of the product.

As a result, the Kooindaa App is not designed to collect personal information entered by its users in order to exploit or monetise it.

4. INFORMATION RECORDED IN THE APP

Depending on which features are enabled, the User can record various data within the Kooindaa App. This includes, in particular:

• certain information linked to their identity;
• contact details;
• data relating to appointments;
• data relating to treatments;
• data relating to allergies;
• health data;
• information useful in an emergency;
• or any other information the User chooses to enter.

The User is free to fill in or leave blank the fields on offer, except where certain data is required for a specific feature to work.

Information recorded in this way stays within the User's own environment. It is never transmitted to the Publisher, in any way whatsoever.

5. HEALTH-RELATED DATA

Some of the data the User may record in the Kooindaa App may be classed as health data under applicable personal data protection law.

The Kooindaa App allows the User to store and manage this information as part of the features on offer.

The Publisher never receives health data entered by the User, and holds no database bringing such data together.

This data is never exploited for advertising, profiling, commercial analysis, or resale purposes.

The User remains responsible for the accuracy and upkeep of the data they choose to record.

6. NO USER ACCOUNT

The Kooindaa App does not require creating a user account with the Publisher to access its features.

The Publisher does not generate any personal account bringing together the data the User enters in the App.

The absence of an account is inherent to how Kooindaa works and helps protect users' data, by limiting, where applicable, the personal information that could otherwise be transmitted through other means and kept by the Publisher.

7. NO COLLECTION OR CENTRALISATION

The Publisher neither collects nor centralises the data the User enters in the Kooindaa App. As a result, this information is never used to:

• build a profile of the User;
• analyse their habits;
• measure their behaviour within the App;
• personalise advertising;
• pass data on to commercial partners;
• sell or rent out data;
• build a commercial database.

The Kooindaa App includes no mechanism for transmitting the information entered by the User to the Publisher.

8. NO ANALYTICS, ADVERTISING, OR TRACKING OF APP DATA

The Kooindaa App does not transmit any data entered by the User to the Publisher for the purposes of individual statistics, profiling, or behavioural analysis.

The App does not use the information entered to power any advertising system or commercial tracking mechanism.

The Publisher receives no data intended to analyse an individual's use of the App.

9. NFC CARRIERS AND QR CODES

Certain features of the Kooindaa App allow the User to use compatible NFC carriers or QR codes. These options are optional. The User may:

• use an NFC carrier they already own;
• use a compatible carrier obtained from a supplier of their choice;
• generate or use a QR code;
• or not use a carrier at all.

No purchase of a carrier from the Publisher is required to use the App.

Where information is deliberately made accessible via an unencrypted NFC carrier, the User should be aware that anyone who has that carrier may be able to view it.

• The emergency profile, although protected against accidental reading, is deliberately made accessible in plain text, in line with its intended purpose: anyone who reads the relevant carrier can view its content, for the purpose of providing assistance in an emergency.
• The User decides what information appears on the emergency profile. However, where it is viewed by a third-party device via a web browser without the App installed, no personal data is transmitted to a server. Displaying it and, where applicable, decrypting it takes place locally within the device's browser; the data is deleted when the browser is closed.
• Treatment-tracking data ("Health Tracking") recorded on NFC carriers is systematically encrypted. Viewing it requires the Kooindaa App and a key that the User only shares if they choose to share the record: simply having the carrier is not enough to access this information.

Under no circumstances does the Publisher receive data stored in the App, whether through its use, through an NFC carrier, or through a QR code.

10. INFORMATION INTENDED FOR EMERGENCY SITUATIONS

Certain features of the Kooindaa App allow the User to make accessible information they want to be able to share in an emergency. The User decides on its content. It is their responsibility to regularly check that it is accurate and up to date.

Information accessible in an emergency is limited to what the User has selected. By default, the App hides personal data that is not essential for first responders (for example, date of birth is converted into an age) and offers a wide range of options to limit what personal data is displayed.

Where the User wants to designate an emergency contact, they select one via their device's operating system contact picker. The App does not access the User's contacts, and does not request any permission to access contacts; only the contact card chosen is passed to the App.

Where the User decides to make information accessible to a third party, they must assess the nature of the data concerned and how sensitive it is.

The Kooindaa App does not guarantee that a third party will actually be able to access the information in every situation.

Whether it can be viewed may in particular depend on the carrier used, the third party's equipment, and the physical conditions involved.

11. USE OF THE DEVICE'S NAVIGATION

The Kooindaa App allows the User to look up directions to an address associated with an appointment.

At the User's request, the App may prompt the Device to open the selected navigation service using that address as the destination.

This action is initiated solely by the User.

Kooindaa does not transmit any other recorded data to that service.

How the address is processed by the navigation service is governed by that service's own operation and privacy policy.

12. THIRD-PARTY SERVICES

Except for Device features deliberately used by the User, the Kooindaa App does not transmit any data entered to third-party providers for the purposes of collection, storage, analysis, or exploitation.

The App does not use any third-party service to centralise personal data entered by the User.

For the automatic translation of certain free-text fields, when a record written in a language other than the Device's is displayed, the App relies on a translation module located on the Device: the operating system's translation service on iOS, and the Google module built into the App on Android. Translation is carried out locally; no text is transmitted to a server. Only the one-off download of generic language models, which contain no data relating to the User, requires an internet connection.

Where a User chooses to activate a feature provided by a third party, any processing carried out by that third party is governed by its own terms and privacy policy.

13. DEVICE PERMISSIONS

Certain features of the Kooindaa App may require access to functions of the Device.

Depending on the features used, the App may in particular request permission to:

• use NFC technology;
• use the camera to read a QR code;
• display notifications;
• use certain security or authentication features of the Device;
• save an image, such as a generated QR code, to the photo library;
• access the internet, on Android, to download the language resources needed for offline translation (see article 12);
• or use another function needed for a given feature to work.

Permissions are managed by the User from their Device's settings, depending on what their operating system offers.

Declining a permission may prevent the relevant feature from being used, without necessarily preventing use of the Kooindaa App's other features.

14. TECHNICAL DATA AND TELEMETRY

The Kooindaa App does not transmit to the Publisher any data arising from the use of the App for the purposes of telemetry, behavioural analysis, or profiling.

The App does not include any mechanism intended to transmit information entered by the User to the Publisher.

The Publisher does not receive User data in order to measure their use of the Kooindaa App.

Reminders for taking treatment and for appointments are scheduled locally by the Device. The App does not use any remote notification service.

15. DATA COMMUNICATED DIRECTLY TO THE PUBLISHER

This Policy does not mean that the Publisher can never receive any personal data.

The Publisher may receive information that a User chooses to send it directly, in particular when they:

• send a request to customer support;
• ask for assistance;
• contact the Publisher by email;
• exercise a right relating to their data;
• or otherwise voluntarily share information as part of a relationship with the Publisher.

In this case, the information received is used for the purpose for which it was communicated and in accordance with applicable regulations.

This data is separate from data recorded locally in the App.

16. PURPOSES OF PROCESSING ACTUALLY CARRIED OUT BY THE PUBLISHER

Where the Publisher receives personal data directly, it may be processed, in particular, in order to:

• respond to a request;
• provide assistance;
• handle a request relating to an individual's rights;
• comply with a legal obligation;
• or defend the Publisher's legitimate rights and interests where necessary.

The Publisher does not reuse this data for commercial purposes.

17. LEGAL BASES

Personal data processing actually carried out by the Publisher relies on the legal basis applicable to its purpose.

Depending on the processing concerned, this basis may in particular be:

• performance of a contract or pre-contractual measures;
• compliance with a legal obligation;
• the Publisher's legitimate interest;
• or the individual's consent, where this is the appropriate legal basis.

The exact legal basis is determined according to the processing concerned.

18. RECIPIENTS OF DATA

Data recorded in the App is not transmitted to the Publisher, and is therefore not passed on by the Publisher to any third party.

Data the User communicates directly to the Publisher may be accessible to individuals authorised to handle the relevant request.

The Publisher does not sell, rent out, or otherwise commercialise Users' personal data.

19. TRANSFERS OUTSIDE THE EUROPEAN UNION

Data recorded in the App is never transferred by the Publisher to a country outside the European Union or the European Economic Area, given that the Publisher never receives it in the first place.

For any data communicated directly to the Publisher, GDPR provisions on international transfers are applied where necessary.

20. RETENTION PERIOD

Data recorded within the App is not retained by the Publisher.

As a result, the Publisher can neither delete nor return remotely information it neither receives nor holds.

Any data communicated directly to the Publisher is kept for as long as necessary for the purpose for which it was collected, in accordance with applicable legal obligations.

Where an extended retention period is required to comply with a legal obligation or to defend legal rights, this is done within the limits set by applicable regulations.

21. SECURITY

The Publisher implements appropriate measures to protect users' personal data. The security of information recorded in the Kooindaa App relies in particular on the fact that it is never transmitted to, centralised by, or hosted on remote infrastructure by the Publisher.

It also relies on the following measures built into the App:

• on iOS, local storage is protected by the operating system's strictest file-protection class, meaning data can only be accessed once the device is unlocked;
• on Android, the App's data is excluded from the system's automatic backups, and storage encryption is handled by the operating system;
• treatment-tracking information found on an NFC carrier, a QR code, or a treatment-tracking or appointment sharing link is encrypted (AES-256-GCM);
• sharing, revoking access to, deleting, or locking a record requires biometric or passcode authentication on the Device.
• The User remains responsible for the security of their Device and must take the steps needed to prevent unauthorised access to it.

The Publisher can under no circumstances remotely retrieve data stored in the App if the Device is lost, destroyed, or replaced.

22. LOST OR DELETED DATA

The Publisher keeps no copy of data recorded in the App.

As a result, it cannot:

• remotely retrieve deleted data;
• remotely restore the data of a lost device;
• provide a copy of recorded data;
• or remotely restore the App's content if the device is lost.

The User must implement whatever backup measures they consider appropriate. Any backup features offered by the device's operating system are provided by the relevant services and are subject to their own terms.

23. DATA DELETION

Deleting the App deletes all data recorded in the App on the device. This action is irreversible.

It does not erase information already written to an NFC carrier, nor information shared with other people, which remains stored on their own device.

Shared treatment trackings are an exception: on the device that received them, the App deletes them automatically the day after the treatment ends. The person who created a tracking can also revoke access to it at any time: the carrier is then encrypted with a new key, and the received copy is deleted the next time it is read. These mechanisms do not extend to information the recipient may have viewed or reproduced before its deletion.

Data recorded on an NFC carrier is deleted from within the App, using the "Erase a tag's data" button.

QR codes generated by the App contain no personal data, only a simple identifier. Once the App has been deleted, this identifier becomes permanently unreadable.

24. USER RIGHTS

As part of the processing of personal data, the User is entitled to the rights provided for by applicable regulations. Under the GDPR, these rights include, in particular:

• the right of access;
• the right to rectification;
• the right to erasure;
• the right to restriction of processing;
• the right to object;
• the right to data portability;
• the right to withdraw consent, where processing depends on it.

Exercising these rights depends on the nature of the processing concerned and its legal basis.

25. EXERCISING YOUR RIGHTS

The User can exercise their rights by contacting:

56 KOOINDAA SASU

61 rue de Lyon

75012 Paris, France

Email: bonjour@kooindaa.app

The Publisher may request the information needed to verify the identity of the person making the request, where such verification is justified.

Requests are handled in accordance with the time limits set by applicable regulations.

Where a request concerns data stored solely within the App, the Publisher can neither access it nor transmit it, as it is neither the recipient nor the holder of that information.

26. COMPLAINING TO THE CNIL

Any user who believes their rights relating to personal data are not being respected may lodge a complaint with the French data protection authority, the Commission nationale de l'informatique et des libertés (CNIL). It is also possible to first contact the Publisher so that it can look into the matter.

27. MINORS

Use of the Kooindaa App by a minor is subject to the rules applicable to use of the App and to the protection of minors' data.

Where consent is the legal basis for processing and applicable regulations set out specific conditions depending on the age of the individual concerned, those conditions are complied with.

As the Publisher does not receive information recorded in the App, entering information about a minor family member is done solely under the responsibility of the User, on their own Device.

28. NO SALE OR MONETISATION OF DATA

Personal data entered by the User in the App is never sold, rented out, or passed on to commercial partners by the Publisher.

The Publisher does not build any database for commercial purposes from information recorded in the App.

The Kooindaa App is not designed to monetise its users' personal data.

Data protection is a founding principle of how the App is designed.

29. CHANGES TO THIS POLICY

This Policy may be amended to take account of, in particular:

• changes to the App;
• changes to the processing actually carried out;
• changes to the services used;
• changes to the regulatory framework;
• or any measure needed to protect data.

The version in force is the one available within the App.

Where a change requires individuals concerned to be specifically informed, this is done in accordance with applicable regulations.

30. CONTACT

For any question relating to this Policy or to the protection of personal data:

56 KOOINDAA SASU

61 rue de Lyon

75012 Paris, France

Email: bonjour@kooindaa.app

31. ENTRY INTO FORCE

This Policy comes into force from:

September 27, 2026

Version: September 27, 2026