* * *

Canada’s Data Privacy Policy is available here.

* * *

 

This privacy charter sets out the terms and conditions attached to the collection and processing of personal data implemented by KINVENT BIOMÉCANIQUE, a simplified joint stock company with capital of 626,054.25 euros, identified under number 829 348 747 RCS Montpellier, whose registered office is located at Cap Omega, Rond-Point Benjamin Franklin 34000 Montpellier (hereinafter “KINVENT BIOMECANIQUE” or “we”).

This charter has been drawn up in consideration of the applicable legal and regulatory provisions, in particular the General Regulation of the European Parliament and of the Council on the protection of personal data No. 2016/679 of April 27, 2016 (hereinafter the “GDPR”) and the French Data Protection Act of January 6, 1978 in its current version (collectively the “Applicable Laws”). 

The collection and processing of personal data is implemented in particular during any visit to the www.k-invent.com website (hereinafter the “Website”) and/or the use of our “K-FORCE” application downloaded from the Play Store (Google) or the App Store (Apple) (hereinafter the “Application”) and/or the use of a KINVENT BIOMÉCANIQUE product (hereinafter a “Product”).

Acceptance of this charter is essential for use of the Website and/or the Application and/or a Product. This acceptance is evidenced by a checkbox. 

 

Definition of personal data

In the context of the present charter, the expression “personal data” refers to all data that can directly or indirectly identify an individual, which corresponds in particular to his/her surname, first name, gender, postal address, e-mail address, telephone number, profession, data relating to his/her transactions, bank details, data relating to his/her use of the Website, the Application and/or a Product, as well as any other information that any person concerned may choose to communicate to us about him/herself.

This personal data may concern, alternatively or simultaneously :

  • the practitioner (physiotherapist, sports coach, rehabilitation specialist, gym operator or, more generally, any professional specializing in the human body) or, more generally, any person who acquires a Product offered by KINVENT BIOMÉCANIQUE ; 
  • a patient of a practitioner who uses a Product under the practitioner’s supervision;
  • a user of a Product, even if not under the supervision of a practitioner; 
  • in general, any user of the Website and/or the Application. 

Generally speaking, this data includes all the data entered when creating a user account (e-mail address associated with a password), as well as data relating to the use of the Application and/or a Product. 

In all cases, the persons concerned by the collection and processing of personal data are indistinctly referred to hereinafter as “you”. 

 

Purpose of this charter

The purpose of this charter is to inform you about the means we use to collect and process your personal data, in strict compliance with your rights.

In this respect, we inform you that we comply with Applicable Laws in the collection and management of your personal data.

 

Identity of the data controller 

KINVENT BIOMÉCANIQUE is responsible for the processing of personal data on the Website, the Application and the Products.

When the use of a Product and/or the Application is implemented on the initiative and under the control or supervision of a practitioner, KINVENT BIOMÉCANIQUE then acts as joint data controller with regard to the personal data of the practitioners’ patient users, the latter then also being joint data controllers. In this capacity, practitioners must inform their patients, users of the tools and the associated Application, of the collection of personal data concerning them (for example, data relating to the exercises carried out) and of the rights they have to request their deletion. In this case, KINVENT BIOMÉCANIQUE, which has no contact with patients, declines all responsibility in this respect.

 

Legal basis for the processing of personal data

All personal data relating to users of the Website and/or the Application and/or a Product are collected and processed in relation to duly determined legal bases:

  • The contract: data is collected and processed to enable users to use the Website (e.g. to place an order for a product on the Website) and/or the Application, in accordance with the general terms and conditions of sale and/or the general terms and conditions of use; 
  • Consent: data may be entrusted to KINVENT BIOMÉCANIQUE on the basis of the user’s free and informed consent, in particular when a user uses the Application and/or a Product. Thus, when the Application is used for the first time, a consent form is displayed on the screen asking the practitioner and/or user to give their consent to the use of their personal data and/or to the sharing of this data, once anonymized, for scientific research purposes. With regard to the data concerned, consent can be withdrawn at any time; 
  • KINVENT BIOMECANIQUE’s legitimate interest: our company has a legitimate interest in collecting and processing certain personal data relating in particular to the use of the Website and/or the Application and/or a Product, for example in order to establish usage statistics and improve the quality of its products and services. 

 

Purposes of personal data processing

Your personal data is collected for one or more of the following purposes:

  1. Manage your access to and use of certain services or features available on the Website and/or the Application,
  2. Manage your access to and use of certain services or features available on the Website and/or the Application,
  3. Carry out customer management operations relating to contracts, orders, deliveries, invoices, loyalty programs and customer relations,
  4. Keep track of registered members and users,
  5. Build up a commercial database of customers and prospects,
  6. To send newsletters, requests and promotional messages. In the event that you do not wish us to do so, we give you the option of expressing your refusal in this respect when your data is collected;
  7. To compile commercial and visitor statistics for our services,
  8. Manage people’s opinions on products, services or content,
  9. To manage any unpaid invoices or disputes relating to the use of our products and services,
  10. Personalize responses to your requests for information,
  11. Meet our legal and regulatory obligations.

When we collect your personal data, we will inform you whether the data concerned is compulsory or merely optional. This indication may take the form of an asterisk symbolizing essential information. As a general rule, data that must be provided are those that are necessary for the operation of our services. For example, in order to place an order, it is essential to provide us with billing and delivery details (surname, first name, address, etc., as well as bank details, depending on the payment method used). Similarly, in the absence of consent to the processing of data derived from the use of a Product, it is impossible to use the corresponding Application. 

You are entirely free to decide whether or not to provide optional data. This applies, for example, to information about your tastes or preferences. We will inform you of the possible consequences of failing to provide optional data.

In the event of a crash of the Application, the technical characteristics and geolocation of your equipment are collected by KINVENT BIOMÉCANIQUE using the Firebase Crashlytics solution, whose confidentiality policy is available at the following URL address: https://firebase.google.com/support/privacy

 

Recipients of collected data

Access to your personal data will be restricted to those who have a strict need to know, namely :

  1. KINVENT BIOMÉCANIQUE staff, auditors, etc;
  2. the practitioner, in the case of patient data collected and processed via the Application and/or a Product; 
  3. public bodies, exclusively to meet our legal obligations; 
  4. judicial officers, ministerial officers and organizations (in particular lawyers) responsible for debt collection. In all cases, these service providers are bound by a strict obligation of confidentiality. 

 

Retention period for personal data

Concerning data relating to the management of customers and prospects : 

Personal data relating to KINVENT BIOMÉCANIQUE customers is kept by our company for the time strictly necessary to manage our commercial relationship with you, i.e., schematically, for the duration of your subscription or for the duration of your use of our services.

With regard to any prospecting operations intended for you, your data may be kept for a period of 3 (three) years from the last contact with you or from the end of the commercial relationship.

Data enabling us to establish proof of a right or contract, and which must be kept in order to comply with a legal obligation, will be kept for the period stipulated by the law in force.

Personal data relating to non-customer prospects may be kept for a period of 3 (three) years from the date of collection or last contact with the prospect.

At the end of this 3 (three) year period, we may contact you again to find out whether you wish to continue receiving commercial solicitations.

 

Concerning data relating to the profile of patients and/or users of a Product :

In the event that a practitioner has agreed to personal data relating to his or her own patients being stored in KINVENT BIOMÉCANIQUE’s anonymized database, such data will be kept for a period of 5 (five) years from the date of collection. It is however specified that this data will have been definitively anonymized and that it will be impossible to re-identify the persons to whom it previously related. 

Similarly, data relating to users of the Application and/or a Product who are not under the care of a practitioner are anonymized in such a way that it is impossible to identify said users. 

 

Concerning credit card data :

Financial transactions relating to the payment of purchases and fees associated with the Application’s paid services by bank card are entrusted to a payment service provider, which ensures their smooth and secure processing.

For the purposes of these services, this payment service provider may be required to receive your personal data relating to your credit card numbers, which it collects and processes in our name and on our behalf. This data is not kept beyond the end of the transaction, except in the case of subscription and commitment to regular payment. In this case, you will need to enter your credit card details, which will be used at each payment date. If the credit card expires, you will be asked to provide new references to enable the subscription to continue.  

Concerning the management of opt-out lists:

Information enabling us to take account of your right to object will be kept for a minimum of 3 (three) years from the date on which you exercise your right to object.

At the end of this period, the data will be anonymized and kept exclusively for statistical purposes and will not be used for commercial purposes.

Audience measurement statistics and raw traffic data are kept for no longer than thirteen (13) months.

 

Security

We inform you that we take all necessary precautions and appropriate organizational and technical measures to preserve the security, integrity and confidentiality of your personal data and, in particular, to prevent it from being distorted, damaged or accessed by unauthorized third parties. 

 

Organizational measures in place : 

  • access to personal data may only be granted to persons who have a need to know, in accordance with the conditions set out in this privacy policy; 
  • the servers used are controlled by security groups. 

 

Technical measures implemented : 

  • all personal data is stored on servers located in France or within the European Union; 
  • data resulting from the use of KINVENT BIOMÉCANIQUE tools and relating to your activities are stored on a server approved by the French Ministry of Health to store health data, operated by our service provider EURIS, whose servers are located in France; 
  • a logging and monitoring system enables us to detect any suspicious activity in real time; all access attempts are recorded and saved in logs; 
  • security tests are carried out on a regular basis to ensure that the system is not vulnerable to this type of attack. 

 

In addition, we use secure payment systems provided by our payment service provider, which comply with the state of the art and applicable regulations.

 

International transfers of personal data

No personal data is transferred to countries outside the European Union. Your data is kept and stored, for as long as it is required, on EURIS servers located in France.

KINVENT BIOMÉCANIQUE undertakes to ensure that patient health data, which has been previously authorized by users, will be hosted by an approved provider of personal health data hosting services within the meaning of Article L. 1111-8 of the French Public Health Code, operating in accordance with the practices of the profession and the state of the art.

Data relating to use of the website and e-shop are stored on a server located within the European Union.

Your data and that of your patients, when it concerns residents of the European Union and the United Kingdom, will not be transferred outside the European Union in connection with the use of the services we offer.

Your data and that of your patients will be stored locally on the internal memory of the terminal or terminals used (Smartphone, Tablet). 

In this case, KINVENT BIOMÉCANIQUE declines all responsibility for the use that the user makes of the data stored on his/her terminal.

 

Exercising rights relating to personal data :

In accordance with Applicable Laws, you have the right to obtain communication and, where appropriate, rectification or deletion of data concerning you by contacting :

  • e-mail address: dpo@kinvent.com
  • postal address: KINVENT BIOMÉCANIQUE, Attn: Athanase KOLLIAS, Cap Oméga, Rond Point Benjamin Franklin, 34 000 Montpellier.

Persons whose data is collected on the basis of our legitimate interests are reminded that they may object to the processing of their data at any time. We may, however, continue to process data if there are legitimate grounds for the processing which override your rights and freedoms, or if the processing is necessary to establish, exercise or defend our legal rights.

 

The right to specify how your data will be handled after your death

You have the right to define directives concerning the conservation, deletion and communication of your personal data after your death. These directives can be general, i.e. they cover all your personal data. In this case, they must be registered with a trusted digital third party certified by the CNIL. Instructions can also be specific to data processed by our company. In this case, please send them to the following address:

  • e-mail address: dpo@kinvent.com
  • postal address: KINVENT BIOMÉCANIQUE, Attn: Athanase KOLLIAS, Cap Oméga, Rond Point Benjamin Franklin, 34 000 Montpellier.

By sending us such instructions, you expressly give your consent for these instructions to be stored, transmitted and executed in the manner provided herein. In your instructions, you may designate a person to be responsible for their execution. This person will then be entitled, when you die, to take cognizance of the said directives and ask us to implement them. If you do not designate a person, your heirs will be entitled to take cognizance of your instructions on your death and ask us to implement them. You may modify or revoke your instructions at any time by writing to us at the above address.

 

Portability of your personal data

You have a right to the portability of the personal data you have provided to us, understood as data that you have actively and consciously declared in the course of accessing and using the services, as well as data generated by your activity in the course of using the services. 

This right does not apply to data collected and processed on a legal basis other than consent or the performance of the contract binding us. This right may be exercised free of charge, at any time, and in particular when you close your account on the Application, in order to recover and retain your personal data.

To this end, we will send you your personal data, by any means deemed useful, in a standard open format that is commonly used and machine-readable, in accordance with the state of the art.

 

Making a complaint to a supervisory authority

You have the right to lodge a complaint with a competent supervisory authority in the Member State in which you have your habitual residence, your place of work or the place where the violation of your rights was committed, if you consider that the processing of your personal data covered by this charter constitutes a violation of the applicable texts. 

In France, the competent authority is the Commission Nationale de l’Informatique et des Libertés (CNIL): www.cnil.fr. 

This recourse may be exercised without prejudice to any other recourse before an administrative or legal jurisdiction. Indeed, you also have the right to an effective administrative or legal remedy if you consider that the processing of your personal data, which is the subject of the present charter, constitutes a violation of the applicable texts.

 

Treatment limitation

You have the right to limit the processing of your personal data in the following cases:

  • During the period of verification we carry out, if you dispute the accuracy of your personal data,
  • When the processing of your personal data is unlawful, and you wish to limit such processing rather than delete your data,
  • When we no longer need your personal data, but you wish us to keep it in order to exercise your rights,
  • During the period of verification of legitimate reasons, when you have objected to the processing of your personal data.

 

Notification of personal data breaches

In accordance with Applicable Laws, in the event of a personal data breach of any kind, the data controller shall, without delay and no later than 24 (twenty-four) hours after becoming aware of such a breach, inform the data subjects and provide them with sufficient details of the nature of the breach to enable them to comply with their obligations under the applicable texts.

 

Modifications

We reserve the right, at our sole discretion, to modify the present charter, in whole or in part, at any time. The new version of the charter will appear on the Website and the Application, in the dedicated section.

A window informing you of the modifications will open the first time you download the Application following the effective date of the new version of the charter. These modifications will come into force on the date of publication of the new charter. 

Your visits to the Website and your use of the Application from the effective date of these modifications will constitute recognition and acceptance of the new charter. If you do not accept the new charter, you should no longer access the Application.

 

* * *

June 5, 2024 version