Privacy Policy OdySight®

Last updated: 12/05/2025

The purpose of this Privacy Policy (“Policy”) is to inform you, regarding your use of the OdySight® Application and the Services associated with such use, about what personal data is collected, how it is collected, and for what purposes Tilak Healthcare will use it; to whom it will be transferred, how Tilak Healthcare will protect it, how long this data will be retained, and the legal bases for processing this data. It also describes your rights and how to exercise them.

The OdySight® mobile app (“App”) is operated by Tilak Healthcare S.A.S. (“Tilak Healthcare”), whose registered office is located at 7 impasse Charles Petit, 75011 Paris, France, and which is registered with the Paris Trade and Companies Register under number RCS (Paris) 820 343 044.

The OdySight® mobile app is a digital medical device for remote monitoring that enables self-assessment of visual parameters. Tilak Healthcare is the operator of this digital medical device, and your ophthalmologist serves as the medical remote monitoring provider.

The App is available only with a prescription from your ophthalmologist. Coverage or reimbursement (if coverage is available in your country) may be contingent upon your actual use of the App and the transmission of certain data about you (by your ophthalmologist and Tilak Healthcare) to your country’s medical oversight authority.

When you use the App and the Services, personal data will be collected and processed by the App, by Tilak Healthcare, and by your ophthalmologist.

In accordance with the laws of your country and the General Data Protection Regulation (“GDPR”), your ophthalmologist is the data controller and Tilak Healthcare is the data processor.

If you do not want Tilak Healthcare to collect, store, use, transfer, or process your personal data in the manner described in this Privacy Policy, you may not use the Application and Services.

In that case, you should let your ophthalmologist know that you do not want to use the OdySight® app.

1. Definitions

The following terms shall have the meanings set forth below, whether used in the singular or plural:

• “Personal data” or “personal information”: refers to your personal information, namely any information relating to you, whether you are identified directly or indirectly by an identifier.
• "Health Data": refers to data related to your health, including information about your health status.
• “Healthcare professional” or “Professional”: means any person authorized to practice medicine under the Public Health Code.
• "Ophthalmologist": the ophthalmologist who is treating you and who prescribed the app.
• “Data processing”: means any operation or set of operations performed on your data, including data collected through the Application.
• “Medical device operator”: means any natural or legal person bearing legal responsibility for the activity requiring the use of such a device or making such a device available to third parties; in this case, Tilak Healthcare.
• “Medical telemonitoring provider”: a healthcare professional or a legal entity that brings together or employs one or more healthcare professionals and uses a medical telemonitoring device; in this case, your ophthalmologist.
• “Medical Review”: The Social Security medical review department conducts the necessary reviews with your ophthalmologist (or their healthcare facility) and Tilak Healthcare (as the operator of OdySight®) regarding the issuance and billing of products or services eligible for reimbursement by health insurance funds or coverage by the government.
• “Service”: all services provided by Tilak Healthcare, including, but not limited to, making the App available for performing certain tests, collecting and processing data, detecting declines in visual acuity, and transmitting to your ophthalmologist the data and declines in visual acuity detected by the App via the OdySight® platform.
• “Subcontractors”: refers to any service provider or supplier of products or services involved in the operation of OdySight® on behalf of Tilak Healthcare.

2. What data is collected and processed, why, and how

As part of your use of the App and the Services, your personal and health data are processed (i.e., collected and used) by Tilak Healthcare staff. This data may be collected by your ophthalmologist and transmitted to Tilak Healthcare, transmitted by you directly to Tilak Healthcare, entered into the App by you or your ophthalmologist, or generated by the App.

For security reasons, your health data stored in the App is hosted by a health data hosting provider certified by an accredited organization, in order to ensure the protection of the hosted health data.

Based on the data stored by the health data host, Tilak Healthcare obtains certain information about you, which it processes to operate the Application and Services.

Tilak Healthcare staff have access to your health data without being able to directly identify you (pseudonymization of your health data); in other words, Tilak Healthcare can access your health data only through a numerical code that replaces your identity.

The data collected and processed by Tilak Healthcare is necessary, appropriate, and limited to the processing of your data as explained in this Privacy Policy.

Tilak Healthcare will use and share your personal data and health information only as described in this Privacy Policy.

2.1 Objectives

The purpose of processing your personal and health data through your use of the App and Services is to improve the quality of your care and to facilitate your ophthalmologist’s monitoring of your treatment and/or condition.

The processing of certain personal data when you use the App and Services is intended to help Tilak Healthcare improve the App.

Use of the App (Data Processing)

2.2. Services Delegated to Tilak Healthcare by Your Ophthalmologist

Your ophthalmologist may delegate certain non-medical tasks to Tilak Healthcare, such as sending reminders to ensure compliance (if your frequency of use of the App does not meet your ophthalmologist’s instructions); Tilak Healthcare staff may contact you by email or phone to discuss the proper use of the App and assist you if necessary.

The data processed during these exchanges will be recorded by Tilak Healthcare as a history of these exchanges.

2.3. Coverage / Reimbursement for the App

The OdySight® mobile app is a digital medical device for remote monitoring that may be covered or reimbursed by your country's health authorities.

To receive this coverage/reimbursement, you must use the app. Tilak Healthcare and your ophthalmologist must also provide certain information about you to the health authorities to enable them to conduct audits.

If you refuse to provide us with this information or if you refuse to allow us to share this information with health authorities, your use of the App will not be covered or reimbursed, and Tilak Healthcare will no longer be able to provide you with the App and related Services.

If, after coverage/reimbursement has been approved, you refuse to allow Tilak Healthcare and your ophthalmologist to share your health insurance and supplemental insurance information with the health authorities, coverage/reimbursement will be suspended, and you will be notified by your local health insurance provider. You will then lose access to the Application and the Services.

3. Storage / Hosting of Your Data

Health Data: Your personal data and health data processed by the Application are hosted by a certified health data hosting provider (as required by the Public Health Code). The purpose of this hosting is to guarantee the storage, archiving, and security of your health data and to ensure compliance with the requirements for confidentiality, security, and long-term preservation of this data. This hosting may only take place with your express consent or that of your legal representative (legal guardian for an adult under guardianship).

Personal Data: Your personal data (other than your health data) processed by Tilak Healthcare in connection with the Application is recorded and stored by Tilak Healthcare in the tools used to operate the Application or generated by the Application.

4. Data Accuracy

Proper use of the App is necessary to ensure that the data transmitted by the App is accurate. You can correct or update the data provided by contacting:

• Tilak Healthcare's Data Protection Officer (DPO) by email: dpo@tilakhealthcare.com or by mail at 7 impasse Charles Petit, 75011 Paris, France.
• Or by contacting your ophthalmologist directly.

Information regarding the use of the App and the devices compatible with the App is available in the Terms of Use and on the Tilak Healthcare website.

5. Your Rights

In accordance with the French Data Protection Act and the GDPR, you have the right to access, correct, delete, and restrict the processing of your data. You may also object to the processing of your data or exercise your right to data portability.

You may withdraw your consent to the processing of your personal and health data at any time. However, your data will not be deleted, as it may still be useful to your ophthalmologist for your follow-up care. Tilak Healthcare will retain it for 2 years after your last use of the App.

You can request to cancel your account on the OdySight app, and you can also request that your health data be deleted.

In order to respond appropriately to your requests to exercise your rights, Tilak Healthcare’s DPO:

• To delete your OdySight account, you will be asked to confirm your identity and that of your ophthalmologist;
• To delete your health data, we will also ask you to provide a copy of an official document proving your identity (ID card, passport). This copy will be destroyed immediately after the DPO verifies your identity.

Your personal and health data will be deleted in accordance with the statutory retention period. Your ophthalmologist will be notified of this deletion when your data is removed from their OdySight dashboard.

Please note, however, that your requests to exercise your rights may require Tilak Healthcare to delete your account in the App:

• if you withdraw your consent to the storage of your data by our health data hosting provider;
• if you withdraw your consent to have your Social Security and health insurance documents sent to social security agencies;
• or if you request that your data be deleted.

In that case, Tilak Healthcare will delete your account and will no longer use or process your data. Tilak Healthcare reserves the right to retain an anonymized version of this data.

If you request that we restrict the processing of your data, or if you object to the processing of your data, Tilak Healthcare may not be able to continue providing you with the Application.

To exercise your rights, you must submit your request to Tilak Healthcare’s DPO:

• by mail to: Tilak Healthcare SAS, 7 impasse Charles Petit, 75011 Paris, France
• or by email: dpo@tilakhealthcare.com

If you believe your rights have not been respected, you may file a complaint with your country’s data protection authority (in France, the Commission Nationale de l’Informatique et des Libertés (CNIL)—website: www.cnil.fr or by mail: 3 Place Fontenoy – TSA 8715 – 75334 Paris Cedex 07, or by phone: 01 53 73 22 22).

6. Shelf Life

Tilak Healthcare retains, uses, and stores your data for as long as you use the App, and for two (2) years following your last access to the App.

If your user account remains inactive for more than two (2) years, it will be automatically closed. We will notify you at the email address you provided prior to this closure so that you may object to it, or so that we may archive your data for a specific and reasonable period not exceeding two (2) years, with a view to reactivating your account in the future.

A longer retention period may be necessary to comply with our legal and regulatory obligations, to resolve disputes, or to respond to requests from a regulatory agency or law enforcement, and/or to be able to defend ourselves against any claims or legal actions during the applicable statute of limitations periods.

In that case, your data will be stored for the required period. After that, Tilak Healthcare may destroy the data.

7. Recipients and Transfer of Your Personal Data

Only the following recipients may have access to the data collected or generated by the Application:

• Tilak Healthcare employees: Most employees have access only to your personal data; for those who have access to your health data, your identity is encrypted;
• Tilak Healthcare's subcontractors;
• Your ophthalmologist or members of his or her medical team acting on his or her behalf;
• The health authorities in your country;
• As well as any other recipient specified or that may be specified by law or regulation.

And solely for the purposes of their respective missions.

In any case, only healthcare professionals will interpret your personal health data as part of your remote monitoring care through the App.

When Tilak Healthcare transfers or shares your personal data with its processors and/or partners outside the European Economic Area (EEA), such as in the United States, these recipients have access only to your personal data and your health data, along with your encrypted identity.

Certain countries outside the EEA ensure an adequate level of personal data protection in line with European requirements. When the laws of these countries are not as strict as those of the EEA regarding personal data protection, Tilak Healthcare will ensure that the transfer of your personal data is governed by an adequate transfer mechanism approved by European authorities, such as standard contractual clauses for data protection.

Tilak Healthcare may disclose your data if required to do so by law or court order anywhere in the world, or if the data relates to actual or potential harmful conduct. In such cases, the disclosure of your data will be limited solely to the data that Tilak Healthcare is legally required to disclose, to the extent permitted by law.

In connection with any sale of Tilak Healthcare or any business unit (including the App), customer information is generally included among the transferred assets. In the event of such a sale or disposition of all or part of our business, your data may be transferred to the purchaser.

8. How We Protect Data

Tilak Healthcare guarantees that it has implemented all appropriate security measures to ensure the protection, confidentiality, and integrity of your personal data that is collected and processed, in order to prevent, among other things, any unauthorized disclosure of or access to your personal data by an unauthorized third party.

In accordance with the GDPR, all of Tilak Healthcare’s processors are also required to implement all appropriate security measures to protect your data against loss, misuse, unauthorized disclosure, alteration, and destruction.

In the event of a breach involving your personal data that could affect your privacy, Tilak Healthcare will notify you immediately and take appropriate measures to address the breach.

If you believe that your data has been used improperly by Tilak Healthcare or a third party, please notify us immediately by email at dpo@tilakhealthcare.com.

9. Consent to the Collection and Processing of Your Data

Consent: If you agree to use the App and, consequently, to allow Tilak Healthcare to process your personal and health data as described in this Policy, you are asked to provide your consent within the App after reading this Policy.

After reading this App Privacy Policy, by checking the box “I have read and understood the Privacy Policy,” you, as a user of the App, give Tilak Healthcare your consent to:

• the collection and processing of your data (personal and health-related) by your ophthalmologist and Tilak Healthcare for the data processing necessary to use and improve the Application and related Services (as explained in this document);
• the transfer by your ophthalmologist and Tilak Healthcare to the medical monitoring department of the data necessary to conduct the monitoring (for the purposes of managing the Application);
• Hosting your data with an approved health data hosting provider.

This consent is in electronic form (it is stored in the computer system rather than on paper), and its collection is tracked (the date of your consent is recorded).

Withdrawal of Consent: You have the right to withdraw your consent at any time by sending your request to dpo@tilakhealthcare.com.

Withdrawing your consent will result in:

• the suspension of your access to the Application (as detailed in the Terms of Use) and the cessation of the collection and processing of your data. Data collected and processed up until the time you withdraw your consent will be retained as set forth in this Privacy Policy, unless you specifically request otherwise;
• the termination of coverage or reimbursement for the App.

10. Amendments to the Charter

Tilak Healthcare reserves the right to modify this Policy without prior notice. Should Tilak Healthcare make significant changes to this Policy, they will be reposted in the “About” section of the App, and the date of the change will be indicated at the top of the page.

Therefore, please review this Policy from time to time to stay informed of any changes. If you would like more information about recent changes, please send your request to contact@tilakhealthcare.com.

11. Entire Agreement

In the event that any provision of this Policy is found to be invalid—including, but not limited to, due to a change in legislation or regulations, the French Data Protection Act, the GDPR, or a decision by a court or competent administrative authority—such invalidity shall in no way affect the validity and enforceability of the other provisions of the Policy.

12. Contact