Privacy Policy - September 26: Medissimo

PRIVACY POLICY – SEPTEMBER 2026

MEDISSIMO’s top priority is the protection of your personal data, which is collected and processed in accordance with the French Data Protection Act of January 6, 1978, and the European Regulation (EU) 2016/679 of April 27, 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data (“ GDPR ").

1. Data Controller and Data Processor

MEDISSIMO acts as the data controller for the data collected on the website medissimo.fr, medissimo.com (the " Sites ").

However, MEDISSIMO is jointly responsible with healthcare professionals when they enter your personal data into the Medissimo Pharmacist and Medissimo Facility web applications, as well as into the Medissimo Nurse mobile app. This is also the case when you enter your personal data into the Kimed mobile app (the “ Applications ").

2. Personal Data Processed and Methods of Collection

Personal Data Processed by Medissimo	Identification	Last Name, First Name, Date of Birth
	Contact Information	Mailing address, email address, phone number
	Sensitive Data	Social Security number, health data (prescriptions and adherence)
Fundraising Methods	Direct Collection	Cookies – When you browse the Websites and Apps, cookies may be stored on your device (see the Cookies Appendix for more information)
	Indirect collection	Prescriptions entered by the pharmacist
	Indirect collection	Adherence data entered by patients, caregivers, pharmacists, and nurses

3. Purposes of the processing of your personal data and legal bases

MEDISSIMO processes your personal data for specific purposes, based on various types of legal grounds. The retention periods for your personal data depend on the purpose of the processing.

FUNDAMENTALS	OBJECTIVES	SHELF LIFE
Implementation of Precontractual Measures	Creating Your Account on the Kimed App	3 years after the last contact
Performance of the contract (service) or consent	Sharing health data via apps among your healthcare providers : doctors, pharmacists, nurses, and medical-social facilities	Data from Medissimo applications is retained for 4 months in the active database—that is, accessible online—and for 32 months in the archive database—that is, accessible only upon a documented and justified request.
Performance of the Contract (Service)	Traceability of the drug supply chain
	Monitoring Adherence
	Sending your information documents via electronic communication (email, text message, etc.)	3 years since the last contact
Legitimate interest	Statistical Studies for Healthcare Professionals	3 years for personal data; unlimited retention period for anonymized data
	Management of any out-of-court settlements or litigation, and preparation of documentation supporting our obligations	5 years since the last contact
	Use of cookies or trackers to ensure the proper functioning of our Websites and Apps	13 months maximum
Legitimate Interest (Ethical Obligation)	Smooth operation of the applications, particularly the traceability of operations	10 years
Legal Requirement	Managing the exercise of your rights regarding the processing of your personal data	Retention period for the file in the active database: 10 years in the intermediate database
Legal Requirement	Compliance with accounting, tax, and labor regulations, and fraud prevention	6 to 10 years, depending on applicable regulations

4. Recipients of your personal data

Personal data is processed within the company.

Medissimo Applications may enable data exchange with other applications used by Healthcare Professionals (care management software in nursing homes, pharmacy management software, etc.). These data exchanges are initiated by the Healthcare Professional within the relevant Medissimo Application, and under the Healthcare Professional’s sole responsibility. Information derived from third-party software and imported into the Medissimo Applications must be verified by the healthcare professionals who use them. Similarly, healthcare professionals who use the Medissimo Applications are responsible for the data they validate in these Applications and send to third-party software.

Your data may also be disclosed to external recipients, solely for the purposes mentioned above and to the extent strictly necessary for the performance of the tasks entrusted to them and/or to comply with applicable laws and regulations.

These include :

Healthcare professionals who make up your care team;

From subcontractors, particularly those in the following categories: technical information system service providers, cookie providers (for more information on this, please see the Cookies Appendix);

- Legally authorized authorities: Tracfin, social security and tax agencies, and all judicial authorities authorized by laws and regulations.

The data is hosted in France by OSPI, a company certified as a Health Data Host (HDS), in accordance with Article L. 1111-8 of the Public Health Code.

5. Transfer outside the EU

Your data is processed within the European Union. Under no circumstances is it transferred to countries outside this territory.

6. Your Rights

You have several rights regarding the data about you that is processed by MEDISSIMO:

- Right to erasure;

- Right of access;

- Right to correction;

- Right to object;

- Right to restrict processing;

- Right to data portability;

- The right to withdraw your consent at any time regarding the processing of your health data;

- The right to establish post-mortem guidelines regarding the retention, deletion, and disclosure of your data.

7. Contact MEDISSIMO

You can exercise your rights by contacting your healthcare providers, whose names and contact information are listed in the “Care Network” tab of your app.

These rights may also be exercised by sending a complete request to MEDISSIMO, along with proof of identity, to the following addresses:

dpo@medissimo.fr

MEDISSIMO SAS

Data Protection Officer

Technoparc – 8 Jeanneret Street

78300 POISSY

The request must include your last name, first name, and the email address or mailing address where you would like to receive MEDISSIMO’s response. Unless there are special, justified circumstances, this request will be answered within one month of receipt of the request.

Finally, you have the right to file a complaint with the CNIL.

SUB-APPENDIX – COOKIES

1. What are "cookies"?

When visiting the Sites / Apps, tracking technologies are used and data is collected. The term “cookies” refers to all tracking technologies that may be used. These include, in particular, text files stored on the user’s device when visiting the Sites / Apps, which contain information about the user’s browsing activity and enable certain features.

There are several categories of cookies, each serving a different purpose:

- Technical cookies: These cookies help make the Websites/Apps usable by enabling basic functions such as page navigation. The Websites/Apps cannot function properly without these cookies.

- Audience measurement cookies: These cookies help, by collecting and sharing information anonymously, to measure the number of visitors and understand how they interact with the Sites/Apps.

- Social media cookies: These so-called “social” cookies are associated with services provided by third-party websites, such as “Like” and “Share” buttons or multimedia players.

They are used to provide services to users or to remember their social media sharing preferences.

The social network providing such an app button may identify the user through this button, even if the user does not use the button while browsing the Sites or Apps. In fact, this type of app button may allow the social network in question to track the user’s browsing activity on the Sites / Applications simply by virtue of the user being logged in on their device.

- Advertising cookies: These cookies are used to display ads that may be relevant to the user’s interests by personalizing the ads and the content of the Websites/Apps.

Cookies may be set by MEDISSIMO or by third parties. In the latter case, the user is notified and consent is obtained prior to the cookies being set; however, MEDISSIMO has no direct control over these cookies. The user is encouraged to refer to the privacy policies of the third-party cookie providers.

2. Rights Regarding Cookies

a) Consent to the Use of Cookies

In accordance with the applicable provisions and the recommendations of the CNIL, no cookies are placed unless the user has first consented to their placement. Express consent is obtained through a mechanism that informs the user about the cookies used, their issuers, and their purposes; this mechanism allows the user to accept or refuse the placement of cookies.

The validity period of the user’s consent regarding cookies is 13 months; upon expiration of this period, consent is required again.

Certain cookies, which are considered strictly necessary for the provision of the service, are exempt from the consent requirement. This is particularly the case for the following trackers:

- "Shopping cart" cookies,

- "Session ID" cookies that last for the duration of a session, or persistent cookies that are limited to a few hours in some cases,

- Authentication cookies,

- Some analytics solutions for audience measurement (analytics),

- Persistent cookies used to customize the user interface (language or layout preferences).

In any case, the user may withdraw their consent at any time by blocking cookies.

(b) Objecting to the Use of Cookies

When a user objects to the installation or use of a cookie, an opt-out cookie is installed on their device.

- Browser Settings

Users can configure their browser's cookie settings to accept or reject certain categories of cookies:

• Google Chrome: https://support.google.com/chrome/answer/95647?hl=fr

• Internet Explorer: https://support.microsoft.com/fr-fr/help/260971/description-of-cookies

• Mozilla Firefox: https://support.mozilla.org/fr/kb/cookies-informations-sites-enregistrent

• Safari: https://support.apple.com/fr-fr/guide/safari/sfri11471/mac

• Safari (mobile): https://support.apple.com/fr-fr/HT201265

• Android Browser:

https://support.google.com/chrome/answer/95647?co=GENIE.Platform%3DAndroid&oco=1&hl=fr

- Configuring cookies set by third parties

Users can opt out of third-party cookies. For example, to disable the Google Analytics cookie, you can download an add-on at https://tools.google.com/dlpage/gaoptout?hl=fr

- Configuring cookies for personalized advertising through the cross-industry platform “ Youronlinechoices”

Users can visit the Youronlinechoices website, provided by digital advertising professionals who are members of the European Digital Advertising Alliance (EDAA) and managed in France by the Interactive Advertising Bureau France; and thus find out which companies are registered on this platform and which offer the option to accept or reject the cookies used by these companies to tailor the advertisements likely to be displayed on users’ devices based on their browsing information: http://www.youronlinechoices.com/fr/controler-ses-cookies

This European platform is shared by hundreds of online advertising professionals and serves as a centralized interface that allows users to indicate whether they accept or reject cookies that may be used to tailor the advertisements displayed on their device to their browsing activity. This procedure will not prevent ads from being displayed on the websites you visit, but will only block the technologies that enable the personalization of ads.

APPENDIX 2 – SECURITY POLICY

This security policy (the “ Security Policy ") presents and summarizes the security measures to be implemented in the area of IT security: (1) by Medissimo, as well as (2) by Healthcare Professionals and/or medical and social care facilities, in connection with the download, access, activation, viewing, and use of the Medissimo Applications.

(1) MEDISSIMO SECURITY MEASURES

The security measures and safeguards provided by Medissimo regarding the implementation of appropriate technical and organizational measures designed to protect personal data are as follows:

- User access control

Registration for the Kimed Mobile App is done online, through the app. When registering for the Kimed Mobile App, the app verifies the user’s email address. Access to a pharmacy’s patient data through the Kimed Mobile App is granted by the pharmacist via the Medissimo Pharmacist Web App.

Logging in to the platform's applications requires the user's username and password, as well as a unique 6-digit OTP ("One-Time Password") and a software certificate, both of which are provided by the OSPI hosting provider.

- Access Management

Access to a patient’s shared medical record is restricted solely to healthcare professionals authorized to view it. Authorization for a healthcare professional takes into account the concept of the healthcare team, so that only those professionals actually involved in a patient’s care or in the treatment provided to them may have access to information covered by medical confidentiality.

All authorization requests are approved by a MEDISSIMO manager, and healthcare professionals’ access permissions are revoked as soon as they are no longer authorized to access the patient’s health data.

- Traceability measures

Access to the servers is strictly limited to authorized personnel and requires a certificate, a VPN, and an access request submitted to our hosting provider. Each access request is logged. The log contains the following information: date, time, developer ID, and reason for access. This information can be retrieved for a period of 6 months.

In addition, the hosting provider has all the login credentials for the platform. Just as with developers’ access to the servers, client connections to the platform are logged. In the event of a problem, Medissimo reserves the right to request a “ extract " (export) to OSPI to verify this information.

- Software protection measures

Data from the Medissimo Applications is hosted by OSPI, a healthcare data hosting provider certified as a “Healthcare Data Host” (Article L. 1111-8 of the Public Health Code and the Decree of January 4, 2006, regarding the hosting of personal healthcare data). This data is hosted entirely in France and is not transferred to a third country or to an international organization.

OSPI is ISO 27001 and HDS certified and has implemented the necessary security measures to comply with the requirements of the sections of the ISO 27001 standard and the HDS certification framework.

Medissimo makes every effort to ensure that its servers and applications have the latest available software patches, including security patches. The hosting provider OSPI communicates with Medissimo regularly regarding the various migrations and fixes applied to its servers.

- Data backup

The hosting provider OSPI runs a daily backup of the Medissimo application databases. These backups can be restored partially or in full in the event of a problem.

In addition, before each production deployment, Medissimo submits a request to the hosting provider to back up the database as it stands beforehand, so that it can perform a recovery in the event of a problem.

- Data encryption

The entire Medissimo platform uses the HTTPS communication protocol, which encrypts requests between clients and the server. In addition, access to the servers is restricted to a few developers and requires a specific procedure (see the “Traceability Measures” section).

- Medissimo Subcontractors

a) List of Medissimo Subcontractors

The Medissimo platform uses only one hosting provider for patient health data: OSPI (for production and pre-production servers).

(b) Measures for Monitoring Medissimo Subcontractors

OSPI has an alert system that notifies Medissimo in the event of an outage. This allows Medissimo to inform its customers if the problem persists, and if the problem is detected during Medissimo support hours (Monday through Friday, from 9 a.m. to 6 p.m.).

- Other measures

Technical data are managed by Confluence and Jira and stored at ATLASSIAN. stored at ATLASSIAN.

(2) SAFETY MEASURES FOR HEALTHCARE PROFESSIONALS

The security measures to be implemented by Healthcare Professionals and/or Data Controllers in connection with the download, access, activation, viewing, and use of Medissimo Applications are as follows:

- User access control

In the Medissimo Pharmacist Web Application, the licensed pharmacist may create a user account for each member of his or her pharmacy’s staff authorized to access the application (pharmacist or pharmacy technician). The licensed pharmacist agrees to create accounts only for authorized individuals, to provide account information only to the person concerned, and not to disclose this information to third parties.

In the Medissimo Etablissement Web Application for healthcare facilities, the head nurse can create a user account for each staff member at her facility who is authorized to access the application (physician, nurse, or nursing assistant). The head nurse agrees to create accounts only for authorized individuals, to provide information regarding each account only to the person concerned, and not to disclose this information to third parties.

In the Medissimo Nurse Web Application, the nurse creates an account in the application using their email address, password, and RPPS or ADELI number. Access to a patient’s pharmacy data via the Medissimo Nurse Mobile App is granted by the pharmacist through the Medissimo Pharmacist Web App. Before granting this access, the pharmacist agrees to verify the nurse’s identity using their professional license.

In the Kimed Mobile App, the patient creates an account in the app using their email address and password. Access to a patient’s data from the pharmacy via the Kimed mobile app is granted by the pharmacist through the Medissimo Pharmacist app. Before granting this access, the pharmacist agrees to verify the patient’s identity using their ID, and to check the patient’s Vitale card.

Each account that provides access to a Medissimo Application (Pharmacist, Facility, Nurse, or Kimed) is registered to a specific individual, personal, and non-transferable. Users agree not to disclose to third parties any information related to their account—in particular, their username and password—and to take all necessary measures to prevent unauthorized persons from accessing this information.

- Traceability measures

Responsibility for for traceability is transferred to the HDS-accredited hosting provider.

- Data backup

Medissimo delegates responsibility for data backup to the HDS-certified hosting provider.

- Other measures

Healthcare professionals agree not to access the platform from a public network and agree to secure their internal networks.