This privacy policy is intended to provide any natural person (hereinafter «you» or the «User») visiting and / or using the services provided on the websites listed below, published by the company UNIVERSKIN, simplified joint stock company, located at 400 Avenue Roumanille - 06410 BIOT - France, registered in the Antibes Trade and Companies Register under number 492 961 347, or any UNIVERSKIN affiliate operating in the User's country of residence ( hereinafter «UNIVERSKIN»), any useful information on the processing of personal data operated by UNIVERSKIN and its partners.

Your personal data is very important, and any information collected will be treated responsibly. UNIVERSKIN undertakes to strictly comply with its obligations under all applicable laws and regulations, including, but not limited to, the General Data Protection Regulation (EU) No. 2016/679 of April 27, 2016 ( "GDPR"), the United States Health Insurance Portability and Accountability Act of 1996, as amended ("HIPAA"), the Canadian Personal Information Protection and Electronic Documents Act of April 13, 2000, as amended ("PIPEDA") and any other national law applicable in the territory where the Patient resides (hereinafter together the «Regulations applicable to the protection of personal data»).

UNIVERSKIN may need to process your personal data when you browse the following websites, published by UNIVERSKIN:

- The site www.universkin.com (the «Site»), on which you can:

• obtain an automated analysis of the quality of your skin using the artificial intelligence tool developed by UNIVERSKIN (the «Tool»),
• if you do not wish to use the Tool or if the Tool detects an anomaly requiring obtaining additional information to provide you with a better analysis, complete the questionnaire for analyzing your skin (the «Questionnaire») ,
• order products made to measure and adapted to your skin (the «Product») or any other cosmetic products offered for sale by UNIVERSKIN, and / or
• be put in touch with a Doctor if you wish to obtain dermatological follow-up following the completion of your skin analysis and / or ordering Products on the Site,
• and more generally, obtain all useful information on UNIVERSKIN's activities and the products it offers.

- The SkinXs platform, available at the following address https://skinxs.com/ (the «Platform»), dedicated to Doctors registered on the Platform, with whom you can be linked to from the Site, and on which the Doctor will be able to:

• establish a dermatological diagnosis using the analysis results carried out by the Tool and / or the Questionnaire that you have completed,
• adjust and / or establish the cosmetic formulation tailor-made and adapted to your needs, then offer you a prescription offer for the corresponding Product that you can order on the Doctor’s Webshop of the Doctor.

You are informed that the Platform offers a functionality for automating dermatological diagnosis, Product formulation and prescription offerings. This functionality allows these tasks to be delegated to UNIVERSKIN, via the Tool. You are also informed that when the Tool detects an anomaly, UNIVERSKIN doctors, subject to medical confidentiality, may be required to access your personal data in order to annotate and validate the analysis, in order to ensure better personalization of the cosmetic formulation of the Product. The modalities of access by UNIVERKSIN physicians to data are specified in Article IV below.

- The Universkin + site, available at the following address https://prescriptionskincare.skinxs.com (the «Doctor’s Webshop »), which allows the Doctor ensuring your follow-up on the Platform, if you validate his prescription offer, to manufacture the Product and allow you to order it directly online, alone or accompanied by other products offered in addition by UNIVERSKIN, under the conditions and according to the methods specified in the general conditions of sale of the Doctor's Webshop.

When carrying out the processing of personal data identified below, the User is informed that UNIVERSKIN may access the following qualities, within the meaning of the Regulations applicable to the protection of personal data:

• Processing manager: UNIVERSKIN then determines the purposes and means of processing, that is to say that the processing is carried out on behalf of UNIVERSKIN, which is responsible for the measures taken to carry out this processing;
• Joint controller: UNIVERSKIN jointly determines with the Doctor the purposes of the treatments carried out through the Platform. UNIVERSKIN and the Doctor are jointly and severally responsible for the security and confidentiality measures implemented to preserve Users' personal data.
• Subcontractor: UNIVERSKIN acts on behalf of the Doctor, qualified as "controller", on the instructions of the latter and within the limits of the missions which are contractually entrusted to it.

UNIVERSKIN undertakes to comply at all times with the requirements of the Regulations applicable to the protection of personal data and to only process personal data under the conditions provided below.

3.1 Retention of data processed on the Site

The personal data processed on the Site for the purposes of creating the Account, using the Tool and / or the Questionnaire, as well as the formulation of the Product and its ordering, are kept by UNIVERKSIN for the duration of use of the Site by the User, until the closure of his Account in accordance with the terms set out in the general conditions of use of the Site.

Personal data collected on the Site through the contact form is kept for a period of three (3) years.

UNIVERSKIN keeps the email address of the User who has subscribed to the newsletter as long as he does not unsubscribe (via the unsubscribe link integrated in the newsletters).

3.2 Retention of data processed on the Platform

UNIVERSKIN keeps the personal data it processes on the Platform as data controller for five (5) years from their collection.

The personal data processed by UNIVERSKIN jointly with the Doctor are kept by UNIVERSKIN until the User has closed his Account on the Site.

When UNIVERSKIN acts as a subcontractor of the Doctor, on the latter's instructions, UNIVERSKIN keeps the User's personal data on its databases as long as the Doctor is a user of the Platform, until the closure of his Account on the platform.

The User is informed that the Doctor keeps his personal data independently of UNIVERSKIN, for his patient's own monitoring needs, under the conditions defined between the Doctor and the User. When the Doctor's Account is closed, the Doctor will be free to export personal data to his own information system, without intervention by UNIVERSKIN.

3.3 Retention of data processed on the Doctor’s Webshop

UNIVERSKIN keeps the personal data it processes on the Platform as data controller for five (5) years from their collection.

UNIVERSKIN keeps the User's personal data in its databases as long as the Doctor is a user of the Doctor’s Webshop, ie until his Account on the Platform is closed.

The User is informed that the Doctor keeps his personal data independently of UNIVERSKIN, for his patient's own monitoring needs, under the conditions defined between the Doctor and the User. When the Doctor's Account is closed, the Doctor will be free to export personal data to his own information system, without intervention by UNIVERSKIN.

3.4 Archiving

Beyond the aforementioned periods, the User's personal data will be archived for the legal period necessary to comply with UNIVERKSIN's legal obligations, in particular in terms of scientific research, as well as for the purposes of proof for the observation, exercise or the defense of a right in court.

The User is informed that UNIVERSKIN will in no way have direct access to the Qualifying Data of the User linked to the Identifying Data. Indeed, when UNIVERSKIN collects the Qualifying Data of the User by means in particular of the Tool or the Questionnaire, an automated pseudonymization process based on the depletion then the secure hashing by private key of the data makes it possible to replace the Identifying Data of the User by a code, so that the User is not directly identifiable:

• By UNIVERSKIN physicians for the purposes of annotation and labeling of data in the event that the Tool reveals an anomaly requiring human intervention in order to ensure that the analysis and cosmetic formulation of the Product are best suited to the needs of the User;
• By the technical teams of UNIVERSKIN responsible for ensuring the operational management of the Site, the Platform and the Doctor's Webshop, which have been authorized to process the data and which have received appropriate operating instructions, it being understood that any employee who accesses Identifying Data cannot access the Qualifying Data of the User;
• When this data is used for scientific research purposes, in accordance with the applicable data protection regulations and, in particular, data processing requirements in the context of carrying out such research.

Likewise, only the Doctor chosen by the User on the Platform will have the Identifying Data and Qualifying Data of the User, for the purposes of monitoring the User as a patient.

In general, unless there is a legal or judicial obligation requiring it to do so, UNIVERSKIN will never disclose, assign, rent or transmit the User's personal data which is processed on the Site, the Platform and / or the Doctor's Webshop to third parties. other than the following recipients:

• The hosting providers of the Site and the Platform, as mentioned in point 5 below, for the purpose of performing technical hosting and database management services ;
• UNIVERSKIN providers authorized, under contract, by the latter to annotate data with a view to their labeling. These service providers act as subcontractors of UNIVERSKIN, only on its instructions, under contractual conditions signed with UNIVERSKIN, in compliance with the Regulations applicable to the protection of personal data;
• Payment service providers, for the purposes of settling orders for Products and / or any other products offered for sale by UNIVERSKIN on the Site and the Doctor’s Webshop, under security conditions in accordance with applicable banking regulations;
• If UNIVERSKIN is involved in a merger, acquisition, disposal of assets or bankruptcy proceedings, it may have to sell or share all or part of its assets, including the Platform, including the Personal Data processed in the part of it. In this case, Users would be informed, before Personal Data is transferred to a third party ;
• Third party cookie editors, under the conditions provided for in Article VIII below.

The personal data of Users residing in the territory of the European Union will under no circumstances be transferred outside the European Economic Area.

UNIVERSKIN seeks to implement and maintain appropriate security and confidentiality measures such as to guarantee adequate protection of the personal data processed, adapted to the risks engendered by their processing on the rights and freedoms of the persons concerned. These measures aim in particular to (i) protect personal data against their destruction, loss, alteration, disclosure to unauthorized third parties and (ii) ensure the restoration of the availability of personal data and access to it within deadlines appropriate in the event of a physical or technical incident. UNIVERSKIN also seeks to set up a procedure to test, analyze and regularly assess the effectiveness of their technical and organizational measures to ensure the security of processing.

The Site is hosted in France by the company OVH (RCS Roubaix 424 761 419).

The Platform as well as the Qualifying Database and the Doctor’s Webshop as well as the personal databases are hosted in France by the company AWS HDS (RCS Nanterre 487482143).

In accordance with the Regulations applicable to the protection of personal data, this / these hosts act as subcontractors of UNIVERSKIN. The host does not have the right to use the Personal Data it hosts, except for the purpose of performing technical hosting and database management services and only under the contractual conditions signed between the host and UNIVERSKIN, in compliance with the Regulations applicable to the protection of personal data and, with regard to the hosting of health data, the HDS certification imposed by the public health code.

You have the option to request, at any time, the exercise of the following rights :

• RIGHT OF ACCESS : you are entitled to ask UNIVERSKIN to provide you with confirmation of the processing of your personal data as well as certain information on the processing carried out by UNIVERSKIN on your data, it being understood that this information is in any event provided in this personal data protection policy ;

• RIGHT TO RECTIFY : you have the right to ask UNIVERSKIN to correct, in particular by supplementing or correcting it, all or certain information held about you ;

• RIGHT TO LIMIT PROCESSING : you can ask UNIVERSKIN that some of your data will not be processed, in particular when you dispute the accuracy of the data, when the data retention period has ended but you still need it to keep this personal data for the establishment, exercise or defense of a legal claim, or if you have objected to the processing ;

• RIGHT TO DELETE (« right to be forgotten ») : obtain the erasure of his personal data when it is no longer necessary for the purposes for which it was collected or when the User objects processing of personal data ;

• RIGHT TO DATA PORTABILITY : you can obtain the communication of the personal data that you have communicated to UNIVERKSIN in a readable format, or ask UNIVERSKIN to transmit the personal data that you have communicated to it to another data controller ;

• RIGHT OF OPPOSITION : to object at any time, for reasons relating to his personal situation, to the processing of his Personal Data, in particular in the event that this opposition relates to commercial prospecting, including profiling ;

• WITHDRAWAL OF CONSENT : withdraw your consent to the future processing of your personal data by UNIVERSKIN, when the processing is based on consent ;

• RIGHT TO SUBMIT A COMPLAINT : for Users residing in the territory of the European Union, if the User considers that the processing carried out by UNIVERSKIN constitutes a violation of his personal data, the right to lodge a complaint with the competent data protection authority in the Member State in which the User resides, or with the lead authority, the French National Commission for Computing and Liberties, online using the form provided for this purpose and available at https://www.cnil.fr/fr/plaintes or by post to the following address: CNIL - 3 Place de Fontenoy - TSA 80715 - 75334 PARIS CEDEX 07.

In order to allow the exercise of his rights, the User is invited to contact the Data Protection Officer of UNIVERSKIN, Maître Eric ELABD at +33 (4) .93.00.11.96 or by sending an email to the address next: dpo@universkin.com. The User will be asked for an identity document to prove his identity. This identity document will be kept under the conditions hereof.

The Site, the Platform and / or the Doctor’s Webshop may contain hypertext links to third party websites. UNIVERSKIN has no control over the content of third-party websites referenced by hypertext links. These websites are published by third-party companies independent of UNIVERSKIN. UNIVERSKIN cannot therefore assume any responsibility for the content, advertising, services or any other information or data available on or from these sites. Consequently, the User acknowledges being solely responsible for the access and use of these sites. UNIVERSKIN cannot be held responsible for any proven or alleged damage or loss resulting from or in connection with the use or the fact of having trusted the content, goods or services available on these sites.

The User is not authorized to create a hypertext link to the Site, the Platform and / or the Doctor's Webshop. The creation of links to the Site, the Platform and / or the Doctor’s Webshop is only possible after the prior and express agreement of UNIVERSKIN.

UNIVERSKIN uses cookies for the proper functioning of the Site and the Platform and to monitor and analyze the traffic on it. A « cookie » is a small data file sent to the User's browser by a web server and stored on the hard drive of his computer. There is no risk of damaging the computer.

The information collected through cookies is solely and strictly intended for UNIVERSKIN, in compliance with the regulations applicable to the protection of personal data. Cookies from third-party publishers (Google, Facebook, etc.) allow these publishers to access the information collected through their cookies.

UNIVERSKIN uses the following cookies :

The User is free to consent to the use of all or part of the cookies (other than cookies strictly necessary for the operation of the Site and the Platform) used by UNIVERSKIN on the Site and the Platform. The User is also free to withdraw their consent to the use of cookies at any time, by clicking on the following link : info@universkin.com.

The User can also configure his browser to accept cookies or deactivate them. The instructions for cookies on the most used browsers are available on the following links :

— Windows Internet Explorer® :
https://support.microsoft.com/fr-fr/help/17442/windows-internet-explorer-delete-manage-cookies

— Mozilla Firefox® : https://support.mozilla.org/fr/kb/autoriser-bloquer-cookies-preferences-sites

— Google Chrome® : https://support.google.com/accounts/answer/61416?co=GENIE.Platform%3DiOS&hl=fr

— Apple Safari® (iPhone ; iPad) : https://support.apple.com/fr-fr/HT201265

— Apple Safari® (Mac) : https://support.apple.com/fr-fr/guide/safari/sfri11471/mac

— Deactivation of Google Analytics : https://tools.google.com/dlpage/gaoptout

The Site uses the following social media plug-ins :

— Facebook® and Instagram®, operated by the company Facebook Inc., whose head office is located at 1601 S. California Ave, Palo Alto, CA 94304, United States ;

— Linkedin®, operated by Microsoft Inc., whose head office is located at 599 N Mathilda Avenue, Sunnyvale, United States ;

— Youtube®, operated by Google Inc., whose head office is located at Moutain View, California, United States ;

— Pinterest®, operated by Pinterest Inc., headquartered in Palo Alto, California, United States.

When the User interacts using these plug-ins, their browser establishes a direct connection with the servers of the corresponding social network. The content of the plug-in is immediately transmitted by the User's browser to the social network and saved on its servers. By integrating this plug-in, the social network is informed that the User has visited the Site. He can thus associate the User's navigation on the Site with his user account of this social network, if necessary. If the User does not want the social network to collect data concerning him through the Site and connect them to his user account on the social network, the User must log out of the corresponding social network before connecting to the Site. If the User is not a member of the social network, it is nevertheless possible that he retrieves and records his IP address.

In any event, UNIVERSKIN has no control over the exact content of the data collected. The use of plug-ins is exclusively operated by social networks respectively and governed by their general terms of use, available at the following addresses :

— For Facebook : https://fr-fr.facebook.com/policies/

— For Youtube : https://support.google.com/youtube/answer/9315727?hl=fr

— For Pinterest : https://policy.pinterest.com/fr/privacy-policy

— For Linkedin : https://www.linkedin.com/help/linkedin/answer/1828/supprimer-le-cache-et-les-cookies?lang=fr

— For Instagram : https://help.instagram.com/1896641480634370

Facebook® and Instagram® are registered trademarks and belong exclusively to Facebook Inc.

Pinterest® is a registered trademark and belongs exclusively to Pinterest Inc.

Linkedin® is a registered trademark and belongs exclusively to Microsoft Inc.

Youtube® is a registered trademark and belongs exclusively to Google Inc.

This Privacy Policy can be modified, supplemented or updated at any time by UNIVERSKIN, in particular to take into account any legal, regulatory, jurisprudential and / or technical development, with the aim of constantly guaranteeing the best data protection of the User’s Personal information. UNIVERSKIN will inform Users of any updates to the Privacy Policy by email at least fifteen (15) days before the effective date of the change. If the User does not agree with the terms of the new wording of the Privacy Notice, he is free to request the closure of his Account and the deletion of his Personal Data by writing to the following address : info@universkin.com.