Privacy & cookie policy

The data controller is DOTs Healthcare, the publisher of this site (see the legal notice).

For any question about your data, or to exercise your rights, write to contact@dots.you.

We only collect what we need. The site collects no health data: please don't send us any, for example in a message.

Contact form

• Data: your name, email address, institution (optional) and message.
• Purpose: answering your request.
• Legal basis: our legitimate interest in replying to people who contact us (art. 6(1)(f) GDPR).
• Retention: 3 years from our last exchange.

Investor space

• Data: your identity and contact details, your sign-in and usage data (dates, IP address, browser) and the information you choose to send us.
• Purpose: giving you secure, personal access to confidential information, enforcing the confidentiality agreement and following up on the funding round.
• Legal basis: the confidentiality agreement and the pre-contractual steps you ask us to take (art. 6(1)(b) GDPR); for security and the protection of confidential information, our legitimate interest (art. 6(1)(f)).
• Retention: while your access is useful for the funding round, then 3 years from our last contact. Records of access to confidential information are kept 5 years (the limitation period for contractual claims), including after your account is deleted. If you become a shareholder, the data needed is kept as long as company and tax law require.

Site security

• Data: technical connection data (IP address, date and time, page requested, browser).
• Purpose: keeping the site available and secure, and preventing abuse.
• Legal basis: our legitimate interest in securing the site (art. 6(1)(f) GDPR).
• Retention: 12 months at most.

Fields marked as required are needed to answer you or to give you access; without them, we can't.

The site only uses what it needs to work: a sign-in cookie for the investor space (7 days at most) and a note in your browser that you closed the cookie message. Both are exempt from consent under the French Data Protection Act (art. 82). There are no advertising, analytics, social media or profiling cookies, and no third-party content that could set any.

You can delete them at any time in your browser settings; deleting the cookie signs you out of the investor space.

Only the members of the DOTs team who need your data can access it. We also use the following providers, who act only on our instructions under a data processing agreement:

• OVH SAS (France): hosting of the website and its database, on a server in France.
• Resend, Inc. (United States): sending the site's emails.
• Our email provider, for the messages we receive at contact@dots.you.

Where needed, we may share data with our legal and financial advisers, who are bound by professional secrecy, or with authorities when the law requires it. We never sell your data.

The website and its database are hosted in France. Resend, Inc. stores the data of the emails it sends in the United States, under the EU–US Data Privacy Framework (European Commission adequacy decision) and standard contractual clauses. Any other transfer outside the EU would be covered the same way. You can ask us for a copy of these safeguards.

We protect your data with measures suited to the risks, including encrypted connections (HTTPS), secure sign-in and access restricted to the people who need it.

Under the GDPR and the French Data Protection Act, you have the right to:

• access your data and get a copy of it (art. 15 GDPR);
• have it corrected (art. 16) or erased (art. 17);
• restrict its processing (art. 18);
• receive the data you gave us in a portable format, where its processing relies on a contract (art. 20);
• object at any time, on grounds relating to your situation, to processing based on our legitimate interest (art. 21);
• give instructions on what happens to your data after your death (art. 85 of the French Data Protection Act).

We make no automated decisions about you and do no profiling.

Write to contact@dots.you. We answer within one month; for complex requests, this can be extended by two months, in which case we let you know. If we have reasonable doubts about your identity, we may ask you to confirm it.

If you believe your rights are not respected, you can lodge a complaint with the CNIL (Commission nationale de l'informatique et des libertés), 3 place de Fontenoy, TSA 80715, 75334 Paris Cedex 07, cnil.fr.

We may update this policy, for example when the site changes. The current version is always on this page, with its date at the top. If a change significantly affects how we use your data, we will let you know.