Dear customer,

Upheal Inc., a Delaware corporation, https://upheal.io, informs you that by using the Upheal app, your personal data will be processed in the ways specified below.

1. WHAT PERSONAL DATA DO WE PROCESS?

We will use your:

CATEGORY	DATA ITEMS
Identifying data	Name, last name, address, email address, phone number, IP address
Personal details	language
Educational and professional data	Qualification, role
Recording	Audio and video
Usage data	Session date and time
Financial data	Bank details, VAT number, fiscal code
Usage data	Log data

2. WHY DO WE USE YOUR DATA?

We will use your data for

PURPOSE	DATA CATEGORY	LEGAL BASIS	ARE YOU OBLIGED TO PROVIDE THE DATA?	HOW LONG DO WE HOLD YOUR DATA
Provision of the service, which includes: -creating your account; -conducting a session with your client; -creating transcripts and insights of the session; -storing the record of the session (optional)	Identifying data, personal details, educational and professional data, usage data	The performance of the contract	Yes. Failure to provide such data will result in the inability for Upheal to provide you with the service	Duration of the contract
Provision of the service	Audio and video recording	The performance of the contract	Yes. Failure to provide such data will result in the inability for Upheal to provide you with the service	Duration of the session
Storage of audio and video recording	Audio and video recording	Your consent which you will express by starting the video recording	No. It is always optional to provide consent for the storage of the audio and video recording	If you decide to store the recording, then it will be kept until you delete it or at the termination of the contract
Compliance with a legal obligation	Identifying data, financial data	Compliance with a legal obligation	Yes. Failure to provide such data will result in the inability for Upheal to provide you with the service	10 years after the termination of the contract
Customer management	Identifying data (phone number, email address)	The performance of the contract	Yes. Failure to provide such data will result in the inability for Upheal to perform the contract	Duration of the contract
Security of the system	Identifying data (IP address) log data	The legitimate interest of Upheal in keeping the systems secure	Data are automatically collected when you use the app	No more than 6 months

3. WHO CAN WE COMMUNICATE YOUR DATA TO?

Your data will be communicated to

- the hosting providers, suppliers of IT services and application software,

- the accountant (only identifying and financial data for the fulfillment of the legal obligation),

who are our data processors;

- public or private bodies to whom we are obliged by the law to disclose the data.

To receive more information about our providers please contact us at support@upheal.io

Disclosure for Law Enforcement: Upheal will disclose your personal data outside the scope of these provisions only as required to do so by law or compelled by court, government or administrative agency of competent jurisdiction. Your personal data may be subject to federal and local laws that require Upheal to disclose this data in certain circumstances.

5. WHERE IS YOUR DATA PROCESSED?

Most of our team is based in the EU and your data is stored in the EU. Some of our suppliers (IT services, hosting provider) operate in the US. Therefore, it is possible that your data will be processed outside of your country/region. In this case, we inform you that the data transfer will take place only in the presence of adequate safeguards provided for by the applicable law. In particular, for transfers from the EU and the UK, where an Adequacy Decision is not applicable, we rely on the Standard Contractual Clauses provided by the European Commission (art. 46 GDPR). For further information about the data transfer you can contact Us at the email address indicated below.

6. HOW DO WE SUPPORT YOU IN DEALING WITH DATA SUBJECT RIGHTS?

We inform you that you have the right to access and request amendment to your data.

You can obtain the erasure of your personal data under certain circumstances. You also have the right to restrict the processing of your personal data.

You can withdraw your consent at any time.

Moreover, you can receive a copy of your personal data or ask Upheal to transmit that data to another controller, where technically feasible.

On grounds relating to your particular situation, you can object to the processing of your personal data used for the legitimate interest of the controller.

You can lodge a complaint with the supervisory authority of your country in case you think that your rights have been breached.

If you wish to exercise one of these rights, you can contact us at support@upheal.io