Effective date: […]

Who is responsible for processing my information?

Your personal data is primarily processed by Cough Monitoring Medical Solutions S. A. (“CMS”), a company incorporated under the laws of Portugal, acting as a Data Controller for the purposes of the following Privacy Notice. Under certain circumstances the responsibility for data protection and your privacy is shared with one or several other legal entities, either being a CMS affiliate or a third party.

CMS operates on the basis of the General Data Protection Regulation (the Regulation (EU) 679/2016) principles such as lawfulness, fairness and transparency. In this sense, the purpose of this privacy notice is to inform individual users of CMS Platforms about how CMS processes their personal data. CMS Platforms are:

• C-mo Management Platform
• C-mo Medical Platform

This privacy notice does not apply to the processing of health or clinical data of C-mo patients.

We intend to deal with your information in a manner that is fair and in line with your expectations and encourage you to read and consider the information provided in this privacy notice to confirm that is the case.

How can I contact CMS?

For all personal data matters, you can contact us through dpo@c-mo.solutions.

Why do you need my personal data and what are the legal basis for such processing of data?

Purpose	Description	Legal Basis
Provision of the service by CMS (contractual evidence – acceptance of terms of use)	We need your personal data to be able to maintain a relationship with you or the healthcare institution you are working at.	Execution of a contractual obligation Legitimate interest
Security	In order to protect our assets and business against violence, fraud, theft, misuse and other malicious activities, CMS has put in place a range of different security and safety measures to protect its C-mo Platforms. Some of these measures will require collection and processing of personal data.	Legitimate interest
Legal Defense	In order to protect the rights, property, or safety of CMS, or any of our respective affiliates, business partners, employees or customers, for example, in legal proceedings, internal investigations and investigations by competent authorities.	Legitimate interest

What categories of personal data do you process?

In short, we collect information that we need to identify or contact you, depending on the specific processing purpose (as identified above in this notice). Below you will find some examples of the personal data we may collect about you:

For login credentials:

• Email
• Selected password
• Tracing your use of the C-mo Platforms
• Mac address for authentication (only for C-mo Medical Platform)

We will make sure that we will inform you whenever we need to collect and process data for other purposes or if we need to use any of these data for other purposes not defined in this Privacy Notice.

How is my personal data protected?

We have implemented a variety of security measures to maintain the safety of your personal information and likewise prevent the loss, misuse or unauthorized alteration of your information under our control. However, given the inherent risks, we cannot guarantee absolute security and consequently, we cannot ensure or warrant the security of any information you transmit to us and you do so at your own risk.

You can contact us to get more detail about our security measures in Personal Data Processing through our contacts mentioned above in this Privacy Notice.

Do you share my information with third parties?

We do not sell, trade or otherwise transfer your personal data to outside parties without a legitimate ground to do it. This does include trusted third parties who assist us in operating our website, conducting our business, or servicing you, so long as those parties (i) accede information on a “need-to-know” basis, (ii) act under the purposes defined above or have legitimate purposes for processing personal data; and (iii) agree to keep this information confidential through legal agreements. Therefore, we may disclose your personal with:

• Affiliates – companies related to CMS by common ownership or control;
• Business partners – trusted companies that work with and support us in providing our services;
• Law enforcement and public authority – when we are required to do so by law or to protect CMS’s rights.
• The healthcare professionals that diagnose, treat and accompany the data subjects (i.e., use C-mo Medical Platform).

Due to its worldwide market approach, CMS may need to process your data out of the European Economic Area. Any information we might share to a third country, outside the European Economic Area, is made under strict compliance of the applicable law. If a relevant adequacy decision is not in force, CMS ensures the adoption of the standard contractual clauses or equivalent mechanism, as required by law.

How can I exercise my rights?

Under certain circumstances, you have rights under data protection laws in relation to your personal data. These may include the right to:

• Right to be informed about what personal data we have about them and how we process it.
• Right of access to personal data, and confirmation as to whether or not their data is being processed.
• Right of rectification/correction of inaccurate personal data concerning them.
• Right of erasure/deletion (‘Right to be forgotten’), without undue delay. This applies when:
  • the data is no longer necessary in relation to the purposes for which it was collected.
  • the data subject withdraws consent or objects and there are no overriding legitimate grounds for the processing.
  • the data has been unlawfully processed.
• Right to restriction of processing of the data.
• Right to data portability. The data subject shall be provided with their information in a structured, commonly used and machine-readable format without hindrance from us and subject to confidentiality obligations.
• Right to object on grounds relating to their particular situation, at any time to processing of personal data concerning them, as well as a right to not be subject to decisions based solely on automated processing.

If you wish to exercise any of the rights set out above, please contact us at dpo@c-mo.solutions.

If you are in the European Union, you can identify the specific authority where to file a complaint or address any questions regarding GDPR, at https://edpb.europa.eu/about-edpb/board/members_en.

For how long will you keep my information?

We will only retain your personal information for the period necessary to fulfill the purposes outlined in this Privacy Notice. For every personal data collected through consent we will only keep it until we have legitimate purposes or for processing such data. We may also retain cached or archived copies of information about you for a certain period. Residual anonymous information and aggregate information, neither of which identifies you (directly or indirectly), may be stored indefinitely.

If you need further and more detailed information about our storage periods, please contact us through our contacts mentioned above in this Privacy Notice.

How can I know if you make changes to this Privacy Notice?

We may update this Privacy Notice from time to time. The updated version will be indicated by an updated “Effective Date” and the updated Privacy Notice will be effective as soon as it is accessible. If we make material changes to this privacy notice, we may notify you either through the email address you have provided us, or by prominently posting a notice on our website.

Is all this valid for data you collect from other sources?

This Privacy Notice only applies to information collected or processed through our C-mo Platforms and not to information collected through other means. For those channels we will have specific privacy notices.