EmoDTx Patient Informed Consent — United Kingdom

1. Preliminary statement

EmoDTx is owned and operated by EMOBOT, a French company, SIRET 912457512, RCS Paris, with its registered office at 15 rue des Halles, 75001 Paris, France (“EMOBOT,” “we,” or “our”).

This document outlines how your personal data and Special Category Health Data are collected, used, and protected. This Policy complies with:

• The UK General Data Protection Regulation (UK GDPR)
• The Data Protection Act 2018 (DPA 2018)
• Relevant NHS Digital and Information Governance standards

2. What data is collected by EmoDTx?

Under the UK GDPR, we categorize the data we collect to ensure “Data Minimisation” — collecting only what is strictly necessary.

2.1 Personal & Special Category Data

• Identity & contact: Email address (required for secure authentication) and optional phone number.
• Special Category Health Data: Self-monitored mood logs.
• Voice data specifications: Where voice interaction is used for mood assessment, note that voice recognition is currently optimized for English-speaking users only. Other data types (mood logs, actigraphy) remain universal in their application.
• Digital biomarkers & activity: Actigraphy data from Apple Health or Google Fit, metadata regarding activities and events (for digital behavior trend assessment), and your time zone.
• Contextual data: Coarse location (approximate 100-metre radius) for mobility trend assessment and to ensure data is processed within the appropriate UK/EEA jurisdiction.
• Integration data: Information linked to your care pathway if integrated with a UK healthcare provider (e.g. NHS Trust or Private Clinic).

2.2 Automatically collected data

Native user actions (e.g. logins, activity logs) to ensure app stability and to maintain a “Single Version of Truth” for your health record, as well as device type, operating system, and app version.

3. Why do we collect this data?

We collect and process your information to deliver and operate the EmoDTx software; support your care team with insights into your condition (where shared); provide feedback and notifications related to your mood and activity; and improve and refine our product based on user interaction. We also use de-identified data for internal research, product development, and Real-World Evidence (RWE) studies to improve digital health outcomes.

Note. EmoDTx does not generate real-time clinical alerts. If you notice changes in your emotional well-being, it is your responsibility to inform your healthcare provider. In the event of an emergency or suicidal thoughts, contact emergency services (e.g. 999 or 111 in the UK).

3.1 Purpose and legal basis

We process your data to provide a digital self-management support tool. Our lawful bases under the UK GDPR are Article 6(1)(a) (Consent) and Article 9(2)(a) (Explicit Consent)for Special Category Data. We process your data with your explicit consent to support your healthcare provider’s activities, fulfill contractual obligations, and meet internal operational and security needs. We also process data in line with legitimate interests for scientific research or public health research (using anonymized or de-identified data).

4. Use and disclosure — user-controlled sharing

You are the sole owner of your data. EmoDTx provides a feature allowing you to share your insights with others (e.g. a family member or a clinician).

• User-initiated sharing: You may choose to grant time-limited access to a personal PDF or dashboard via a secure link.
• No professional duty: Sharing your data with a clinician via this app is for informational purposes only. It does not obligate the clinician to monitor your data in real time or act upon it.
• No sale of data: We do not sell your personal or health data to third parties for marketing or insurance purposes.

5. Data Controller and Processor roles

EMOBOT is the Data Controller of your information for independent use. You retain the right to stop sharing or delete your data at any time. Because EmoDTx is not a medical device, the data generated is considered a personal health diary rather than a formal medical record governed by an NHS Trust, unless you and your doctor explicitly agree to include it in your clinical files.

6. Data storage and hosting

Your personal and health data are securely stored on Amazon Web Services (AWS) Health Data Hosting-certified servers within the UK/EEA.

While AWS provides HIPAA-eligible cloud infrastructure for global standards, EMOBOT specifically configures this environment to UK GDPR standards, including:

• Encryption at rest and in transit
• Role-based access permissions
• Secure backup and intrusion detection

Only authorized EMOBOT personnel may access sensitive data for technical support.

7. Security of your data

We maintain robust safeguards to protect your data:

• Administrative controls: internal training, access policies, and audits
• Technical safeguards: encryption, secure protocols (HTTPS), firewalls, and daily authentication resets
• Physical security: enforced access policies at our facilities

Despite these efforts, no digital system can be guaranteed 100% secure. We are committed to promptly responding to any security incident or data breach in accordance with UK law.

8. Data retention and deletion

• Retention: We retain your data for as long as your account is active. If your account is inactive for 5 years, we will contact you before de-identifying the data.
• Deletion: You have the Right to Erasure under the UK GDPR.

To request deletion of your data, contact Samuel Lerman — dpo@emobot.fr.

9. Your legal rights (UK)

Under the Data Protection Act 2018, you have the right to:

1. Access your data (Subject Access Request)
2. Correct inaccurate information
3. Withdraw consent at any time (this will result in the cessation of data processing and may require account closure)
4. Lodge a complaint with the Information Commissioner’s Office (ICO) if you have concerns about your privacy

All requests should be directed to Samuel Lerman — dpo@emobot.fr.

10. Changes to this policy

We may update this Policy from time to time. You will be informed of material changes directly in EmoDTx. Continued use of the platform requires acceptance of the updated policy.

11. Contact

For any questions or to exercise your rights, please contact:

Samuel Lerman — Data Protection Officer

dpo@emobot.fr

EMOBOT SAS · 15 rue des Halles, 75001 Paris, France · SIRET 912457512

12. Consent

Consent statement

By signing below (or by confirming in the app), you acknowledge that you have read and understood how EmoDTx collects, uses, stores, and protects your data. You also acknowledge that EmoDTx does not replace professional mental health treatment, does not issue clinical alerts, and should not be relied upon for emergency situations. In such cases, contact your provider or emergency services.

You voluntarily give your informed consent to participate in the use of EmoDTx as a digital self-management tool, and you authorize EMOBOT to use and disclose your data — including for internal research and Real-World Evidence studies — in accordance with the UK GDPR and under the Data Protection Act 2018.

Consent revocation

You may withdraw your consent at any time by contacting dpo@emobot.fr. Withdrawal will not affect data already processed but will stop future data collection.