Courtesy translation. In case of any discrepancy, the Portuguese version prevails. PRIVACY POLICY AND PERSONAL DATA PROTECTION Preamble This Privacy Policy describes how OnPosture collects, uses, stores, shares and protects the personal data of its Clients and of the users of Onposture.app. Reading this Policy in full is mandatory and its express acceptance is an indispensable condition for the use of OnPosture's Services. 1. Introduction This Privacy Policy describes how OnPosture collects, uses, stores, shares and protects the personal data of its Clients and of the users of Onposture.app, in compliance with Regulation (EU) 2016/679 ("GDPR") and Law No. 58/2019 of 8 August, which ensures the implementation of the GDPR in the national legal order. 2. Data Controller Data controller: OnPosture, Lda, company number (NIPC) 519046722, with registered office at Avenida Duque d'Ávila, 64 - 1A, 1050-083 Lisbon. Contact for data protection matters: hello@onposture.com. 3. Principles OnPosture processes personal data in accordance with the principles of lawfulness, fairness and transparency; purpose limitation; data minimisation; accuracy; storage limitation; integrity and confidentiality; and accountability, under Article 5 of the GDPR. 4. Categories of Personal Data Collected 4.1. Identification and contact data Collected when the Client registers: name, date of birth, tax number (NIF), mobile phone number, email address and sex. This data is used specifically for: (i) unequivocal identification of the Client and management of the Client's account in the App; (ii) formalisation of the admission process and of the service contract; (iii) issuing invoices and complying with tax and accounting obligations (using the NIF); (iv) communicating with the Client regarding services, appointments, reports and contractual changes; (v) compliance with legal identification obligations and fraud prevention; and (vi) segmentation by sex, for the presentation of a self-reported pain questionnaire and for the interpretation of functional metrics and musculoskeletal reference norms. 4.2. Functional data Functional data includes the answers to the self-reported pain distribution questionnaires and to the physical/musculoskeletal condition questionnaires; the metrics collected in in-person assessments (weight, age, plantar pressure, muscle strength, postural estimates); the metrics collected through OnPosture Telemetry during remote exercise; and any other information voluntarily shared by the Client. Image and video: during the in-person assessment, the Humantrack system captures a three-dimensional image that is processed in real time to extract metrics and, according to VALD's guarantee, is not recorded. In remote exercise sessions, the camera image is processed locally on the Client's device (see section 7.2) and is neither recorded nor sent to OnPosture. In tele-assessments by video call, the session is recorded on video, with the Client's consent, exclusively to extract the assessment metrics, and the video is kept in accordance with section 9.4. This data, together with the personal identification data referred to in 4.1, is used specifically to produce the functional assessment and performance/progression reports, to personalise the clinical exercise service, and for the possible identification of the need for referral to Partner Professionals. 4.3. Data collected automatically by the App Technical usage data, device type, operating system, session identifiers and activity logs in the App, used for security, maintenance and improvement of the Service. 5. Purposes of Processing and Lawful Bases The data identified in section 4.1 is processed on the basis of the performance of a contract to which the data subject is party or of pre-contractual steps taken at their request (Article 6(1)(b) of the GDPR), as well as compliance with legal obligations to which OnPosture is subject, namely tax obligations (Article 6(1)(c)). Fraud prevention and prevention of abusive use of the account (section 4.1, (v)) and the processing of the technical data referred to in section 4.3 are based on OnPosture's legitimate interest in ensuring the security, integrity and proper functioning of the App and the Services (Article 6(1)(f) of the GDPR). The data identified in section 4.2, as it constitutes a special category of data that may, at the limit, fall within Article 9(1) of the GDPR, is processed exclusively on the basis of the data subject's explicit, free, specific and informed consent (Article 6(1)(a) and Article 9(2)(a) of the GDPR), given when accepting the Terms and Conditions and this Policy. The Client may withdraw this consent at any time, without affecting the lawfulness of processing carried out previously, with the possible consequence that OnPosture may be unable to continue providing the Services that depend on that data. 6. Anonymised Use for Statistical and Scientific Purposes 6.1. The metrics collected under section 4.2, after undergoing an anonymisation process that irreversibly prevents the direct or indirect identification of the data subject, may be used by OnPosture for: (i) internal statistical analyses to improve the Service; and (ii) scientific studies or research that OnPosture promotes or takes part in, with a view to improving the quality of life of Clients and of the population in general. 6.2. Truly anonymised data ceases to be personal data for the purposes of the GDPR (recital 26), so this use does not require an additional lawful basis. Nevertheless, OnPosture undertakes to apply robust anonymisation processes, periodically assessed for re-identification risk, and not to share such data in a way that allows the re-identification of the data subjects. 6.3. The Client may object to the use of their anonymised data for study purposes by contacting OnPosture under section 16, without such objection having retroactive effect on analyses already completed and effectively anonymised. 7. Sharing Data with Third Parties / Processors In strict compliance with the principle of minimisation, OnPosture shares personal data with the following third parties, under the conditions described: 7.1. VALD Performance As part of the in-person assessment, only the following Client data is entered into VALD's software: weight, sex, age and an identification code (without a name), whose key linking it to the Client's identity is kept exclusively by OnPosture. VALD acts, with respect to this set of data, as a processor of OnPosture (when it processes the data to produce the metrics for OnPosture's report), or as an independent controller (with regard to the use of the metrics it has collected for its own anonymised studies), the latter processing being governed by VALD's own privacy policy and terms and conditions, available at https://vald.com/privacy-policy and https://www.vald.com/static/Terms-of-Use-VALD-Apps-20032023.pdf. The Humantrack 3D image capture system is used in a format that, according to VALD's guarantee, does not record or keep the captured image, which is processed in real time only. 7.2. Google MediaPipe The OnPosture Telemetry system uses an open-source posture estimation library developed by Google (MediaPipe), which runs locally in the Client's browser or device. The images captured by the camera during the remote session are processed on that device and are not transmitted to Google or to OnPosture; only the resulting numerical metrics (for example, joint angles and repetitions) are sent to OnPosture to produce the report. To load this library, the Client's browser connects to content delivery servers (Google and jsDelivr), which receive technical connection data, such as the IP address. Additional information on the data processing carried out by this technology is available in the respective privacy policy, accessible at https://policies.google.com/. 7.3. Partner Professionals Whenever OnPosture's technicians identify a need for specialised follow-up and the Client expresses an express wish to be referred, the data strictly necessary for that follow-up may be shared with the chosen Partner Professional, with the Client's specific and prior consent to that particular sharing. 7.4. Technical service providers OnPosture may use hosting, IT maintenance and App support providers, who act as processors under written contracts that guarantee adequate levels of security and confidentiality, in accordance with Article 28 of the GDPR. The providers currently used are: hosting of the App and the database, including server backups - Hetzner Online GmbH (servers located in Germany, European Union); email service and backups - Google (Gmail / Google Drive); video calls - Google Meet; MB WAY payment processing - Stripe. 7.5. Disclosure of data OnPosture does not sell, rent or trade Clients' personal data to third parties for marketing purposes. 8. International Data Transfers Should any of the entities referred to in section 7 (namely VALD and/or Google) process personal data outside the European Economic Area, the responsibility for ensuring that such transfer only takes place under adequate safeguard mechanisms pursuant to Chapter V of the GDPR lies with those entities, and OnPosture cannot be held liable. 9. Retention Period 9.1. Identification and contractual data is kept for the whole duration of the contractual relationship and, after it ends, for the period legally required to comply with tax and accounting obligations (as a general rule, 5 years) or for the defence of rights in the event of a dispute. 9.2. Data on physical condition is kept for as long as necessary for the purposes described in section 4.2 and, after the end of the contractual relationship or the withdrawal of consent, for the additional period necessary to complete any ongoing reassessments or to comply with legal obligations, after which it is deleted or irreversibly anonymised. 9.3. Once any retention period has ended, the data will be securely deleted or, where possible and appropriate to the statistical/scientific purposes described in section 6, anonymised. 9.4. Video recordings of tele-assessments are kept only for as long as necessary to extract the metrics and prepare the respective report, not exceeding 30 days, and are then securely deleted. 10. Information Security OnPosture implements technical and organisational measures appropriate to the risk, namely access controls, encryption of data in transit and at rest whenever technically feasible, pseudonymisation (namely through the correspondence code system used with VALD), access logging and monitoring, and training of its staff in data protection, with a view to preventing unauthorised access, loss, destruction or improper disclosure of personal data. 11. Data Subject Rights Under Articles 15 to 22 of the GDPR, the Client has the right, at any time and free of charge (except for manifestly unfounded or excessive requests), to: a) Access their personal data and obtain information about their respective report and plan; b) Request the rectification of inaccurate or incomplete data; c) Request the erasure of their data ("right to be forgotten"), in the cases provided for by law; d) Request the restriction of processing, in certain circumstances; e) Object, on grounds relating to their particular situation, to the processing of data based on OnPosture's legitimate interest (section 5), including to the use of anonymised data for studies, under section 6.3; f) Request their data; g) Withdraw the consent given, at any time, without affecting the lawfulness of processing carried out previously; h) Not be subject to decisions based solely on automated processing, including profiling, that produce legal effects or similarly significantly affect them - OnPosture clarifies that the reports produced, including those that use postural estimation algorithms, are always reviewed and contextualised by human technicians before being made available to the Client, and do not constitute a decision based solely on automated processing within the meaning of Article 22 of the GDPR; i) Lodge a complaint with the competent supervisory authority (section 15). These rights may be exercised through the contacts indicated in section 16, and the request must be answered within a maximum of one month, extendable as legally provided. 12. Minors OnPosture's Services are intended, in principle, for persons over 18. Should they exceptionally be provided to minors, this will depend on the consent and supervision of the holder of parental responsibilities, as required by applicable law, and on reinforced safeguards for the protection of the minor's health data. 13. Cookies and Similar Technologies Onposture.app may use cookies, device identifiers or similar technologies strictly necessary for the operation of the App and, where applicable, for analytical purposes, with the Client's consent, in accordance with Law No. 41/2004 of 18 August, as currently worded. Additional information on these technologies, when used, is made available in a specific cookie policy in the App. 14. Changes to the Privacy Policy OnPosture reserves the right to update this Policy, with changes being communicated to the Client through the App and/or by email with reasonable notice, and applying immediately after publication - except where the change implies new processing of health data not previously consented to, in which case new explicit consent will be requested. 15. Complaints - Supervisory Authority Without prejudice to any other administrative or judicial remedy, the data subject has the right to lodge a complaint with the Portuguese data protection authority (Comissão Nacional de Proteção de Dados, CNPD), with registered office at Avenida D. Carlos I, 134, 1st floor, 1200-651 Lisbon, through the website www.cnpd.pt, if they consider that the processing of their personal data violates the GDPR or applicable national legislation. 16. Contacts To exercise their rights or clarify any question regarding the processing of their personal data, the Client may contact OnPosture at hello@onposture.com.