Data Processing Agreement (DPA)

1. Parties and roles

The Customer, a psychologist using the Service, is the controller of their patients' data (the "Data"). Mentaal SASU, with a share capital of €1,000, SIREN 107 464 463, Clermont-Ferrand Trade and Companies Register, whose registered office is at 4 rue Vercingétorix, 63670 La Roche-Blanche, France ("Mentaal") acts as a processor of this Data within the meaning of Article 28 of the GDPR.

For account management, billing, support and usage statistics, Mentaal is a controller under the terms of its privacy policy. Those activities are outside the scope of this DPA.

2. Subject matter and duration

Mentaal processes the Data to provide the Service, as described in Annex 1, for the term of the contract and until the Data is returned or deleted under Section 13.

3. Customer instructions

Mentaal processes the Data only on the Customer's documented instructions. These instructions consist of the Terms, this DPA, and the Customer's settings and actions in the Service.

Mentaal does not use the Data for commercial or advertising purposes, to train artificial intelligence models, or for any purpose other than providing the Service.

If Mentaal believes an instruction infringes applicable data protection law, it will inform the Customer immediately. If European Union or French law requires a processing operation, Mentaal will inform the Customer beforehand unless legally prohibited.

4. Confidentiality

Mentaal ensures that persons authorized to access the Data are bound by a duty of confidentiality. To date, access to production data is restricted to one person, and every access is logged.

5. Security

Mentaal implements the technical and organizational measures described in Annex 2. It may update them without reducing the level of protection.

6. Sub-processors

The Customer gives general authorization for the sub-processors listed in Annex 3. Mentaal will notify the Customer by email at least 30 days before adding or replacing one. The Customer may object on legitimate grounds during that period. Failing agreement, the Customer may terminate the contract without penalty.

Mentaal contractually imposes on each sub-processor obligations equivalent to those of this DPA and remains fully liable for their performance.

7. Location and transfers

The Data is stored exclusively within the European Union or the European Economic Area.

Any transfer outside this area, including remote access, is set out in Annex 3. It relies on an adequacy decision (Article 45 GDPR) or, failing that, on appropriate safeguards (Article 46 GDPR) described in that Annex.

8. Data subject rights

Directly in the Service, the Customer can view a patient's Data, export it as a PDF, edit the patient's identity and notes, and delete a single administration or the patient's entire record.

If a patient contacts Mentaal directly, Mentaal forwards the request to the Customer without delay and does not respond itself unless instructed by the Customer. Mentaal assists the Customer with any request the Customer cannot handle alone.

9. Data breaches

Mentaal notifies the Customer of any personal data breach without undue delay and no later than 48 hours after becoming aware of it, at the email address of the Customer's account. The notice states, where possible, the nature of the breach, the categories and approximate number of people and records concerned, the likely consequences and the measures taken. Information not yet available is provided as soon as possible.

10. Assistance to the Customer

On request, Mentaal provides the Customer with the information needed for a data protection impact assessment, for prior consultation with the supervisory authority and for meeting its security obligations.

11. Audit

Mentaal makes available to the Customer the information needed to demonstrate compliance with this DPA. The Customer, its data protection officer or an independent auditor bound by confidentiality may conduct an audit, on 30 days' written notice and no more than once a year, except following a data breach or at the request of an authority.

An audit may not cover other customers' data. For sub-processors, it is carried out within the limits of their contracts, in particular through the provision of their certificates.

12. Health data hosting

Health data is hosted by a certified host within the meaning of Article L.1111-8 of the French Public Health Code. In accordance with Article R.1111-11 II of that Code, Annex 4 sets out the clauses of the contract between Mentaal and that host.

13. Retention, return and deletion

During the contract, the Data is kept until the Customer deletes it, and the Customer is responsible for setting retention periods suited to their practice. A deletion made in the Service takes effect immediately in production, and backups are overwritten within one year.

The contract ends when the Customer's account is deleted. Canceling a paid subscription does not end it as long as the account exists. Before deleting their account, the Customer can export their Data from the Service or request a full export at contact@mentaal.org.

Deleting the account immediately destroys the Data in production, with no copy kept unless the law requires retention, and backups are overwritten within one year. By deleting their account, the Customer agrees to this destruction. Mentaal confirms it in writing on request.

When Mentaal ends the contract, it informs the Customer, who has 30 days to export their Data before the account is deleted.

Result emails already received by the Customer remain the Customer's sole responsibility.

14. Liability

Each party's liability under this DPA is subject to the Terms, without prejudice to the rights of data subjects under Article 82 of the GDPR.

15. Changes and technical developments

Mentaal notifies the Customer at least 30 days before any material change to this DPA or any technical development affecting the hosting of the Data. Where a development is imposed by law, this period may be shortened as far as the applicable text allows.

16. Final provisions

In the event of a conflict concerning data protection, this DPA prevails over the Terms. It is drawn up in French and translated into English, and the French version prevails. It is governed by French law and subject to the courts designated in the Terms.

Annex 1: description of the processing

• Purpose: sending questionnaires to patients, collecting answers, scoring and delivering the results to the Customer.
• Data subjects: the Customer's patients.
• Data: name or pseudonym entered by the Customer, patient email address, Customer's notes, questionnaire answers, scores and interpretations, sending and completion dates.
• Special category: health data.
• Operations: collection, hosting, score calculation, sending by email, viewing, export and deletion.
• Duration: as set out in Sections 2 and 13.

Annex 2: security measures

• Encryption of communications with HTTPS/TLS.
• Application-level AES-256-GCM encryption of patient names, email addresses and record notes.
• Encryption at rest of the database.
• Data isolation: each access is limited to the account of the practitioner concerned.
• Sign-in by code, with progressive account lockout after repeated failures.
• Error and incident monitoring.
• Regular updates of the application and its dependencies.

Annex 3: sub-processors

Annex 4: hosting contract clauses (Article R.1111-11 of the French Public Health Code)

1. Scope of the certificate, issue and renewal dates: Scalingo SAS (Strasbourg Trade and Companies Register 808 665 483), HDS certificate no. 38436 issued by LNE on September 12, 2025 and valid until September 11, 2028, for all six activities of the framework. Physical infrastructure operated by Outscale (HDS certificate no. 36741-4).
2. Services and expected results for availability, integrity, confidentiality and auditability: provision and maintenance of the platform and database, outsourced backups (full weekly, differential daily), encryption at rest, and an annual internal control report available on request.
3. Hosting locations: data centers located in France (Paris-Pantin and Magny-les-Hameaux), operated by Outscale.
4. Data subject rights, breach notification and audits: Sections 8, 9 and 11.
5. Contact for incidents: contact@mentaal.org.
6. Quality and performance indicators, guaranteed level, measurement frequency and penalties: guaranteed monthly availability of 99.96% (Business plan), measured per calendar billing month. In case of breach, a discount of 5% per hour of unavailability beyond this rate, capped at 50% of the monthly service price.
7. External technical providers: Section 6 and Annex 3.
8. Access control and transfers outside the EU or EEA: Section 7, Annexes 2 and 3. The host undertakes not to access the hosted health data and declares that it gives no access to it from outside the European Economic Area.
9. Changes and technical developments: Section 15.
10. Guarantees and procedures covering a failure of the host: professional liability and cyber-risk insurance maintained for the term of the contract, a business continuity and recovery plan, and a backup site to which the data is replicated.
11. The host is prohibited from using the hosted health data for any purpose other than hosting it.
12. End of hosting and reversibility, including on loss or withdrawal of certification: Section 13. The host guarantees access to backups and to the platform for one month after the end of the contract, and immediately informs Mentaal of any loss of certification.
13. Return of the health data to the controller at the end of the service: Section 13.
14. Destruction of the health data at the end of the service, with no copy kept: Section 13. The host destroys the data no later than 30 days after the end of the reversibility phase, with Mentaal's express authorization, and issues a certificate of destruction on request.
15. Third-country laws to which the host or its sub-processors are subject: the host declares, for itself and for Outscale, no risk of access under foreign legislation.