Version: privacy_policy-en-2026-06-16-8

Last updated: 16 June 2026

Privacy policy

Privacy Policy 28/05/2026

Your participation in the HOLIVIA Platform and your use of the Services provided by HOLIVIA, by each selected Practitioner and, depending on the relevant services, by Workplace Options (“WPO”), involve the processing of your personal data and in particular data relating to your health (“your Data”). Take a few minutes to review this document, we will explain everything to you!

Three data controllers On the HOLIVIA Platform, your data is processed by several distinct data controllers depending on the services used:

• HOLIVIA, within the framework of the services provided through the Platform; • the selected Practitioners with whom you choose to engage; • Workplace Options (“WPO”), HOLIVIA’s partner specialized in Employee Assistance Program (“EAP”) services.

Each acts as an independent data controller for the processing activities carried out within its own systems and for its own service purposes. The processing of your data is necessary for the operation of the proposed services. Otherwise, you will not be able to create a personal account through the HOLIVIA Platform or use these services. THE HOLIVIA PLATFORM DOES NOT ALLOW YOU TO BENEFIT FROM MEDICAL CARE, TELECONSULTATION OR TELECARE SERVICES. IF YOU HAVE ANY DOUBTS, PLEASE CONSULT YOUR REGULAR PHYSICIAN. THE HOLIVIA PLATFORM DOES NOT PROVIDE EMERGENCY SUPPORT. IN CASE OF EMERGENCY, PLEASE CONTACT THE EMERGENCY SERVICES USING THE APPROPRIATE EMERGENCY NUMBER IN YOUR COUNTRY.

For any questions: a data protection officer HOLIVIA has appointed a data protection officer to ensure compliance with the regulations and the rules described in this Privacy Policy and to ensure the effective exercise of your rights. HOLIVIA’s Data Protection Officer is Phase 4 Avocats, certified DPO. For any questions regarding the processing of your data, you may contact them by email at the following address: dpo@holivia.fr.

Why and on what legal basis are your data processed and who has access to it?

  • Your Data processed by HOLIVIA The table below allows you to understand all uses made of your data and the legal basis for these uses, namely what legally authorizes us to process your data. It also indicates whether data relating to your physical or mental health is used and under which legal basis such processing is authorized. Finally, it identifies the recipients of your data, namely the restrictive list of persons or entities to whom your data may be communicated. Legal basis – (Article 6 Processing of health Purpose GDPR) data? Data recipients Management of users’ Performance of the Yes: Self-declared Selected Practitioners; personal accounts General Terms of Use – overall psychological staff members of (Art. 6, 1, b GDPR) health status (stress, authorized technical sleep, self-confidence, service providers accomplishment at (technical account work, meaning, management); relationships, self- authorized HOLIVIA staff esteem, mental members; WPO outside workload), psychological Europe; hosting provider support needs. Explicit consent – (Art. 9, 2, a GDPR) Production of aggregated Allow HOLIVIA to No Staff members of and anonymized improve its services and authorized technical statistics enable its clients to service providers; monitor contract authorized HOLIVIA staff execution and effectively members; third-party

Legal basis – (Article 6 Processing of health Purpose GDPR) data? Data recipients prevent psychosocial funders/customers risks within their (aggregated and organizations. Legitimate anonymized statistics for interest – Art. 6, 1, f monthly reporting) GDPR Sending welcome and Legitimate interest: No Staff members of engagement emails after HOLIVIA’s interest in authorized technical account creation supporting users in the service providers; use of the platform – Art. authorized HOLIVIA staff 6, 1, f GDPR members Secure transmission of Performance of the Yes where transmitted Authorized Workplace requests to Workplace General Terms of Use – information concerns Options (WPO) staff Options (WPO) for (Art. 6, 1, b GDPR) psychological support members; authorized services operated by needs or wellbeing- technical service WPO related data. Explicit providers; authorized consent – (Art. 9, 2, a HOLIVIA staff members GDPR)

  • Your Data processed by each selected Practitioner Legal basis – Article 6 Processing of health Purpose GDPR data? Data recipients Video consultation Consent – (Art. 6, 1, a Yes. Explicit consent – Selected Practitioners; sessions offered to Users GDPR) Art. 9, 2, a GDPR staff members of authorized technical service providers (technical account management); authorized HOLIVIA staff members Management of the Legitimate interest of Yes. Explicit consent – Practitioner providing the appointment booking Practitioners in Art. 9, 2, a GDPR appointment booking service organizing their service; staff members of schedules – (Art. 6, 1, f authorized technical GDPR) service providers (technical account management); authorized HOLIVIA staff members Management of payment Performance of the No Payment system (Stripe). for Services provided by general terms and HOLIVIA does not have the Practitioner to conditions of sale – (Art. access to this Beneficiary Users 6, 1, b GDPR) information
  • Your Data processed by Workplace Options (WPO) For certain countries located outside Europe, psychological support services may be provided directly by Workplace Options (WPO). In addition, certain complementary services are operated by WPO worldwide, including:

• 24/7 helpline support; • Work-Life services; • legal support; • financial support; • coaching and referral services to external resources.

In this context, WPO acts as an independent data controller for processing activities carried out within its own systems and tools.

Legal basis – Article 6 Processing of health Purpose GDPR data? Data recipients Management of Performance of the Yes. Explicit consent – Authorized Workplace psychological support service contract – (Art. 6, Art. 9, 2, a GDPR Options (WPO) staff services operated by 1, b GDPR) members; professionals WPO and counselors involved in the assistance program; authorized technical service providers Management of Legitimate interest of Yes. Explicit consent – Authorized Workplace appointment booking WPO in organizing Art. 9, 2, a GDPR Options (WPO) staff services operated by appointments and members; authorized WPO support services – (Art. 6, technical service 1, f GDPR) providers Management of Work- Performance of the Potentially, depending Authorized Workplace Life services, legal service contract – (Art. 6, on the nature of the Options (WPO) staff support, financial 1, b GDPR) User’s request. Explicit members; authorized support and 24/7 consent – Art. 9, 2, a partners and helpline services GDPR professionals involved in the relevant services Management and Legitimate interest of Yes where information Authorized Workplace monitoring of support WPO in ensuring relates to wellbeing, Options (WPO) staff

Legal basis – Article 6 Processing of health Purpose GDPR data? Data recipients requests within WPO continuity and quality of mental health or support members; authorized information systems services – (Art. 6, 1, f needs assessment. technical service GDPR) Explicit consent – Art. 9, providers 2, a GDPR

For psychological support services provided in Europe, HOLIVIA organizes appointment booking and interactions with psychologists and selected Practitioners. For certain countries located outside Europe, psychological support services may be provided directly by Workplace Options (WPO). In this context, WPO notably manages appointment booking, interactions with professionals, support request monitoring and case management within its own information systems. In order to provide access to services operated by WPO from the HOLIVIA application, certain data may be transmitted between HOLIVIA and WPO through secure application programming interfaces (APIs). For more information regarding data processing activities carried out directly by Workplace Options (WPO), you may consult WPO’s Privacy Policy available at the following address: https://www.workplaceoptions.com/privacy-policy/ Please note that HOLIVIA may produce and publicly disseminate statistics while unconditionally preserving your anonymity, namely aggregated and non-individualized data, for strictly statistical purposes and without any possibility of directly or indirectly identifying you. Please note that your data may also be used for studies, research and evaluations serving the public interest, for the purpose of improving knowledge and patient care, after completion of all formalities required by the competent data protection authority where applicable. For this purpose, you will be informed of each study, research or evaluation conducted using your Data and you will be able to object if you so wish. HOLIVIA guarantees that your data will not be transmitted to any unauthorized third party without your prior explicit consent.

Focus on your consent Certain services provided by HOLIVIA, Practitioners or Workplace Options (WPO) are based on the prior collection of your consent. Without your consent, you will not be able to access these services whether they are provided by HOLIVIA, Practitioners or WPO. Your explicit consent is also required for any use of data relating to your health by HOLIVIA, Practitioners or Workplace Options (WPO). Please note that you may withdraw your consent at any time by contacting: dpo@holivia.fr. Withdrawal of your consent shall not affect the lawfulness of any processing carried out before such withdrawal.

How long is your data retained?

  • As part of the Services provided by HOLIVIA Your Data is retained as long as you are employed by a company that is a client of HOLIVIA. When your name no longer appears on the list provided by your employer (which marks your departure), your account is deactivated and your Data is archived for a period of 3 years. After this period, your Data is permanently anonymized, with only non-identifiable statistical data retained.
  • As part of the Services provided by the Practitioner(s) Your Data is retained by the Practitioner for the entire duration of the contractual relationship between you and the selected Practitioner. After this period, your Data is archived for a period of 3 years and, once archived, only non- identifiable statistical data is retained.
  • As part of the Services provided by Workplace Options (WPO) Data processed directly by WPO is retained for the duration necessary to provide the relevant services, in accordance with applicable regulations and WPO’s internal data retention policies.
  • Your payment data Your payment data is retained only for the duration of the transaction (purchase of sessions). With your explicit consent (checkbox), your payment details may be retained in order to facilitate future payments.

What are your rights regarding your data? In accordance with applicable regulations, you benefit from the following rights: Right to information: you have the right to obtain clear, transparent, understandable and easily accessible information regarding the manner in which HOLIVIA, selected Practitioners and Workplace Options (WPO) use your personal data and regarding your rights. Right of access: you have the right to access the personal data held by HOLIVIA, selected Practitioners and Workplace Options (WPO) concerning you (provided that the request is not manifestly unfounded or excessive, notably because of its repetitive nature), and to obtain a copy thereof. Right of rectification: you have the right to request the rectification of your personal data if inaccurate or outdated and/or to have incomplete data completed. Right to object: you may at any time object to the processing of your personal data for reasons relating to your particular situation where processing is based on legitimate interest. You also benefit from the following rights, which may be exercised under the same conditions: • right to erasure; • right to restriction of processing; • right to data portability; • right to define instructions regarding the retention, erasure and communication of your data after your death; • right to lodge a complaint with the competent data protection authority.

Where processing of your data requires your consent, you have the right to withdraw such consent at any time by email at the following address: dpo@holivia.fr.

These rights may be exercised with HOLIVIA’s Data Protection Officer (DPO) by email at the following address: dpo@holivia.fr. Where your request concerns processing activities carried out directly by Workplace Options (WPO), HOLIVIA may transmit your request to WPO in order to facilitate its processing as quickly as possible.

Data security HOLIVIA implements all security measures necessary to ensure the protection and security of data, particularly against unauthorized third-party access. Within the framework of services operated by Workplace Options (WPO), appropriate technical and organizational measures are also implemented in order to ensure the confidentiality, integrity and security of data exchanged between HOLIVIA and WPO, notably through secure application programming interfaces (APIs). As part of the provision of services operated by WPO, certain data may be transferred outside the European Union. Such transfers are governed in accordance with the General Data Protection Regulation (GDPR), notably through the use of Standard Contractual Clauses approved by the European Commission. Your Data is hosted by a certified health data hosting provider within the meaning of Article L1111-8 of the French Public Health Code.