🛡️ Privacy Policy – NOWA

Last update: December 2025

Your fertility journey is personal. Your privacy is just as important.

At Nowa, we support individuals and couples on their fertility journey with high standards, kindness, and respect for their privacy. The protection of your personal and health data is an absolute priority.

This privacy policy explains how we collect, use, and protect your data in accordance with the General Data Protection Regulation (GDPR) and, where applicable, the Health Insurance Portability and Accountability Act (HIPAA), particularly in the context of certain processing operations carried out using artificial intelligence tools.

1. Who are we?

Name: NOWA.CARE (SASU)

• SIREN: 990 265 647 – RCS Evry
• Share capital: 1,000,000 €
• Headquarters: ZA Courtaboeuf, 7 avenue de Laponie, 91940 Les Ulis, France
• President: Figonia Holding
• Data Protection Officer (DPO):
  Hugo Manoukian – dpo@nowa.care
• General contact:
  support@nowa.care

2. What data do we collect?

a. Data you provide to us directly

• Account information: first name, last name, email address, password. password.
• Profile data: age, gender, country of residence, treatment goals (design, assisted reproductive technology, freezing, etc.).
• Health and fertility data (sensitive data):
  • medical history,
  • biological or imaging tests and results,
  • past or ongoing treatments,
  • data related to the menstrual cycle, male and female fertility,
  • sexual activity, hygiene, and lifestyle, if applicable.
• Imported documents: analyses, medical reports, prescriptions, medical correspondence.
• Data entered into the application: tracking, mood, treatments, personal notes.

Specific data depending on the offers:

• Fertility assessment (with prescription)
  Data required to assess your fertility, verify your eligibility, and compile the file sent to a partner physician, who is the only person authorized to issue a prescription.
• Second medical opinion
  Structured questionnaires, timeline of treatment, medical documents, and questions for the specialist doctor responsible for providing a written opinion, with the option of teleconsultation upon request.
• Assisted Reproductive Technology (ART) abroad (EU)
  Medical information required for referral to partner clinics located exclusively in the European Union (Spain, Portugal), as well as data useful for the preparation and transmission of medical records.
• Billing: country, zip code, billing name.
• Payment: via Stripe. Nowa never stores your bank details.

b. Data collected automatically

• Technical data: IP address, device type, operating system, language, timestamp.
• Application and website usage data.
• Cookies and trackers (see dedicated section).

c. Data received from third parties

Only when necessary for the service and with your explicit consent:

• Partner physicians.
• Examination centers, laboratories, or partner clinics (if you choose to send them your file via Nowa).
• Connected services (Apple HealthKit, Google Fit, etc., with permission).
• Public administrations or agencies, when required by law (e.g., social security).

3. Purposes and legal bases of processing

No medical decisions are made in a fully automated manner. .

Nowa is not a healthcare facility and does not provide medical diagnoses. medical.

4. Artificial intelligence, OCR, and anonymization

Certain medical data and documents can be analyzed using artificial intelligence systems (including via OpenAI), under a Business Associate Agreement (BAA) ensuring HIPAA compliance.

Before any external treatment:

• direct identifiers are removed or reduced as much as possible,
• only data that is strictly necessary is transmitted.

The sole purposes of these processing operations are:

• the structuring of medical information,
• the generation of understandable summaries,
• preparing files related to Nowa offers.

Human supervision is systematically provided.

5. Sharing your data

We do not sell or rent your personal data.

Data may only be shared with:

a. Technical service providers

• OVHcloud (HDS-certified hosting, France)
• OpenAI (AI, under BAA and contractual guarantees)
• Stripe (payment)
• Brevo, WhatsApp (communications)
• Posthog, Google Analytics, Meta, Pinterest (depending on consent)

b. Medical partners (with your explicit consent)

• Partner physicians (prescriptions, second opinions).
• Partner exam centers.
• Partner clinics located exclusively in the European Union (Spain, Portugal).

c. Public authorities

Only when required by law.

Data is primarily hosted within the European Union. No transfers outside the EU are made in connection with PMA offers.

6. Shelf life

7. Your rights

You have the following rights at any time:

• access,
• rectification,
• deletion,
• opposition,
• portability,
• withdrawal of consent.

Contact: support@nowa.care

Response within 30 days maximum.

You may also contact the CNIL.

8. Security

• HDS hosting (OVHcloud, France).
• TLS 1.3 encryption in transit, AES-256 at rest.
• Restricted access, strong authentication.
• Logging and security audits.

9. Minors

Service reserved for adults (18 years and older).

10. Cookies and trackers

Management via consent banner:

• technical
• functional,
• analytical,
• marketing (subject to consent).

11. Updates

This policy may change. Any substantial changes will be subject to notification. The current version is available at www.nowa.care/privacy.