Privacy Policy

Last updated:

  1. ABOUT THIS POLICY

Lime Santé Inc. ("Lime Santé", "we", "us" or "our") takes the protection of your privacy very seriously. That is why this privacy policy (the "Policy") provides you with information on how we collect, use and disclose (collectively, "process", "processed", "processing") your personal information when you use our Emilia Notes platform, an intelligent AI scribe for patients (the " App "), the emilianotes.com  website (the " Website ") and any interaction with an employee, representative or authorized subcontractor of Lime Santé, including by email, telephone, in person or by videoconference. However, this Policy does not apply to third-party content and platforms accessible through our App, including through third-party links or features. These third parties may process your personal information in accordance with their respective privacy policies. We are not responsible for this processing and encourage you to review the policies of these third parties carefully. 

In addition to the other applicable provisions of this Policy, if you reside in the United States, Europe, the United Kingdom or Switzerland, you may benefit from additional rights under European laws, as applicable. You can find additional information regarding these rights in the respective schedules entitled " United States ", "Europe" and " Switzerland "

By accessing our Website or using the App, you acknowledge that you have read this policy and freely, knowingly and specifically consent to the collection, use and disclosure of your personal information as set out below. You may withdraw your consent at any time by changing your preferences in the app settings or by contacting us at the address provided in the " Contact Us " section.

  1. PERSONAL INFORMATION

For the purposes of this policy, " Personal Information " means any information relating to an individual that, directly or indirectly, allows that individual to be identified. Personal Information includes Health Information (as defined below). However, laws applicable in certain jurisdictions, including Canada and Quebec, may not consider business contact information as personal information. In these jurisdictions, Personal Information does not include business contact details, such as your name, title or business coordinates, when used strictly in a professional context. Personal Information also excludes information anonymized or aggregated irreversibly and in accordance with the criteria established by applicable laws and regulations. 

When you use the App and/or the Website, we may collect the following Personal Information:

  • Your contact details such as your last name, first name, email address, mailing address and phone number in order to identify you and correspond with you; 

  • Your connection and usage details for the App such as the date of your registration on the App, your username, your password, your IP address anonymized before processing and storage, information regarding your browser or device used; 

  • Technical information related to your use of our services, such as pages viewed, session duration, your clicks and interactions with our services;

  • Data relating to cookies and identifiers, as described in the " Cookies and other similar tools " section;

  • When you use the App, sound recordings, voice captures or audio files relating to you, as well as the information and metadata associated with them; 

  • When you use the App, health information which encompasses all Personal Information relating to your health, including diagnosis, medical history, test results, treatments, care received and any Personal Information related to your health discussed between your healthcare professional and you during the recording of the consultation (the " Health Information "). 

  • Any other Personal Information that you have provided to us or for which you have consented to disclosure.

  1. HOW DO WE COLLECT YOUR PERSONAL INFORMATION? 

Directly from you

In general, we obtain the Personal Information we need directly from you, for example when you fill out registration forms on the Website or the App, when you communicate with us or when you use the App or the Website. We may also collect your Information directly from you during an audio recording, the processing of audio data and voice exchanges. For more information about audio recordings, please see the " Voice Recording Features " section.

On a legal basis such as your consent

The legal basis for processing your Personal Information is generally consent, unless applicable law provides for another admissible legal basis (for example, to comply with our legal obligations, when necessary to establish, exercise or defend a legal claim or legal proceeding). 

When the processing relates to Health Information, it is only collected and processed with the express, free, informed and specific consent of the individuals concerned. You can withdraw your consent to the processing of your Health Information at any time, in accordance with the terms of this Policy.

Your consent to the processing of your Personal Information will be renewed in each of the following circumstances: (i) when Lime Santé makes a significant change to this Policy, to the terms of use of the App or to the cookie policy. In such a case, Lime Santé will inform you of the nature of the changes made and seek your renewed consent before continuing the processing of your Personal Information; (ii) when a period of twelve (12) months has elapsed since the date you last gave or renewed your consent.

In the absence of renewal of your consent within the timeframes provided above, Lime Santé will cease processing your Personal Information for the purposes requiring your consent, subject to its legal retention obligations and any other applicable legal basis allowing the continuation of the processing.

By a business partner, with your consent

Subject to your consent with third-party partners, such as Third-Party Authentication Services (as defined in the " Third-Party Authentication Services " section), we may collect your Personal Information directly from these third-party partners who may submit any information that you have established with these third parties and that this third party will make available to us, with your consent. 

Refusal of collection and withdrawal of your consent

You have the right, if you wish, to refuse the processing of your Personal Information. You may also, at any time, and subject to reasonable notice and any applicable legal or contractual restrictions, withdraw your consent (where applicable) to the processing of your Personal Information in our possession by contacting us. You should be aware, however, that if you choose not to provide your Personal Information, it may prevent you, for example, from using the App, as this information is essential to access it. You can contact us as indicated in the " Contact Us " section to submit any request in this regard.

  1. WHY DO WE COLLECT AND USE YOUR PERSONAL INFORMATION? 

We only collect Personal Information necessary to achieve the following purposes:

  • Provide access to the App, its features and products;

  • Process transactions and manage billing; 

  • Provide support to users of the App or Website; 

  • Respond to your questions, requests, comments or complaints;

  • Develop new features and products for users;

  • Personalize your experience on the App;

  • Prevent and detect fraud, abuse or suspicious activities;

  • Conduct statistical analysis and market research;

  • Personalize content made available to you on the App;

  • To protect our legal rights and comply with our legal and regulatory obligations; 

  • Any other use for which you have given your consent, including communications through newsletters.

We do not use automated decision-making processes, including profiling, for decisions that produce legal effects concerning you. However, the App relies on artificial intelligence models to transcribe your recordings, generate summaries of your consultations and, where appropriate, translate them. These models do not make any decisions about you or formulate any clinical recommendations. The results generated may contain errors; we invite you to validate them with your healthcare professional. You can obtain clarification on the functioning of these processing activities by contacting us as indicated in the " Contact Us " section. 

  1. WHO DO WE SHARE YOUR PERSONAL INFORMATION WITH?

Lime Santé does not rent or sell any of your Personal Information to third parties and will not share it with third parties without your consent, unless required by law or for the purposes set out above. Lime Santé will only share your Personal Information as follows:

  • With our employees. As part of their work, our employees may need to access your Personal Information, for example when you contact us to request help. Their access is limited to what is necessary to perform their duties.


  • With our strategic partners. Lime Santé may share your Personal Information with its partners, service providers and vendors, including notably Google Cloud Platform (including its Gemini artificial intelligence services), Firebase, Google Analytics, AppsFlyer and Sentry, to the extent that such disclosure is necessary for the purposes listed above. When Lime Santé shares your Personal Information with third parties, it implements reasonable contractual and technical safeguards so that these third parties preserve the confidentiality of all Personal Information they process (to the extent required by applicable laws). 

Our artificial intelligence service provider (Google, through Gemini) processes the content of your recordings solely for the purpose of generating the transcription, summary and, where applicable, translation of your consultation. No account identifier, such as your phone number or UserID, is transmitted to them. This processing generally takes place in your hosting region, as we have configured this service for this purpose. Our provider cannot, however, guarantee that processing will never take place, on very rare occasions, in another country where it operates its infrastructure. In this case, the measures described in the section " Where do we transfer your Personal Information? " apply.

Our other service providers, in particular for analytics and error reporting (Google Analytics, AppsFlyer and Sentry), do not have access to any Health Information and are not able to listen to your consultations or view the summaries generated by the App. In addition, no identifier allowing an individual user to be recognized or tracked is transmitted to them for targeted advertising purposes, as long as your device's privacy preferences are activated. The data communicated to them remains aggregated, anonymized and non-identifiable, with the exception of the email address you may choose to provide voluntarily in the App's feedback form.

Please note that these third parties may be located in countries other than yours, in which case Lime Santé takes appropriate measures, as indicated below in the section " Where do we transfer your Personal Information? "

  • With third parties you have designated. The App may include features allowing you to share your data and results generated by the App with third parties or via external services. You acknowledge that Lime Santé does not control the choice of recipients or the use made of your data and generated results once shared, and cannot be held responsible for the confidentiality, security or use of this information outside of the App. Any sharing via external services is subject to the terms and conditions of those third-party services, and you are responsible for complying with them.

  • When required by law. Lime Santé may share your Personal Information if required by law or if it believes in good faith that such action is necessary to: (a) comply with the law; (b) comply with an order from a competent judicial authority in any jurisdiction; (c) comply with legal proceedings served on Lime Santé; (d) protect and defend the rights or property of Lime Santé; (e) enforce or verify your compliance with any part of the agreements you have entered into with Lime Santé, if applicable; (f) prevent fraud or any other illegal activity perpetrated through the App; or (g) act in urgent circumstances to protect the personal safety of users of the App or the general public.

  • Business transfers. We may share your Personal Information without your authorization when our business requires it (in the case of a merger, acquisition, bankruptcy or sale of assets, for example). In this type of situation, we may also share all or part of your Personal Information with the concerned third party (or its advisors) as part of a due diligence process.

  1. THIRD-PARTY AUTHENTICATION SERVICES

We may offer you the ability to create an account or log in to the App using your credentials from third-party service providers, such as Google, Apple, Facebook or any other provider we may integrate at our discretion (collectively, "Third-Party Authentication Services"). By choosing to authenticate through a Third-Party Authentication Service, you acknowledge and agree that: (i) your use of these services remains governed by the terms of use and privacy policies of those third-party providers, which are independent of this Policy; and (ii) Lime Santé exercises no control over the Third-Party Authentication Services and disclaims all liability as to their availability, operation, security, or any harm arising from their use, malfunction or unavailability, including any harm that may be related to their non-compliance with legislative or regulatory requirements regarding the protection of Personal Information or Health Information.

  1. WHERE DO WE TRANSFER YOUR PERSONAL INFORMATION?

The Personal Information we collect is stored in secure systems that may be hosted in Canada, or in the United States for UserIDs and phone numbers, which may constitute servers located outside your jurisdiction of residence. We may also use the services of agents and service providers who may be located outside Canada. However, we strive to protect the Personal Information under our control, including Personal Information entrusted to an agent or service provider, whether located in Canada or in other jurisdictions or countries. In particular, we strive to limit their access to Personal Information to what is necessary to perform their assigned functions. These providers must also maintain internationally recognized privacy certifications, such as ISO 27001 certification or any other equivalent certification. Please note that we also implement contractual agreements, such as data processing agreements, with these agents and service providers to guarantee the confidentiality and security of your Personal Information and that we conduct privacy impact assessments before these transfers in accordance with applicable legal requirements. This may include implementing robust and effective security measures. If you have further questions on this subject, you can contact us as indicated in the " Contact Us " section.

  1. HOW DO WE PROTECT YOUR PERSONAL INFORMATION? 

With necessary and appropriate security measures

We strive to apply the necessary and appropriate security measures and policies, based on the sensitivity of the information, to guarantee the confidentiality of Personal Information in our possession or custody, including without limitation conducting privacy impact assessments for the processing of Health Information. In doing so, we follow generally accepted industry standards. Personal Information under our control is therefore only accessible to persons who have the right to access it, who are bound by confidentiality agreements, and who only consult it when necessary for the performance of their duties. Appropriate physical, technical and administrative security and protection measures have been implemented and are maintained to minimize the risk of incidents. These measures include, for example, restricted access to premises and Personal Information, encryption of data in transit and at rest; access and permissions management; activity logging; security incident response protocols; maintenance of internationally recognized privacy certifications; notification in the event of a confidentiality incident, in accordance with applicable laws. The security mechanisms of the App are subject to regular checks, including penetration testing. IP addresses are anonymized before any processing, no UserID, DeviceID, or identifier allowing you to be recognized or allowing analytical data to be linked to your profile or your Health Information is transmitted to analytical platforms, and the data transmitted remains strictly aggregated and non-identifiable, and does not allow a user to be identified or an analytical session to be linked to a medical consultation.

Lime Santé is committed to promptly correcting any identified vulnerability. It should be noted, however, that no method of transmission over the Internet or method of electronic storage is completely secure or error-free. Although we implement rigorous security measures to protect your Personal Information, no data transmission or storage system is entirely infallible. We are committed, however, to doing everything reasonably possible to ensure the protection of your information. You acknowledge that the security of online transactions and the security of communications sent electronically or by mail cannot be guaranteed. You provide information to us via the Internet or by mail at your own risk. We encourage you to exercise caution when using the Internet.

Payment Information

The financial information you provide at the time of payment is that required by our payment solutions partner. This information is processed separately by an encrypted payment module, in accordance with security and encryption standards in force in the payment industry (for example, the PCI SSL standard). No information related to your payment card is collected or kept by Lime Santé. 

Children's Privacy

Lime Santé does not knowingly process Personal Information of minors under sixteen (16) years of age, without the prior and explicit consent of the holder of parental authority or legal guardian. If you believe that Personal Information has been collected from minors under sixteen (16) years of age without the necessary consents, you can contact Lime Santé as indicated in the " Contact Us " section.

If you believe that your Personal Information has been compromised, we invite you to contact our privacy officer in accordance with the " Contact Us " section.

Respecting your device's privacy preferences

Lime Santé automatically respects the privacy settings you have configured in your mobile device, for example the "do not track" feature. If one of these settings is enabled, data collection is automatically restricted only to technical data essential for error diagnosis and measuring application performance. No data related to marketing or personalization of communications is then collected.

Security incident management

In the event of unauthorized, actual or suspected access to confidential information or systems of the App, Lime Santé will implement a formal process aimed at containing, analyzing, correcting and documenting the incident, in compliance with applicable laws. When Lime Santé determines that unauthorized access has occurred, it undertakes to promptly notify you if you are affected by the unauthorized access or likely to suffer harm therefrom. Following the discovery of any unauthorized access, Lime Santé undertakes to immediately take measures to: (i) terminate the unauthorized access; (ii) manage and mitigate the repercussions of the unauthorized access; and (iii) develop a strategy to prevent unauthorized access in similar circumstances.

  1. RETENTION AND DESTRUCTION

Your Personal Information will only be retained for the duration necessary to fulfill the purposes for which it was collected, or in accordance with the legitimate interests of Lime Santé, or to comply with applicable legal, tax or regulatory requirements. At the end of this period, we will strive to destroy or anonymize this information. Original data captured through the App, namely Audio Files (as defined below), are deleted after a maximum period of twenty-four (24) hours following their collection. 

To determine the appropriate retention period for your Personal Information, we consider the amount, nature and sensitivity of the Personal Information concerned, the potential risk of harm resulting from unauthorized use or disclosure of your Personal Information, the purposes for which we process your Personal Information and the possibility of achieving those purposes through other means, as well as any applicable legal, tax or regulatory requirements. 

  1. WHAT ARE YOUR RIGHTS?

Depending on the applicable legislation, you may have certain rights regarding your Personal Information, such as the right to the portability of your Personal Information, the right to access or rectify your Personal Information, and the right to withdraw your consent (where applicable). To exercise any of these rights (to the extent they are available), please contact us by writing to the address indicated in the " Contact Us " section. 

In addition, you may file a complaint with Lime Santé's privacy officer if you are not satisfied with how we handle your Personal Information or our compliance with this policy. The law also authorizes you to file a complaint with a privacy commissioner or any other competent supervisory authority regarding the protection of Personal Information. 

  1. COOKIES AND OTHER SIMILAR TOOLS

A cookie is a small text file that is stored in a dedicated location on your computer, mobile device, tablet or other device when you use your browser to visit an online service. Other tracking technologies, such as web beacons and tracking pixels, may be used for similar purposes. In this policy, all such tracking technologies are collectively referred to as "cookies". All Personal Information collected through the use of cookies by or on behalf of Lime Santé is treated with the same level of confidentiality as any other Personal Information held by Lime Santé.

Please consult our Cookie Policy to be informed of any collection and use of your Personal Information through cookies, available at: https://emilianotes.com/politique-de-cookies. 

  1. VOICE RECORDING FEATURES

Lime Santé, acting as a service provider, may, through the App, provide audio recording, artificial intelligence transcription and transcription outlining features for your consultation tracking, conversation or voice communication needs, including with your healthcare professional (collectively referred to as " Voice Recording Features "). When you use the Voice Recording Features, it is possible, depending on the case, that sensitive Personal Information may be processed, including your voice, Health Information or any other information you may communicate when using the Voice Recording Features. Lime Santé does not collect any Personal Information arising from the Voice Recording Features without first obtaining your explicit, informed, specific and time-limited consent.

For the sake of transparency, you are always informed, by means of a visual and/or sound indicator, of the activation of the Voice Recording Features. In addition, before proceeding with the Voice Recording Features, you must ensure that you have obtained the consent of any person whose voice or personal information is likely to be captured during the recording. In the absence of such consent, you must not use the Voice Recording Features. Lime Santé disclaims all liability with respect to Voice Recording Features performed without the consent of the individuals concerned.

You can at any time refuse collection by Voice Recording Feature and request an alternative method for entering your information.

In all cases, Lime Santé will only retain the original Audio Files for a maximum duration of twenty-four (24) hours. You can request the deletion of specific segments of Audio Files by sending a written request to [email protected]. Lime Santé will strive to respond to these requests within a reasonable timeframe, subject to legal retention obligations and technical limitations. For the purposes hereof, an "Audio File" means any data consisting of sound or voice content, including in particular any recording made by means of the Voice Recording Feature, which is transmitted, provided or stored in digital format as part of the use of the App, by yourself or on your behalf.

Please note that we do not use Personal Information obtained using the Voice Recording Features for training, refining or developing artificial intelligence models, without your consent. 

  1. CONTACT US

You can contact us to exercise your rights or if you have questions about our practices, procedures and policies regarding the protection of Personal Information. You can also contact us if you need help exercising or understanding your choices regarding the protection of your Personal Information. We will inform individuals who make inquiries or file complaints of the existence of the relevant procedures. Lime Santé will investigate all complaints. If a complaint is found to be justified, we will take appropriate measures, including, if necessary, amending our policies and practices. Please feel free to contact us with any questions, inquiries, comments or complaints regarding your Personal Information. 

The person responsible for ensuring compliance with and implementation of this policy, including handling rights and complaints, is our privacy officer, whose contact details are as follows: 

Privacy Officer

Lime Santé Inc.

Jonathan Santerre

212 du Grand-Hunier, Saint-Augustin-De-Desmaures, 

Quebec, G3A 2J2, Canada 

[email protected]

1-877-503-LIME

  1. AMENDMENTS TO THIS PRIVACY POLICY

We reserve the right to modify this policy at any time. We therefore encourage you to consult it regularly. Changes to this policy will be published on our App and on our Website in the form of an updated policy and will take effect upon publication. If we make material changes to this policy, we will notify you by publishing a notice on our App, our Website or by email. However, in all other cases, the publication of a new version of the policy on our App and on our Website or your continued use of the App or Website will be sufficient to inform you of the changes made to the policy and to obtain your consent to them.


SCHEDULE 1 – UNITED STATES

This schedule applies only to the collection and processing of "personal information" within the meaning of United States laws. By this term, we mean any personal information relating to an individual located in the United States, including California, whether a citizen of that country or not. This section concerns you if you are located in the United States. It does not apply if you are outside the United States, even if you are a United States citizen. It is current as of Apr. 15, 2026

1. What personal information is collected?

Although our processing of personal information varies depending on our relationship and interactions with you, we describe in this section, in a general manner, how we have collected and disclosed personal information during the twelve (12) months preceding the last update of this Schedule. For more information, please see the sections "Personal Information", "How do we collect your Personal Information?" and "Why do we collect and use Personal Information?". We identify below the categories of personal information (as defined by applicable United States laws) that we collect about United States residents.

Identifiers: include direct identifiers, such as name, username, account number or unique personal identifier; email address, phone number, address and other contact details; IP address before its anonymization and other online identifiers.

User Accounts: include personal information, such as name, account name, contact details, professional information, account number and financial or billing information, that individuals provide to us to access our App.  

Commercial information: includes records of products or services purchased, obtained or considered, or other purchasing or usage histories or tendencies.

Usage data: includes browsing history, clickstream data, search history, access logs and other usage data and information concerning interaction with our App and our Website, our marketing emails and our online advertisements.

Sensitive personal information: includes personal information relating to your health, your diagnoses, your medical history, your test results, treatments, care you have received.

2. Is your personal information sold?

In accordance with United States personal information protection laws, your Personal Information will never be sold to third parties.

Our Website and App are not directed to minors, and we do not knowingly collect, let alone sell, any personal information from minors under sixteen (16) years of age through our websites. However, if the parent or guardian of a minor under sixteen (16) years of age believes that the minor has provided us with personal information without the prior and explicit consent of the parental authority holder or legal guardian, they must contact us at [email protected] to request the deletion of this information from our files.

3. Your rights 

Under United States laws, you may have certain rights related to your personal information, including the rights below. To exercise them, please contact us at [email protected].

Access: you have the right to request, in accordance with applicable laws, that we disclose to you the personal information we have collected, used, shared and sold (if applicable) about you during the past twelve (12) months. You can request information preceding this period and we are required to provide it to you, provided that obtaining it is possible and does not require disproportionate effort. 

Deletion: you have the right to request that we delete certain personal information we have collected about you. 

Opt-out of sale or sharing: you have the right to opt-out of the sale or sharing of your personal information. 

Request for transparency (or Shine the Light): you may also have the right to request that we provide you with (i) a list of certain categories of personal information that we have disclosed to third parties for direct marketing purposes during the preceding calendar year and (ii) the identity of those third parties.

Correction of inaccurate personal information: you have the right to request that we correct any inaccurate personal information, taking into account the nature of the personal information and the purposes of processing the personal information. We will do everything possible, within reason, to correct inaccurate personal information in accordance with your instructions, in accordance with applicable United States laws.

Freedom from discrimination: you have the right not to be discriminated against in connection with the exercise of your rights.

4. Hosting of your personal information

Personal information of users located in the United States, including Health Information within the meaning of this Policy, is hosted on servers in Canada or the United States, for UserIDs and phone numbers. 

As part of the operation and maintenance of the App, certain personal information may be accessed from Canada by authorized Lime Santé personnel. This right of consultation is governed by appropriate contractual, technical and organizational measures, in accordance with applicable United States personal information protection laws. 

In any event, Lime Santé undertakes that no health data will be transferred or hosted outside of Canada without the explicit consent of the individual concerned and without the implementation of appropriate safeguards in accordance with applicable laws.

5. Anonymous visit to the Website

Users of the Website can visit our Website anonymously.  

Our link to the "Privacy Policy" page includes the word "Privacy" and can be easily found on the page specified above. You will be notified of any changes to this Policy on our Privacy Policy page.  

You can modify your personal information: 

  • By sending us an email;

  • By calling us.

6. How does our Website handle "do not track" signals?

We honor "Do Not Track" signals, we do not plant cookies and we do not use advertising when a "Do Not Track" browser mechanism is in place.

7. Does our Website allow behavioral tracking by third parties?

No. It is also important to note that we do not allow behavioral tracking by third parties.

8. Fair Information Practices

The Fair Information Practice Principles form the backbone of privacy law in the United States and the concepts they include have played a significant role in the development of data protection laws around the globe. Understanding the Fair Information Practice Principles and how they should be implemented is critical to comply with the various privacy laws that protect Personal Information.  

In order to be in line with Fair Information Practices, we will take responsive action. In the event of a breach of your personal information, we will notify you in writing, including by email or by notice on the App, as promptly as possible and without unreasonable delay following the breach.   

We also agree to the Individual Redress Principle which requires that individuals have the right to legally pursue enforceable rights against data collectors and processors who fail to adhere to the law. This principle requires not only that individuals have enforceable rights against data users, but also that they have recourse to courts or government agencies to prosecute and/or investigate non-compliance by data processors.


SCHEDULE 2 – EUROPE 

This schedule applies only to the collection and processing of "personal data" of the European Union ("EU"). By this term, we mean any personal information relating to an individual located in the EU, whether a citizen of a member country or not. This section concerns you if you are located in an EU country. It does not apply if you are outside the EU, even if you are a citizen of a member State.

For the purposes of this schedule, the term "processing" has the meaning given by the General Data Protection Regulation (the "GDPR") and includes any operation or set of operations performed on EU personal data, such as: collection, recording, organization, structuring, retention, adaptation or modification, extraction, consultation, use, disclosure by transmission, dissemination or otherwise making available, alignment or combination, restriction, erasure or destruction.

The EU personal data we process may come directly from you, from a third party (for example, our European partners) or result from your use of our services.

We process this data in accordance with this schedule and our Policy. In the event of a discrepancy between this schedule and other sections of the Policy regarding the processing of EU personal data, this schedule shall prevail. It is current as of Apr. 15, 2026

1. GDPR Principles

All personal data will be:

  • Processed lawfully, transparently and fairly;

  • Collected only for the purposes identified in the Policy or for any other agreed purpose, without further processing incompatible with those purposes;

  • Adequate, relevant and limited to what is necessary in relation to the purposes pursued;

  • Kept up to date in accordance with the "How do we protect your Personal Information?" section of the Policy;

  • Retained in a form permitting identification only for the duration necessary for the intended purposes;

  • Stored and processed securely to prevent unauthorized access, loss, damage or accidental disclosure, in accordance with the Policy.

2. Legal Bases for Processing

We collect and process personal data only if we have a legal basis, including:

  • Your consent;

  • The necessity of the processing to perform a contract with you (for example, providing requested services);

  • The necessity of the processing for the "legitimate interests" of Lime Santé, provided that these interests do not override your rights and freedoms. Certain legitimate interests are specified in the section "Why do we collect and use Personal Information?" of the Policy.

Where we rely on your consent, you may withdraw, limit or refuse it at any time. Where we invoke a legitimate interest, you may object to it. For any questions regarding legal bases, see the "What are your rights?" section of the Policy.

We do not use automated decision-making, including profiling, for decisions producing legal effects concerning you.

3. Rights of Data Subjects

In addition to the rights provided by the Policy, you have the following rights regarding your personal data:

  • Access and Portability: you can request a copy of your data (as well as any information provided for under Article 15 of the GDPR) and obtain this data in a structured, commonly used and machine-readable format, including for transfer to a third party.

  • Restriction and Objection: you can request the restriction or stopping of the processing of your data, particularly if you believe its processing is unlawful or if it is used for direct marketing purposes.

4. Responsibilities as Data Controller

In general, we act as the "data controller" for personal data. In this capacity, we:

  • Explain, in the Policy, how we collect, store, disclose and process this data;

  • Appoint processors only under agreements compliant with the GDPR;

  • Maintain a record of processing activities when required;

  • Cooperate with competent authorities;

  • Implement appropriate technical and organizational measures to protect data and report any breaches in accordance with the "How do we protect your Personal Information?" section of the Policy.

5. Disclosure to Third Parties

If we must disclose your data to third parties (including processors), we require them to comply with the GDPR. In the event of a transfer outside the EU, this will be carried out as part of the legal execution of our services.

6. Hosting of Personal Data

Personal data of users located in the EU, including Health Information within the meaning of this Policy, is hosted on servers located in Belgium, with the exception of UserIDs and phone numbers which are hosted in the United States. However, as part of the operation and maintenance of the App, certain personal data may be accessed remotely from Canada by authorized Lime Santé personnel. These hosting and consultation rights are governed by appropriate contractual, technical and organizational measures, and rely in particular on the adequacy decisions rendered by the European Commission with respect to Canada and the United States, recognizing a sufficient level of protection within the meaning of the GDPR. In any event, Lime Santé undertakes that no health data will be transferred or hosted outside of Belgium without the explicit consent of the individual concerned and without the implementation of appropriate safeguards in accordance with Articles 46 et seq. of the GDPR.

7. Consent to Transfer

By accepting this Policy, you consent to the transfer of your personal data to third parties located outside the EU. You acknowledge that we are not responsible for compliance by these third parties with their obligations under the GDPR.

For any comments, questions or complaints regarding the processing of your personal data, or to exercise your rights, please use the contact details indicated in the "Contact Us" section of the Policy. Your requests will be processed in accordance with the "What are your rights?" section.

8. European Representatives

You can also use the contact details of our representative in Europe: 

Contact details of the European representative

EDPO

Avenue Huart Hamoir 71, 

1030 Schaerbeek, Belgium 

Online form available at: https://edpo.com/gdpr-data-request/


SCHEDULE 3 - UNITED KINGDOM 

This schedule applies only to the collection and processing of "personal data" of the United Kingdom ("UK"). By this term, we mean any personal information relating to an individual located in the UK, whether a citizen or not. This section concerns you if you are located in the UK. It does not apply if you are outside the UK, even if you are a UK citizen.

For the purposes of this schedule, the term "processing" has the meaning given by the United Kingdom General Data Protection Regulation (the "UK GDPR") and the Data Protection Act 2018 (the "DPA 2018"), and includes any operation or set of operations performed on UK personal data, such as: collection, recording, organization, structuring, retention, adaptation or modification, extraction, consultation, use, disclosure by transmission, dissemination or otherwise making available, alignment or combination, restriction, erasure or destruction.

The UK personal data we process may come directly from you, from a third party (for example, our European partners) or result from your use of our services.

We process this data in accordance with this schedule and our Policy. In the event of a discrepancy between this schedule and other sections of the Policy regarding the processing of UK personal data, this schedule shall prevail. It is current as of May 11, 2026.

1. GDPR Principles

All personal data will be:

  • Processed lawfully, transparently and fairly;

  • Collected only for the purposes identified in the Policy or for any other agreed purpose, without further processing incompatible with those purposes;

  • Adequate, relevant and limited to what is necessary in relation to the purposes pursued;

  • Kept up to date in accordance with the "How do we protect your Personal Information?" section of the Policy;

  • Retained in a form permitting identification only for the duration necessary for the intended purposes;

  • Stored and processed securely to prevent unauthorized access, loss, damage or accidental disclosure, in accordance with the Policy.

2. Legal Bases for Processing

We collect and process personal data only if we have a legal basis, including:

  • Your consent;

  • The necessity of the processing to perform a contract with you (for example, providing requested services);

  • The necessity of the processing for the "legitimate interests" of Lime Santé, provided that these interests do not override your rights and freedoms. Certain legitimate interests are specified in the section "Why do we collect and use Personal Information?" of the Policy.

Where we rely on your consent, you may withdraw, limit or refuse it at any time. Where we invoke a legitimate interest, you may object to it. For any questions regarding legal bases, see the section "What are your rights?" of the Policy.

We do not use automated decision-making, including profiling, for decisions producing legal effects concerning you.

3. Rights of Data Subjects

In addition to the rights provided by the Policy, you have the following rights regarding your personal data:

  • Access and Portability: you can request a copy of your data (as well as any information provided for under Article 15 of the UK GDPR) and obtain this data in a structured, commonly used and machine-readable format, including for transfer to a third party.

  • Restriction and Objection: you can request the restriction or stopping of the processing of your data, particularly if you believe its processing is unlawful or if it is used for direct marketing purposes.

4. Responsibilities as Data Controller

In general, we act as the "data controller" for personal data. In this capacity, we:

  • Explain, in the Policy, how we collect, store, disclose and process this data;

  • Appoint processors only under agreements compliant with the GDPR;

  • Maintain a record of processing activities when required;

  • Cooperate with competent authorities;

  • Implement appropriate technical and organizational measures to protect data and report any breaches in accordance with the section "How do we protect your Personal Information?" of the Policy.

5. Disclosure to Third Parties

If we must disclose your data to third parties (including processors), we require them to comply with the UK GDPR and the DPA 2018. In the event of a transfer outside the UK, this will be carried out as part of the legal execution of our services.

6. Hosting of Personal Data

Personal data of users located in the UK, including Health Information within the meaning of this Policy, is hosted exclusively on servers located in Belgium, with the exception of UserIDs and phone numbers which are hosted in the United States. However, as part of the operation and maintenance of the App, certain personal data may be accessed remotely from Canada by authorized Lime Santé personnel. These hosting and consultation rights are governed by appropriate contractual, technical and organizational measures, and rely in particular on the adequacy decisions rendered by the UK Secretary of State with respect to Canada, Belgium and the United States, recognizing a sufficient level of protection within the meaning of the UK GDPR. In any event, Lime Santé undertakes that no health data will be transferred or hosted outside of Belgium without the explicit consent of the individual concerned and without the implementation of appropriate safeguards in accordance with Articles 44 et seq. of the UK GDPR.

7. Consent to Transfer

By accepting this Policy, you consent to the transfer of your personal data to third parties located outside the UK. You acknowledge that we are not responsible for compliance by these third parties with their obligations under the UK GDPR.

For any comments, questions or complaints regarding the processing of your personal data, or to exercise your rights, please use the contact details indicated in the "Contact Us" section of the Policy. Your requests will be processed in accordance with the section "What are your rights?".

8. DPO Representative

To learn more about Lime Santé's privacy practices or to request access, correction or deletion of your personal information, please contact Jonathan Santerre by email at [email protected] or by toll-free telephone at 1 877 503-LIME.


SCHEDULE 4 – SWITZERLAND 

This schedule applies only to the collection and processing of "personal data" of Switzerland. By this term, we mean any personal information relating to an individual located in Switzerland, whether a citizen of Switzerland or not. It does not apply if you are outside Switzerland, even if you are a Swiss citizen. 

For the purposes of this schedule, the term "processing" has the meaning given by the Federal Act on Data Protection (FADP) and includes any operation or set of operations performed on Swiss personal data, including: the collection, recording, storage, use, modification, disclosure, archiving, erasure or destruction of data.

The Swiss personal data we process may come directly from you, from a third party (for example, our Swiss partners) or result from your use of our services.

We process this data in accordance with this schedule and our Policy. In the event of a discrepancy between this schedule and other sections of the Policy regarding the processing of personal data, this schedule shall prevail. It is current as of Apr. 15, 2026.

1. FADP Principles

All personal data will be:

  • Processed lawfully, transparently and fairly;

  • Collected only for the purposes identified in the Policy or for any other agreed purpose, without further processing incompatible with those purposes;

  • Adequate, relevant and limited to what is necessary in relation to the purposes pursued;

  • Kept up to date in accordance with the "How do we protect your Personal Information?" section of the Policy;

  • Retained in a form permitting identification only for the duration necessary for the intended purposes;

  • Stored and processed securely to prevent unauthorized access, loss, damage or accidental disclosure, in accordance with the Policy.

We do not use automated decision-making, including profiling, for decisions producing legal effects concerning you.

2. Rights of Data Subjects

In addition to the rights provided by the Policy, you have the following rights regarding your Swiss personal data:

  • Access and Portability: you can request a copy of your data (as well as any information provided for under Article 25 of the FADP) and obtain this data in a structured, commonly used and machine-readable format, including for transfer to a third party.

  • Restriction and Objection: you can request the restriction or stopping of the processing of your data, particularly if you believe its processing is unlawful or if it is used for direct marketing purposes.

3. Responsibilities as Data Controller

In general, we act as the "data controller" for personal data. In this capacity, we:

  • Explain, in the policy, how we collect, store, disclose and process this data;

  • Appoint processors only under agreements compliant with the FADP;

  • Maintain a record of processing activities when required;

  • Cooperate with competent authorities;

  • Implement appropriate technical and organizational measures to protect data and report any breaches in accordance with the "How do we protect your Personal Information" section of the Policy.

4. Disclosure to Third Parties

If we must disclose your data to third parties (including processors), we require them to comply with the FADP. In the event of a transfer outside Switzerland, this will be carried out as part of the legal execution of our services.

5. Hosting of Personal Data

Personal data of users located in Switzerland, including Health Information within the meaning of this Policy, is hosted exclusively on servers located in the territory of Belgium, with the exception of UserIDs and phone numbers which are hosted in the United States. However, as part of the operation and maintenance of the App, certain personal data may be accessed remotely from Canada by authorized Lime Santé personnel. These hosting and consultation rights are governed by appropriate contractual, technical and organizational measures, and rely in particular on the adequacy decisions rendered by the Swiss Federal Council with respect to Canada, Belgium and the United States, recognizing a sufficient level of protection within the meaning of the FADP. In any event, Lime Santé undertakes that no health data will be transferred or hosted outside of Belgium without the explicit consent of the individual concerned and without the implementation of appropriate safeguards in accordance with Articles 16 et seq. of the FADP.

6. Consent to Transfer

By accepting this Policy, you consent to the transfer of your personal data to third parties located outside Switzerland. You acknowledge that we are not responsible for compliance by these third parties with their obligations under the FADP.

For any questions, comments or complaints regarding the processing of your personal data, or to exercise your rights, please use the contact details indicated in the "Contact Us" section of the Policy. Your requests will be processed in accordance with the "What are your rights?" section.

7. DPO Representative

To learn more about Lime Santé's privacy practices or to request access, correction or deletion of your personal information, please contact Jonathan Santerre by email at [email protected] or by toll-free telephone at 1 877 503-LIME.