5. HOW DOES ONELEAF PROTECT YOUR PERSONAL DATA?
Oneleaf has implemented technical and organizational measures in order to protect your personal data, in
particular against potential data breaches likely to cause, either by accident or unlawfully, the destruction, loss, modification, unauthorized access or divulgation of your personal data. These measures will ensure a level of security adapted to the data and will take into account the state of the art and the cost of implementation in relation to the risks and nature of the data to be protected. However, no data, on the Internet or otherwise, can be guaranteed to be 100% secure. While we strive to protect your information from unauthorized access, use, or disclosure, we cannot and do not warrant the security of your information.
Oneleaf also requires that all members of its personnel and any other person processing your personal data comply with the internal rules and procedures related to the processing of personal data, including the technical and organizational security measures put in place to protect your personal data. In this context, Oneleaf reviews and updates its practices regularly to enhance your privacy and ensure that its internal policies are followed.
If you have found a vulnerability or would like to report a security incident, you may send an email
[email protected]Oneleaf is a provider of online and mobile meditation, hypnosis, mindfulness, sleep and movement content in the health& wellness space and is not a covered entity or a business associate of a covered entity under the Health Insurance Portability and Accountability Act of 1996, and the regulations promulgated thereunder, as amended from time to time (“HIPAA”). As such, HIPAA does not apply to the collection, storage, use, and disclosure of the information you provide to us.
6. FOR HOW LONG ARE YOUR PERSONAL DATA STORED?
As a general rule, your personal data will only be retained for the period necessary for the accomplishment of the purposes for which said data was collected, or as necessary to fulfill legal or regulatory obligations.
In the absence of applicable exceptions:
• all personal data processed in order to provide with Oneleaf’s services (including health data) will be stored until the deletion of your personal account or after two (2) years of inactivity on your personal account; and,
• beyond that, personal data is archived for five (5) years for evidential purposes and for ten (10) years for invoicing data;
• your traffic data will be stored for a period of thirteen (13) months from the connection date.
7. WHAT ARE YOUR RIGHTS REGARDING YOUR PERSONAL DATA?
You have the following rights over your personal data:
• You can request the access to your personal data in order to obtain clear, transparent and understandable information on how Oneleaf processes your personal data and on your rights (as provided in this policy), as well as a copy of your personal data.
• You can request the rectification of your personal data in order to obtain the modification of your personal data if they are obsolete, inaccurate or incomplete.
• You can object to the processing of your personal data when the processing is based on Oneleaf's legitimate interest. Oneleaf will no longer process your personal data unless Oneleaf demonstrates compelling legitimate grounds for the processing which override your interests, rights and freedoms, such as the respect of a legal obligation (e.g. legal obligation involving the retention of documents), or for the establishment, exercise or defense of legal claims.
• You can request the restriction of the processing during a limited period of time, in particular in order to carry out some verifications, where one of the following applies:
• You contest the accuracy of your personal data, the processing of which is thus restricted for the period necessary for Oneleaf to verify the accuracy of such personal data;
• The processing is unlawful and, rather than requesting their deletion, you prefer to restrict their use;
• Oneleaf no longer needs your personal data for the purposes of the processing, but you need them for the establishment, exercise or defense of legal claims;
• You have objected to the processing, which is thus restricted pending the verification of whether the compelling legitimate grounds of Oneleaf may override your interests, rights and freedoms.
• You can withdraw your consent when it has been obtained, without this withdrawal affecting the lawfulness of the processing operations previously carried out.
• You can ask to receive your personal data in a structured, commonly used and machine-readable format and also can request their transmission to another controller where technically feasible. This right is not exercised in all circumstances, it applies only if it fulfills all the following conditions:
• Your request is only related to your personal data (excluding anonymous or third party data);
• Your request does not adversely affect the rights or freedoms of others, in particular those of Oneleaf (including trade secrets or intellectual property);
• The processing is carried out by automated means (paper files are therefore not included);
• The processing is based on consent or the performance of a contract (to check if it is the case, you can see the section 2 of this policy).
• You can request the deletion of your personal data (or right to be forgotten), where one of the following legal grounds applies:
• You object to the processing of your personal data and there are no overriding legitimate reasons justifying to maintain the processing of your personal data (such as an obligation for Oneleaf to keep certain personal data);
• You decide to withdraw your consent on which the processing is based;
• Your personal data are no longer useful for the original purposes for which they were collected or for any other type of processing;
• The use that is made of your data does not comply with the applicable legal or regulatory provisions.
It is specified that the exercise of these rights is based on the legal basis of the processing as indicated in section 2 of this policy, as follows:
