PRIVACY POLICY OF THE SEMIO APPLICATION

Version: 3.2.0 — Last updated: 2026-10-12.

1. DATA CONTROLLER

The Semio application is published by LA TOUR DE BABEL CORPORATION ("LTB SARL"), a limited liability company governed by Cameroonian law (the "Publisher"), controller of the processing of personal data.
Contact and exercise of rights: semio.ltdb@gmail.com. Further company identification details are provided on request.

2. NATURE OF THE APPLICATION

Semio is an educational training tool, including a medical observation simulator for clinical-reasoning practice. It is neither a medical device, nor an electronic health record, nor a care tool. The User undertakes to enter only training, fictitious, or duly anonymized data, and never data identifying a real patient.

3. DATA PROCESSED

3.1. User data. Email address and account identifier required for authentication; first name, last name, and sex, provided when the profile is created; where applicable, date of birth, professional role, specialty, and affiliated institution. This data identifies the User, not a patient.

3.2. Observation content (form). The content of training cases entered by the User in the observation form: complaint, history, background, examination, additional tests, hypotheses, treatments, and monitoring parameters, including images. Such content may constitute health data, a special category within the meaning of Article 9 of Regulation (EU) 2016/679 ("GDPR"), and is treated as such. Before any transmission to a server, an AI service, or remote storage, this content is anonymized on the User's device, an application check blocking transmission where an identifying field is present.

3.3. Messages and images sent to the conversational assistant. When the User uses the assistant, the message text and, depending on the selected feature, filtered recent history, relevant document context, or attached educational image are transmitted to the Publisher's servers and then to the providers identified in Article 8 to produce the response. For image analysis, only the current message and image are transmitted. These contents are not anonymized on the device. A text filter blocks some identifiers, but it does not guarantee anonymization and cannot remove identifying details visible in an image. Sending patient photographs, recognizable faces, named documents, or any image containing a real identifier is strictly prohibited. Before sending an image, the Application re-encodes it, reduces its dimensions, and removes EXIF metadata; this does not conceal information that remains visible in the pixels. The Publisher's server does not retain the image file after processing the turn. Any retention by the external provider is governed by its terms and applicable contractual safeguards. A temporary textual copy of the conversation may be retained on the server for no more than two hours to ensure session continuity.

3.3 bis. Web and image search. In automatic mode, the model decides whether a search is useful; enabling the globe forces a search for the next message only. A search query derived from the message may be shared by DeepSeek with its own search-service providers. When illustrations are useful, a separate query is sent to Openverse; the Application receives links, titles, creators, and licence information and may load a thumbnail from a third-party domain, which then receives ordinary network-request data, including the IP address. Licence information is provided as an indication and must be verified on the source page before reuse.

3.4. AI-generated outputs. Summaries, hypotheses, and suggestions produced for learning purposes, with no diagnostic or prescription value.

3.5. Voice recordings. When the User uses dictation, an audio recording is captured and then transmitted to a voice-recognition provider, for the sole purpose of its transcription into text. The recording passes through the Publisher's servers in memory only and is not retained there beyond transcription.

3.6. Technical, security, and device data. User identifier, notification token, timestamps, synchronization status, account sign-in history, as well as technical and security logs including the IP address, from which an approximate country may be derived for the purpose of applying regional restrictions. These logs serve the security of the Service, abuse prevention, and technical diagnostics; the Publisher strives to minimize the presence of conversation content in them. Usage logs of the AI features (volumes and costs, linked to a pseudonymized identifier) are also kept for credit-management and security purposes.

3.7. Biometric unlock data. Biometric unlocking is handled by the device operating system. No biometric data is transmitted to the Publisher or stored on its servers; it remains on the device.

3.8. Permissions. The Application may request access to the camera and gallery, microphone, notifications, and biometrics. These permissions are optional and enabled on the User's request. For the chatbot, only the image taken or selected by the User is prepared and transmitted; the Application does not browse the remainder of the photo library.

4. PURPOSES AND LEGAL BASES

4.1. Operation of the Application and account management: performance of the contract with the User (Article 6.1.b GDPR).

4.2. Processing of content constituting health data: the User's explicit consent (Articles 6.1.a and 9.2.a GDPR), obtained separately and revocable at any time. The Publisher does not rely on the "health care" basis of Article 9.2.h, the Application being an educational tool.

4.3. Improvement and security of the Service, abuse prevention: the Publisher's legitimate interest (Article 6.1.f GDPR), respecting the User's rights.

The Publisher does not use data for advertising, commercial profiling, resale, or training its own models. However, under DeepSeek's public terms, de-identified Inputs and Outputs may be used to improve its services when the relevant account opt-out is not enabled or no contrary contractual commitment applies. The image-analysis feature is available in production builds, except for Users located in the European Union, the United Kingdom, and the United States, for whom it remains disabled and is refused by the Publisher's server. Users who rely on it are informed that the image may be used by DeepSeek under the conditions described in this article.

5. STORAGE AND SECURITY

5.1. Local storage. Data is stored primarily on the User's device. Sensitive observation content is encrypted there using an AES-256-GCM algorithm, the key being kept in the device's hardware secure component.

5.2. Remote storage. For Users located outside the regulated regions referred to in Article 7, where the User enables cloud saving, the clinical content of cases and associated photographs are transmitted to and retained on the Publisher's (SEMIO) servers, hosted on DigitalOcean cloud infrastructure. Patient identification data (name, date of birth, address, telephone, file number and other identity fields) is encrypted on the device, before any transmission, with a key that only the User holds through their vault password: the Publisher stores it without being able to read it. Only age, sex and gravidity/parity remain readable. The vault password is mandatory to enable cloud saving; if it is forgotten, this identification data can no longer be read on a new device. Clinical content is protected by encryption at rest, strict per-account partitioning, authentication-based access control, and access logging. Transmissions are encrypted in transit using TLS.

5.2 bis. Conversational assistant history. So that the User can retrieve conversations on another device signed in to the same account, the assistant history is saved on the Publisher's servers, encrypted (AES-256-GCM) with an account-specific key. This key is held in escrow by the Publisher so that signing in is sufficient to restore the history; the Publisher is therefore technically able to access these conversations and undertakes not to use them for any purpose other than providing the service, security, or compliance with a legal obligation. The history is retained until deleted by the User or until account deletion, which also erases the key.

5.3. Security measures. The Publisher implements appropriate technical and organizational measures: encryption in transit and at rest, mandatory authentication, per-user data partitioning, access logging, and regular updates.

6. SUB-PROCESSORS AND INTERNATIONAL TRANSFERS

6.1. The Publisher uses technical providers for hosting, authentication, storage, AI models, web and image search, document recognition, notifications, subscriptions, and technical monitoring. Where GDPR applies and the provider acts as a processor, the Publisher must execute the agreement required by Article 28 before enabling the relevant processing in production. The named list and safeguard status are maintained in the provider register.

6.2. Some providers are established outside the European Union, including in the United States and, for DeepSeek, in the People's Republic of China. Chatbot image analysis, which sends the current turn's image to DeepSeek in the People's Republic of China, is enabled for Users located outside the European Union, the United Kingdom, and the United States. It remains disabled, and is refused by the Publisher's server based on the connection's location, for Users located in those territories until the applicable transfer mechanism (adequacy decision, standard contractual clauses and supplementary measures, or another valid mechanism) and the required data-processing agreement have been verified and documented. Location detection relies on the IP address and may be imperfect; Users located in those territories agree not to circumvent this restriction. Identifying data remains prohibited in text messages, which are minimized in accordance with Article 3.3. The Publisher maintains a detailed register of providers and safeguards.

7. DATA RESIDENCY AND REGULATED REGIONS

Remote storage and synchronization may be disabled for Users located in certain strict-framework jurisdictions, in particular the European Union, the United Kingdom, and the United States. In that case, the Application operates in local mode, data remaining encrypted on the device, and the User is informed.

8. AUTOMATED PROCESSING AND ARTIFICIAL INTELLIGENCE

The AI model providers used by the Publisher are Google Gemini, DeepSeek, and Mistral; Openverse is used to search for openly licensed images. Content is transmitted to provide the requested feature. The Publisher does not use it to train its own models, but providers' public terms may permit use to improve their services; the Publisher applies available opt-outs and contractual safeguards and documents their status before enabling the relevant features in production. Three regimes apply:

a) the content of the observation form is anonymized on the device before any transmission, an application check blocking sending where an identifying field is present;

b) messages sent to the assistant are not anonymized on the device: they are subject to the filter described in Article 3.3 and then transmitted, depending on the path, with filtered recent history or only the context required;

c) an attached educational image is re-encoded without metadata and then sent with the current message to DeepSeek when this feature is enabled. Patient photographs, named documents, and visible identifiers are prohibited. The image file is not retained by the Publisher's server after the turn.

The suggestions produced have no legal or similarly significant effect on the User, who retains the decision.

9. SDKS AND ABSENCE OF ADVERTISING TRACKERS

The Application integrates third-party services for its operation: authentication and database, notification delivery, subscription management, and technical monitoring (with personal data filtered). The Application integrates no advertising network and no advertising tracker, and performs no tracking of the User's activity across applications or websites. Non-essential trackers, if any, are placed only with the User's prior consent.

10. RETENTION PERIODS

Account data is retained for the duration of account use. Locally stored data is retained until deleted by the User. Upon an account-deletion request, data is permanently erased after a thirty-day grace period. The following periods further apply: voice recordings are not retained beyond transcription; the temporary conversation copy referred to in Article 3.3 is deleted no later than two hours after the last activity; access logs including the IP address are retained for no more than twelve months; usage logs of the AI features are anonymized beyond twelve months; records of attempts to enter identifying data (detected types, excluding message content) are retained for no more than six months; proofs of consent are retained for as long as necessary to demonstrate compliance with the Publisher's legal obligations; the ledger of credit and subscription transactions is retained for the statutory retention period applicable to accounting records.

11. RIGHTS OF DATA SUBJECTS

The User has the rights of access, rectification, erasure, restriction, objection, and portability, as well as the right to withdraw consent at any time without retroactive effect. These rights are exercised with the Publisher at semio.ltdb@gmail.com. The User also has the right to lodge a complaint with the competent supervisory authority.

12. CALIFORNIA USERS

For Users residing in California, the Publisher collects identifiers, user content, any health data qualifying as sensitive personal information, commercial information relating to purchases and subscriptions, and technical data, for the purpose of operating the Application and excluding any advertising purpose. The Publisher does not sell or share personal data within the meaning of the California Consumer Privacy Act as amended. Concerned Users have the rights to know, access, delete, correct their data, opt out of its sale or sharing, limit the use of sensitive information, and to non-discrimination. These rights are exercised at the address in Article 11.

13. MINORS

The Application is reserved for adults practising or training for a healthcare profession. It is not intended for children. The Publisher does not knowingly collect data concerning minors within the meaning of the Children's Online Privacy Protection Act and Article 8 GDPR. Any data relating to a minor brought to its attention is deleted.

14. DATA BREACH

In the event of a data breach likely to result in a risk to the rights and freedoms of individuals, the Publisher notifies the competent supervisory authority as soon as possible, and at the latest within seventy-two hours of becoming aware of it, and informs the concerned individuals where the risk is high.

15. CHANGES TO THIS POLICY

The Publisher may amend this policy. In the event of a material change, the User is informed at the next login and, where required, invited to renew their consent.

16. CONTACT

For any question regarding this policy or to exercise rights, the User may contact the Publisher, LA TOUR DE BABEL CORPORATION ("LTB SARL"), at semio.ltdb@gmail.com.