General Personal Data Protection Policy

Edition 3.0 – Updated on July 2, 2026

Volta Medical's Privacy Policy consists of two parts: Volta Medical's General Personal Data Protection Policy and various specific Policies that apply depending on the processing concerned

On this page you will find general information on all the processing of personal data that we carry out, our commitments in terms of privacy and processing, as well as all your rights as data subject and how to exercise them. This document is entitled "Volta Medical - General Data Protection Policy".

Following this general information, are various specific personal data protection policies (hereinafter referred to jointly as the " Specific Policies "). Each of these Specific Policies is intended to inform you, depending on your situation, of the essential characteristics and the terms and conditions relating to how we carry out personal data processing in our capacity as data controller. Please refer to the Privacy Policy applicable to your situation to find out how we process your data.

If you have any questions, you can contact Volta Medical's Personal Data Protection Officer whose contact details are listed in the "Contact" tab below.

Volta Medical processes the personal data entrusted to it in compliance with the Laws and Regulations in force, specifically the General Data Protection Regulation that entered into force on May 25, 2018 (GDPR), and the French Data Protection Act ("Loi Informatique et Libertés") of January 6, 1978, as well as the research guidelines and methodologies issued and published by the CNIL [National Commission on Data Privacy].

More specifically, our commitments regarding the processing of your data are as follows:

Transparency: Volta Medical is committed to processing your personal data in a transparent, fair and lawful manner. As such, you are informed of the essential characteristics of each processing we carry out on your personal data. No processing of your data is carried out without your knowledge. We provide you with appropriate and timely information on all the processing of your data, whether it has been obtained directly from you or indirectly from third parties.

Proportionality: We also undertake to process your personal data only for specific, explicit, and legitimate purposes, or when applicable, to comply with our legal/regulatory obligations. Your personal data is not subsequently processed in any way that is incompatible with these purposes. If there is compatibility with the purpose for which the data is collected, and we intend to carry out further processing with it, we will provide you with any information you may need to understand this new purpose and any relevant information. When the processing falls within our legitimate interests, this means that we have determined that it does not harm your interests nor your fundamental rights and freedoms. You may request information on how we weigh these factors at any time by contacting Volta Medical’s Data Protection Officer, whose contract details are specified in the “Contact” section of this General Policy.

Necessity: We make sure to limit the data we process to what is “just necessary”. This means that we only collect data that is strictly necessary to enable us to achieve the purposes we have set for ourselves. In this context, the data is adequate, relevant, and limited to what is necessary for the purposes of each processing operation we carry out. Furthermore, we only retain data for as long as is necessary to achieve the purpose for which it was collected, unless a specific period of data retention is required by law, or a longer period is necessary to preserve our rights. However, your data may be retained for research or statistical purposes, provided that we implement appropriate technical and organizational measures to guarantee your interests or fundamental rights and freedoms (specifically the anonymization and aggregation of data).

In addition, we strictly regulate how potential recipients of your data can access it:
- Within our group, we limit our employees' access to only the data strictly necessary for the accomplishment of their missions and carry out regular reviews of these access authorizations;
- From an external point of view, we choose our data processors, partners, and service providers diligently (such as our data hosting providers), and frame our relationships with appropriate contractual safeguards in order to (i) ensure that they implement appropriate technical and organizational measures to ensure a high level of protection of your data and (ii) carry out processing in compliance with regulations on the protection of personal data.
‍
In exceptional circumstances, and in accordance with the law, we may have to extract and disclose your data when required to do so by a competent judicial or administrative authority, subject to respect for your fundamental rights and freedoms and the provisions of the French Code of Criminal Procedure. In such cases, disclosure of data is strictly regulated by law.

‍
Accuracy: We ensure that your personal data is accurate and kept up to date. We take reasonable steps to ensure that data that is inaccurate, having regard to the purposes for which it is processed, is erased or rectified without delay

To this end, if your data has become incomplete or inaccurate, we encourage you to exercise your right to rectification under the conditions set out under the tab "What are your rights regarding the processing of your data and how can you exercise them" of Volta Medical's General Data Protection Policy.

Security: Your data is processed in such a way as to guarantee its security and to prevent any breach of its confidentiality, availability and integrity. In this context, we implement appropriate technical and organizational measures adapted to the level of sensitivity of the data processed in order to protect them and to avoid, in particular, the risks of loss, destruction, alteration, disclosure or unauthorized access to them.

In particular, we employ encryption and/or pseudonymization techniques whenever possible or appropriate, and we carry out impact assessments prior the implementation of any processing that may result in a high risk to the rights and freedoms of data subjects.

In general, we are committed to complying with the regulations relating to the protection of personal data, and in particular, to ensure:
- respect for the rights conferred on individuals;
- compliance with retention periods (while taking into account, in compliance with applicable law, the purpose of the processing, contractual or operational requirements, and our legal/statutory obligations) ;
- compliance with our obligations concerning international transfers, for which we will take the necessary measures to ensure compliance with European regulations in the case of recipients who are not located in a European Union member State,
- the supervision of subcontracting;
- raising employees’ awareness about data protection and the necessity of confidentiality,
- implementing organizational and technical measures to ensure effective compliance with these principles.