Entrelacs Proof of Concept (PoC) – Privacy Policy (v1.0)

1. Introduction

Welcome to the Entrelacs Proof of Concept (PoC) — a pilot project by Entrelacs to test and showcase our AI-powered conversational assessment that explores social connection and loneliness. This PoC represents an early demonstration of the Entrelacs platform’s capabilities. It is intended for testing, showcasing, and research purposes, not for clinical or commercial use.

The feedback and data collected will help us refine the platform, ensure responsible handling of user information, and evaluate engagement during demonstrations. Entrelacs is committed to processing all information responsibly and securely, in compliance with:

The General Data Protection Regulation (EU) 2016/679 (GDPR)
The French Data Protection Law No. 78-17 (Loi Informatique et Libertés)
The French Public Health Code (Code de la Santé Publique)

2. Data Controller and Contact

Controller: Entrelacs
Data Protection Officer (DPO): Prakhar Srivastava
Email: prakhar@absl.io
Infrastructure: Hosted on Google Cloud Platform (France Region, HDS-certified)

3. Purpose and Scope

This policy applies only to the Proof of Concept (PoC) phase of Entrelacs. During this phase, the platform is used to:

Test and demonstrate AI-driven conversational assessments
Showcase the Entrelacs experience to potential clients, collaborators, and investors
Collect user interaction data (with consent) to improve performance and personalization
Generate anonymized insights into social connection and loneliness for research

The PoC is designed for demonstration and evaluation only — not for medical, therapeutic, or diagnostic use.

4. Data We Collect

Category	Examples	Purpose in PoC
Conversation Data	Text inputs during chat-based interactions	Evaluate conversation quality and showcase product capability
Assessment Responses	Answers to social connection or loneliness questions	Analyze flow and performance for testing and demonstrations
Optional Demographics	Age, gender, occupation (if provided)	Understand audience diversity during demonstrations
Technical Data	Device, browser type, timestamps	Ensure stability, performance, and security
Authentication Data	Name, email, profile picture (if Google Sign-In)	Facilitate access and personalization; not shared or reused

Only essential cookies (for authentication and session security) are used — no tracking, marketing, or analytics cookies.

5. Legal Basis for Processing

Activity	Legal Basis	GDPR Article
Participation in PoC demonstrations	Consent	6(1)(a)
Processing social connection or well-being indicators	Explicit consent	9(2)(a)
Technical logs and infrastructure data	Legitimate interest (security and performance)	6(1)(f)
Use of anonymized feedback for research	Scientific/public-interest research with safeguards	9(2)(j)

6. Data Retention

Data Type	Retention Period	Deletion/Anonymization
Identifiable PoC data (e.g., name, email)	Up to 6 months after demonstration period	Secure deletion
Anonymized chat/assessment data	May be retained for ongoing research and system improvement	Fully anonymized and non-reversible
Technical logs and backups	1 month	Automated deletion
Google Sign-In data	Up to 6 months or upon request	Secure purge

Once data are anonymized, they cannot be re-linked to participants.

7. Data Storage, Security, and Infrastructure

7.1 Location and Hosting

All data collected during the PoC are hosted on Google Cloud Platform (France region), certified under Hébergeur de Données de Santé (HDS) and compliant with GDPR and French healthcare data protection standards.

Infrastructure Certifications & Controls:

GDPR-compliant Data Processing Agreement with Google Cloud
HDS certification for storage, processing, and backup of personal health data
Data centers located exclusively within the European Economic Area (EEA)

7.2 Security Measures

Encryption: All data are encrypted in transit (HTTPS/TLS) and at rest (AES-256).
Access Control:
- Restricted to authorized Entrelacs project and technical staff.
- Multi-factor authentication and role-based access enforced.
- Regular access log reviews.
Data Separation:
- Personal identifiers stored separately from interaction data.
Monitoring and Auditing:
- Automated vulnerability scanning and incident alerts via Google Cloud.
- Real-time monitoring of suspicious activity.
Backups:
- Encrypted backups stored only within the EEA for one month.
- Regular verification for data integrity.
Administrative Safeguards:
- Confidentiality agreements for all staff with access.
- Documented incident response and breach notification protocols.

7.3 Demonstration Context

Since this is a showcase and testing PoC, limited authorized personnel may access pseudonymized user interactions to demonstrate system functionality to potential partners and clients. All demonstrations follow strict confidentiality protocols and exclude personally identifiable information.

8. Data Sharing

Internal Access: Restricted to Entrelacs developers, researchers, and authorized demonstration staff.
Processors: Google Cloud (France, HDS-certified) as infrastructure provider.
No Third-Party Marketing or Data Sales: No sharing with advertisers or external analytics services.
Research Use: Only anonymized, aggregated data used for scientific or technical evaluation.
Google Sign-In: Managed under Google’s Limited Use Policy.

9. Your Rights

Under GDPR, you have the right to:

Access, correct, or delete your identifiable data
Withdraw consent at any time (without affecting prior lawful processing)
Object to or restrict data processing
Request data portability

Contact prakhar@absl.io with the subject line “GDPR Request” to exercise your rights. We respond within 30 days. Once anonymized, your data cannot be identified or deleted.

10. Children's Privacy

This PoC is designed for adults (18+). If data from minors are identified, they are deleted immediately.

11. Automated Decision-Making

The PoC uses limited automated scoring to provide non-clinical insights during demonstrations. No outputs have legal, medical, or therapeutic impact.

12. Data Breach Procedure

If a breach occurs:

CNIL notified within 72 hours if required.
Affected participants informed promptly if risks arise.
Incidents documented and addressed according to GDPR Articles 33–34.

Policy Updates

This policy applies exclusively to the Entrelacs Proof of Concept (PoC). If the PoC scope expands to new demonstration or data-processing activities, this notice will be updated, and the “Last Updated” date will change accordingly.

14. Complaints

For privacy concerns or complaints:
prakhar@absl.io
Supervisory Authority (France): CNIL – www.cnil.fr