The Solution is a service that supports mental and psychological well-being at work. It is available to employees of moka.care's client companies. It offers, in particular:

• Individual coaching sessions with qualified practitioners: psychologists, therapists or coaches.
• Group sessions led by a practitioner.
• An orientation call, which identifies your needs and directs you to the most suitable practitioner.
• Well-being questionnaires and self-assessment tests.
• The Sunny conversational assistant, which supports you in your well-being journey.
• Digital self-care content and programs.
• The Félix tool, a training program available in Slack and Microsoft Teams.
• Psychosocial risk audits, if your employer subscribes to them. They may include a digital questionnaire, interviews with a practitioner, or both.

The services you can access depend on the subscription taken out by your employer.

We only collect the data needed to provide our services. This section describes the data of users. Practitioners are covered by a separate framework: they accept their own terms of use and have their own privacy policy.

Identification data

Your last name, first name and work email address. If you log in through a third-party authentication service or your employer's SSO, we retrieve your last name, first name and email from it. We then have no access to your password and we do not collect it. Mandatory data is flagged when it is collected. It is necessary to provide our services.

Professional data

Your job title, your company, your team and your seniority.

Optional data

Your country, your gender and your age.

Appointment management data

We keep the date, the time and the practitioner of each appointment. We use this data to book your appointment, deduct from your session credit and pay the practitioner. The topics are the ones you choose yourself when you make your request, so that we can direct you to the most suitable practitioner. After the session, the practitioner only indicates whether it related to your professional life or your personal life. The practitioner does not record any information about the content of the discussion. This classification feeds our prevention recommendations in aggregated form.

Connection data

Your IP address, your connection logs and your browsing data on the Solution.

Sensitive data

Some services, all of them optional, process data relating to your physical or mental health. We only collect it with your explicit consent. It is encrypted and is never sent to your employer in a form that identifies you. You can ask for it to be erased at any time. Booking an appointment with a practitioner does not require it. These services are:

• The WHO-5 well-being questionnaire, offered when you arrive. It has five questions and you can decline it. If you decline, it is not offered again for one week. After a second refusal, it is not offered again for three months. We do not keep your answers, only an overall score. This score is used only to guide you, for example by offering you an orientation call with a psychologist.
• Well-being questionnaires and self-assessment tests, with your express consent before each use.
• The Sunny assistant, with your consent.
• Psychosocial risk audits, with your express consent collected at the start of the questionnaire.

What your employer sees. Your employer sees neither your appointments, nor your practitioner, nor your topics, nor the questionnaires. It only has access to aggregated dashboards: segments, usage rates and main topics at organization level. The only verbatim comments it receives are those that employees choose to leave themselves as feedback, with a delay of at least one month.

What moka.care sees. A limited number of authorized people, bound by confidentiality, access your data for two purposes only: to ensure your journey runs smoothly, and to step in when someone is in distress and needs support. This second purpose requires being able to identify you. It is a requirement for people's safety, not a commercial use.

‍

Your data is accessible to the following categories of recipients:

• Authorized moka.care staff. Access rights are granted to each employee according to their role, within the limits of their duties. Three teams are involved: the clinical team, for coordinating journeys and handling situations of distress; user support, to handle your requests; and technical operations, to keep the Solution running and secure. No other staff have access to your data. We keep no paper files and no data is stored on workstations. Access is only possible through personal authentication.
• Our technical service providers: our hosting provider, Amazon Web Services; our email sending tool, used for transactional emails, information messages and newsletters.
• Practitioners. They act as independent data controllers for the therapeutic relationship.
• Competent authorities, where legally required: courts, supervisory authorities and statutory auditors.

We do not send any data from the Solution to advertising networks. We do not use it for any targeting and we do not resell it. Our business model relies on the subscription taken out by your employer.

The only data sent to your employer is strictly aggregated data, provided as statistics. No individual data is sent to your employer: not your identity, not the content of discussions, not your questionnaire results.

Your data is hosted exclusively in Europe, on Amazon Web Services servers, in its data centers in Germany and France. AWS is ISO 27001 certified and HDS approved (French certification for hosting health data).

Our contract is with Amazon Web Services EMEA SARL, a company under Luxembourg law, and not with the US parent company. It is covered by AWS's data processing agreement, which includes the European Commission's standard contractual clauses. AWS contractually commits to challenge any public authority request it considers unfounded, and to notify us of any order concerning our data, unless legally prohibited. AWS publishes a transparency report every six months on the requests it receives.

Some technical tools used by moka.care may involve transfers of data outside the European Union. These transfers are covered by one of the following mechanisms:

• an adequacy decision by the European Commission, under Article 45 GDPR;
• standard contractual clauses approved by the Commission, under Article 46 GDPR;
• any other appropriate safeguard in line with Chapter V of the GDPR.

No personal data is transferred without adequate safeguards.

In accordance with the GDPR and the French Data Protection Act, you have the following rights:

• Right to information: this is the purpose of this policy.
• Right of access: obtain a copy of your data.
• Right to rectification: have inaccurate or incomplete data corrected.
• Right to erasure: ask for your data to be deleted.
• Right to restriction: ask for the temporary restriction of processing.
• Right to data portability: receive your data in a structured, readable format.
• Right to object: object to certain processing based on legitimate interest.
• Right to withdraw consent: withdraw your consent at any time, without retroactive effect.
• Right to set post-mortem directives: state your wishes on how your data is kept and communicated after your death.
• Right to lodge a complaint: contact the CNIL, at www.cnil.fr.

To exercise your rights, contact our Data Protection Officer:

• By email: dpo@moka.care
• By post: Moka Care, DPO, 6-8 rue Saint Sabin, 75011 Paris, France

moka.care commits to reply to any request within one month. This period may be extended to three months for complex requests.

In accordance with Articles L.616-1 and R.616-1 of the French Consumer Code, you may use a consumer mediator free of charge to settle amicably any dispute relating to the performance of our services. You can obtain the contact details of the competent mediator on request at dpo@moka.care.

We may change this policy at any time, in particular to reflect changes in our services or in the regulations. We will inform you by email of any significant change, with reasonable notice.

Effective date: 01/01/2026

A cookie is a small text file placed on your browser when you browse. Cookies make the Solution and the Site work. On the Site, they are also used to measure audience.

The Solution only places cookies that are necessary for it to work or for a feature you use. They do not require your consent. The Solution places no advertising cookies and no audience measurement cookies.

The Solution also includes third-party services, which may place their own trackers: Google Maps for searching for a practitioner by location, Typeform for embedded questionnaires, and Jimo for help and information messages in the application.

These cookies make the Site work. You cannot disable them.

• Necessary cookies, on the Solution and on the Site: they are placed without consent, because they are essential for the service to work.
• Audience measurement cookies on the Site: they require your express consent on your first visit. We keep your choice for 6 months.
• You can withdraw your consent at any time from the cookie manager, available at the bottom of the Site, or by changing your browser settings.