Last Updated: September 8, 2026
Science Corporation (“Science”, “we”, “us”) complies with the EU-U.S. Data Privacy Framework (EU-U.S. DPF), the UK Extension to the EU-U.S. DPF, and the Swiss-U.S. Data Privacy Framework (Swiss-U.S. DPF) as set forth by the U.S. Department of Commerce (collectively, the “Frameworks”).
Science has certified to the U.S. Department of Commerce that it adheres to the EU-U.S. Data Privacy Framework Principles with regard to the processing of personal data received from the European Union in reliance on the EU-U.S. DPF and received from the United Kingdom (and Gibraltar) in reliance on the UK Extension to the EU-U.S. DPF.
Science has certified to the U.S. Department of Commerce that it adheres to the Swiss-U.S. Data Privacy Framework Principles regarding the processing of personal data received from Switzerland in reliance on the Swiss-U.S. DPF.
If there is any conflict between the terms in this DPF Statement and the Principles, the relevant Principles shall govern.
To learn more about the Data Privacy Framework (DPF) program, and to view our certification, please visit https://www.dataprivacyframework.gov/list.
Personal Data Processed by Science as a Controller
Science is committed to complying with the EU-U.S. DPF Principles and the Swiss-U.S. DPF Principles for all personal data received from the European Union, the United Kingdom (and Gibraltar) and Switzerland in reliance on the relevant part(s) of the Frameworks. This DPF Statement supplements the Science PRIMA Patient Privacy Notice for Science’s processing of personal data as a controller:
-
Personal Data Processed. Please review the section of the PRIMA Patient Privacy Notice entitled What data do we use and where does it come from? for details on the types of personal data we collect for processing as a controller.
-
Purposes of Personal Data Processing. Please review the section of the PRIMA Patient Privacy Notice entitled Why do we use your data and what are the legal bases? for details on the purposes of processing personal data where Science is a controller.
-
Third Parties Who May Receive Personal Data. Please review the section of the PRIMA Patient Privacy Notice entitled When do we disclose your data? for details on the third parties who may receive personal data where Science is a controller and the purposes for which we disclose it to them.
-
Rights to Access, Limit Use, and to Limit Disclosure of Personal Data. Please review the section of the PRIMA Patient Privacy Notice entitled What are your rights? on rights to access, limit use, and limit disclosure of personal data where Science is a controller. In addition, if personal data covered by this DPF Statement is to be used for a new purpose that is materially different from that for which the personal data was originally collected or subsequently authorized or is to be disclosed to a third party not anticipated or as described in this DPF Statement, individuals will be entitled to choose whether to have their personal data so used, and/or, in particular for sensitive data (i.e., personal data specifying medical or health conditions, racial or ethnic origin, political opinions, religious or philosophical beliefs, trade union membership or information specifying the sex life of the individual), will be asked to provide explicit consent (opt-in) for any such new purposes. For any sensitive personal data we collect about you, we will obtain affirmative, express consent (i.e., opt-in) from you if such information will be (i) disclosed to a non-agent third party or (ii) used for a purpose other than those for which it was originally collected or subsequently authorized by you. In addition, we will treat as sensitive any personal data received from a third party where the third party identifies and treats it as sensitive. To request to exercise your rights or choices, contact us at privacy@science.xyz. Your exercise of the choices and rights described above may be subject to the limitations permitted by the Principles.
Personal Data Processed by Science as a Processor
Science is committed to complying with the EU-U.S. DPF Principles and the Swiss-U.S. DPF Principles for all personal data received from the European Union, the United Kingdom (and Gibraltar) and Switzerland in reliance on the relevant part(s) of the Frameworks. Science provides services to its wholly-owned subsidiary, La Science SAS (“La Science”), to facilitate its provision of certain treatments to patients (“Patients”), including the PRIMA vision restoration treatment. In providing these services, Science processes certain data of La Science on its behalf:
-
Personal Data Processed. Personal data we may process on behalf of La Science will depend on what data Patients make available but may include:
- identification, contact, appointment, communication, and consent records and, where necessary, contact details of family members, caregivers or primary care practices;
- fitting and customisation data, including head and face measurements, eye-related measurements, glasses or lens parameters, assistive-device use, personal goals, and support needs;
- relevant health, eye, treatment, surgery, and follow-up information, including diagnoses, medical history, medication, visual and functional test results, ophthalmological images, implantation details, complications, and adverse events;
- product, device, and usage data linked to Patients or their assigned PRIMA system, including identifiers, software versions, settings, usage information, and technical, diagnostic, error, and security logs;
- rehabilitation and support data, including goals, exercises, progress, visual or reading performance, everyday use, feedback, and information from home visits or other support contacts; and
- complaint, quality, safety, and vigilance data linked to Patients or their assigned device, including malfunctions, follow-up information, causality or reportability assessments, recalls, and corrective measures.
-
Purposes of Personal Data Processing. We process personal data that La Science makes available to us for processing on its behalf to facilitate its interactions with Patients including the provision of the PRIMA vision restoration treatment. These purposes include:
- Fitting, customisation, rehabilitation, ongoing support, device operation, troubleshooting, and information security
- Compliance with laws and regulations
- Quality, complaints, post-market surveillance, vigilance, recalls, and other manufacturer obligations.
-
Third Parties Who May Receive Personal Data. We use third party service providers to assist us in providing our services to La Science, including providers of operational support, rehabilitation support, laboratory, IT, cloud, software, communications, support, quality, and analytics services. These third parties may access, process, or store personal data while providing their services. We maintain contracts with these third parties restricting their access, use and disclosure of personal data in compliance with our obligations under the Frameworks, including the onward transfer provisions.
-
Rights to Access, Limit Use, and to Limit Disclosure of Personal Data. Individuals in the European Union, United Kingdom (and Gibraltar) and Switzerland have rights to access personal data about them, and to limit use and disclosure of their personal data. With our Data Privacy Framework self-certification, we have committed to respect those rights. As required by our agreement with La Science and applicable data protection law, we will refer requests to exercise these rights to La Science and support them as needed in responding to these requests.
Contacting Us, Complaints, and Dispute Resolution
In compliance with the EU-U.S. DPF, the UK Extension to the EU-U.S. DPF, and the Swiss-U.S. DPF, Science commits to resolve complaints about our collection and use of your personal data that we receive pursuant to the Frameworks. We will endeavor to resolve your issue and respond no later than 45 days after receipt. EU, UK, and Swiss individuals with inquiries or complaints relating to our handling of personal data received in reliance on the Frameworks should first contact us at privacy@science.xyz.
Any such complaint that cannot be resolved internally will be referred to JAMS, a third-party alternative dispute resolution provider located in the United States. If you make such a complaint and do not receive timely acknowledgment of your complaint from us, or if we have not addressed your complaint to your satisfaction, please visit the JAMS complaint link here: https://www.jamsadr.com/dpf-dispute-resolution. The services of JAMS are provided at no cost to you.
If neither we nor JAMS resolve the matter, you may be able to invoke binding arbitration through the Data Privacy Framework Panel. For more information on this option, please see Annex I of the EU-U.S. Data Privacy Framework Principles or Annex I of the Swiss-U.S. Data Privacy Framework Principles, as applicable.
FTC Enforcement
The U.S. Federal Trade Commission has jurisdiction over Science’s compliance with the Frameworks.
Law Enforcement or Public Authority Requests
In accordance with our legal obligations, we may be obligated to disclose personal data in response to lawful requests by public authorities, including to meet national security or law enforcement requirements.
Liability for Onward Transfers
We are responsible for the processing of personal data we receive under the Frameworks and subsequently transfer to a third party acting as an agent on our behalf. We remain liable under the Principles if our agent processes such personal data in a manner inconsistent with the Principles, unless we prove that we are not responsible for the event giving rise to the damage.
Changes to this DPF Statement
This DPF Statement may be amended from time to time, consistent with the requirements of applicable laws and regulations. The revisions will take effect on the date of publication of the amended DPF Statement, as stated. We will not amend this DPF Statement in a manner inconsistent with the Principles.
