Research data access policy.

01Who this policy is for

This policy describes how external parties can request access to research data and clinical collaborations with Boli Care SAS. It applies to:

• Academic clinical researchers and university hospitals
• Pharmaceutical medical affairs, HEOR and Real-World Evidence teams
• HTA bodies, payers and public health agencies
• Patient organisations conducting structured research
• Independent journalists and writers requesting aggregated, non-identifying statistics

It does not apply to direct patient access to their own data (covered by the Privacy policy and the Instructions for Use) or to physician access to data of their own patients (covered by physician onboarding agreements).

02What data Boli holds

Boli Care collects, processes and stores three families of data, with the explicit and revocable consent of each user:

a. Patient-reported outcomes (PROs)

Side-effect grading aligned with PRO-CTCAE, appetite, satiety, nutrition behaviour, hydration, sleep, mood, energy, physical activity, social context.

b. Treatment journey data

Anti-obesity medication class and dose-step, adherence pattern, persistence, planned and unplanned discontinuations, concomitant treatments where reported by the user.

c. Behavioural and contextual signals

In-app interactions with educational content, peer community participation patterns, alert acknowledgements, language preferences, country of residence (anonymised at study level).

03Our governing principles

Every research data access decision is evaluated against four principles, in this order:

1. Patient first. No data leaves Boli unless the use is consistent with the consent given by patients and serves obesity care, metabolic health, or the public good.
2. Scientific value. The proposed research must be methodologically sound, peer-reviewable, and likely to advance clinical knowledge or care pathways.
3. Privacy by design. Minimum necessary data, strongest available pseudonymisation, k-anonymity ≥ 5 on every released subset, and contractual data-use restrictions.
4. Strategic alignment. Boli Care is a privately funded medtech. We can decline requests that would harm our mission, our patients, our partners, or the long-term viability of the platform.

04Access modes

Depending on the request, we offer four access modes:

05Request process

1. Initial contact at research@boli.care with a 1-page intent letter: requesting institution, primary investigator, research question, intended access mode, expected timeline.
2. Boli scoping call with our medical and data teams. We will describe what is feasible, what is not, and what the protective constraints are.
3. Formal request file: research protocol, ethical approval (or path to obtaining it), funding source, data security plan, intended publication route.
4. Boli internal review by the Medical Director, the Data Protection Officer (DPO), and the Scientific Committee. Decision is communicated within 20 working days of a complete file.
5. Contracting: Data Use Agreement, Data Processing Agreement (when applicable), Data Protection Impact Assessment, Material Transfer Agreement (when relevant). Boli uses standardised templates aligned with EDPB guidelines and ICH-GCP E6(R3).
6. Delivery through the agreed access mode.
7. Audit trail: every access is logged, the partner provides annual usage reports, and Boli reserves the right to audit on reasonable notice.

06Legal & ethical framework

• EU GDPR (Regulation 2016/679), in particular Article 9 on special-category health data and Article 89 on processing for scientific research.
• French Loi Informatique et Libertés as amended, including the référentiels and méthodologies de référence of the CNIL applicable to health research (MR-001 to MR-006 as relevant).
• Health Data Hosting (HDS): sensitive workloads are hosted on HDS-certified infrastructure in the European Union.
• EU MDR 2017/745: Boli Care is a Class I software medical device and complies with post-market surveillance and clinical evaluation requirements.
• Declaration of Helsinki and ICH-GCP E6(R3) for clinical research collaborations.
• Ethics review: every collaborative study requires an ethics approval from a competent committee in the partner's jurisdiction (CPP / CER / IRB).
• International transfers: data transfers outside the EU/EEA require Standard Contractual Clauses and a transfer impact assessment, in line with the Schrems II ruling.

07Data standards & formats

To maximise interoperability and reduce friction in academic and pharma workflows, Boli supports:

• HL7 FHIR R4 for clinical observations, medications, and patient-reported outcomes.
• OMOP Common Data Model v5.4 (OHDSI) for cohort studies and federated analytics.
• ICHOM-aligned outcome sets where applicable.
• PRO-CTCAE grading for treatment-related symptoms.
• ICD-10 coding for the obesity and metabolic conditions in scope.
• CSV / Parquet for ad-hoc bespoke extracts.

For each release, Boli provides a data dictionary, a coverage and missingness report, and a bias-and-limitations note (BIO statement, in line with STROBE for observational research).

08Fees & cost recovery

Boli Care is a privately funded medtech. We are happy to support genuine research, and we recover the cost of the work we do for partners.

Fees are not a profit centre. They are calibrated to fund the engineering, statistical, ethical and contractual work required to deliver high-quality, defensible research data, and to keep Boli sustainable for our patients.

09Intellectual property & publication

• Boli retains ownership of the underlying datasets, the derivation methods, and the platform.
• Partners retain ownership of their analyses, methods and publications.
• Publications using Boli data must cite Boli Care using the canonical citation provided in the Data Use Agreement, and must respect the embargo and review windows defined in the agreement (typically 30 days for factual review, no veto right on scientific content).
• Boli encourages co-authorship when our scientific or medical contribution warrants it, in line with ICMJE authorship criteria.
• Boli supports preprints and open-access publication.

10When we will refuse a request

Boli reserves the right to decline any request, with a reasoned response, in particular when:

• The proposed use is inconsistent with the consent given by patients.
• The research design is not scientifically sound or is methodologically unsafe.
• The partner cannot demonstrate adequate data security, ethics governance, or legal basis.
• The request would create a conflict of interest with Boli's mission, regulatory standing, or commercial sustainability.
• The cohort size or query specification would create a re-identification risk.
• The partner is sanctioned, on a denied-party list, or operating in a jurisdiction without an adequate data protection framework, without compensating safeguards.
• The request relates to advertising, marketing optimisation, insurance underwriting against the patient's interest, or use by employers to make individual personnel decisions.

11How to contact us

One-page intent letters and any question on this policy are warmly welcomed at research@boli.care. For data-protection-specific questions, our DPO can be reached at dpo@boli.care. For media enquiries on aggregate statistics, please write to hello@boli.care.

Research contact

research@boli.care

Data Protection Officer

dpo@boli.care

Postal address

Boli Care SAS, 3 rue Loustau, 64200 Biarritz, France

Companies register

989 985 718 R.C.S. Bayonne