Privacy Policy

Introduction

Avicen ("we", "our", or "us") is committed to protecting the privacy and security of your personal data. This Privacy Policy explains how we collect, use, disclose, and safeguard your information when you use the Avicen clinical intelligence platform (the "Service").

By accessing or using our Service, you acknowledge that you have read and understood this Privacy Policy. If you do not agree with our practices, please do not use the Service.

Data Controller

The data controller for the purposes of applicable data protection legislation is Avicen, a simplified joint-stock company (société par actions simplifiée, SAS) incorporated and registered in France.

For all data protection inquiries, you may contact us at contact@avicen.io.

Data We Collect

We collect different types of information depending on how you interact with our Service.

Usage Data

• Account information: name, email address, professional credentials, organization details
• Authentication data: login credentials managed through our identity provider
• Usage logs: pages visited, features used, session duration, browser type and version
• Device information: IP address, operating system, device type, unique device identifiers

Medical Data

When you use Avicen to process medical records, the following types of data may be uploaded and processed:

• Medical documents: PDFs, scans, lab reports, DICOM images, handwritten notes, audio recordings
• Extracted clinical data: patient summaries, timelines, clinical findings, medication lists
• Analysis outputs: AI-generated reports, cross-references, divergence flags, citations

Medical data is processed solely on your behalf and under your instructions as the data controller. We act as a data processor for medical data. We do not use medical data for training AI models, marketing, or any purpose other than delivering the Service to you.

Purpose of Processing

We process your personal data for the following purposes:

• To provide and maintain the Service, including clinical document analysis and report generation
• To manage your account, authenticate your identity, and enforce access controls
• To communicate with you about service updates, security alerts, and support inquiries
• To improve the Service through aggregated, anonymized usage analytics
• To comply with legal obligations and respond to lawful requests from authorities

Legal Basis

We rely on the following legal bases under the GDPR and applicable French data protection legislation to process your personal data:

• Contractual necessity — Processing is necessary to perform our contract with you and provide the Service.
• Consent — Where required, we obtain your explicit consent before processing (e.g., for marketing communications or optional cookies).
• Legitimate interests — Processing is necessary for our legitimate interests, such as improving the Service and ensuring security, provided these interests are not overridden by your rights.
• Legal obligation — Processing is necessary to comply with applicable legal requirements.

Data Sharing

We do not sell your personal data. We may share your data only in the following circumstances:

• Infrastructure providers: We use Swiss-hosted cloud infrastructure to store and process data. Our sub-processors are bound by strict data processing agreements.
• Legal requirements: We may disclose data when required by law, regulation, or valid legal process.
• Business transfers: In the event of a merger, acquisition, or sale of assets, your data may be transferred as part of the transaction, subject to equivalent privacy protections.

We never share medical data with third parties for their own purposes.

International Transfers

Your data is primarily stored and processed in Switzerland, which is recognized by the European Commission as providing an adequate level of data protection.

If any data is transferred outside of Switzerland or the EEA, we ensure appropriate safeguards are in place, such as Standard Contractual Clauses (SCCs) or equivalent mechanisms.

Data Retention

We retain your personal data only for as long as necessary to fulfill the purposes for which it was collected, including to satisfy legal, accounting, or reporting requirements.

Medical data uploaded to the Service is retained for the duration of your subscription. Upon termination of your account, your data remains available for export for 30 days, after which it is permanently deleted unless a longer retention period is required by law or explicitly requested by you.

Security Measures

We implement comprehensive technical and organizational measures to protect your data, including:

• Encryption at rest (AES-256) and in transit (TLS 1.3)
• Role-based access controls (RBAC) with multi-factor authentication
• Regular security audits, penetration testing, and vulnerability assessments
• Data isolation: each customer's data is logically separated and inaccessible to other customers

Your Rights

Under the GDPR and applicable data protection laws, you have the following rights regarding your personal data:

• Right of access — You may request a copy of the personal data we hold about you.
• Right to rectification — You may request correction of inaccurate or incomplete personal data.
• Right to erasure — You may request deletion of your personal data, subject to legal retention requirements.
• Right to restriction — You may request that we restrict processing of your personal data in certain circumstances.
• Right to data portability — You may request your data in a structured, commonly used, machine-readable format.
• Right to object — You may object to processing based on legitimate interests or for direct marketing purposes.

To exercise any of these rights, please contact us at contact@avicen.io. We will respond to your request within 30 days. If you are unsatisfied with our response, you have the right to lodge a complaint with your local data protection authority.

Cookies

We use cookies and similar tracking technologies on our website. For detailed information about the cookies we use and how to manage your preferences, please refer to our Cookie Policy.

Changes to This Policy

We may update this Privacy Policy from time to time. When we make material changes, we will notify you by email or by posting a prominent notice on our website. The "Last updated" date at the top of this policy indicates when the latest revisions were made.

Contact Us

If you have any questions or concerns about this Privacy Policy or our data practices, please contact us:

Avicen — Email: contact@avicen.io