Privacy Policy
Last updated:
Introduction
Avicen ("we", "our", or "us") is committed to protecting the privacy and security of your personal data. This Privacy Policy explains how we collect, use, disclose, and safeguard your information when you use the Avicen medical record analysis and review platform (the "Service").
By accessing or using our Service, you acknowledge that you have read and understood this Privacy Policy. If you do not agree with our practices, please do not use the Service.
Data Controller
The data controller for the purposes of applicable data protection legislation is Avicen, a simplified joint-stock company (société par actions simplifiée, SAS) with a share capital of €5,000, registered office at 47 rue Vivienne, 75002 Paris, France, registered with the Paris Trade and Companies Register (RCS Paris) under SIREN number 105 345 136. VAT number: FR11 105 345 136.
Data We Collect
We collect different types of information depending on how you interact with our Service.
Usage Data
- Account information: name, email address, professional credentials, organization details
- Authentication data: login credentials managed through our identity provider
- Usage logs: pages visited, features used, session duration, browser type and version
- Device information: IP address, operating system, device type, unique device identifiers
Medical Data
When you use Avicen to process medical records, the following types of data may be uploaded and processed:
- Medical documents: PDFs, scans, lab reports, DICOM images, handwritten notes, audio recordings
- Extracted clinical data: patient summaries, timelines, clinical findings, medication lists
- Analysis outputs: AI-generated reports, cross-references, divergence flags, citations
Medical data is processed solely on your behalf and under your instructions as the data controller. We act as a data processor for medical data. We do not use medical data for training AI models, marketing, or any purpose other than delivering the Service to you.
Purpose of Processing
We process your personal data for the following purposes, each linked to its legal basis (Art. 13(1)(c) GDPR):
- To provide and maintain the Service, including clinical document analysis and report generation. Legal basis: performance of the contract (Art. 6(1)(b) GDPR).
- To manage your account, authenticate your identity, and enforce access controls. Legal basis: performance of the contract (Art. 6(1)(b) GDPR).
- To communicate with you about service updates, security alerts, and support inquiries. Legal basis: performance of the contract and our legitimate interest in keeping you informed (Art. 6(1)(b) and (f) GDPR).
- To improve the Service through aggregated, anonymized usage analytics. Legal basis: our legitimate interest in improving the Service (Art. 6(1)(f) GDPR) and, for audience measurement cookies, your consent (Art. 6(1)(a) GDPR).
- To comply with legal obligations and respond to lawful requests from authorities. Legal basis: compliance with a legal obligation (Art. 6(1)(c) GDPR).
Legal Basis
We rely on the following legal bases under the GDPR and applicable French data protection legislation to process your personal data:
- Contractual necessity: Processing is necessary to perform our contract with you and provide the Service.
- Consent: Where required, we obtain your explicit consent before processing (e.g., for marketing communications or optional cookies).
- Legitimate interests: Processing is necessary for our legitimate interests, such as improving the Service and ensuring security, provided these interests are not overridden by your rights.
- Legal obligation: Processing is necessary to comply with applicable legal requirements.
Health Data (Article 9 GDPR)
Health data are special categories of personal data within the meaning of Article 9(1) GDPR. Their processing is prohibited unless one of the exceptions provided for in Article 9(2) applies.
Medical records are processed by Avicen exclusively as a processor, on behalf of and on the documented instructions of the professional client, who acts as controller. For medical expertise work (expertise médicale), the client typically relies on Article 9(2)(f) GDPR (processing necessary for the establishment, exercise or defence of legal claims) and, where applicable, on Article 9(2)(h) GDPR (processing necessary for the purposes of medical diagnosis or the management of health care systems, carried out by or under the responsibility of a professional subject to the obligation of professional secrecy).
Avicen does not process health data for its own purposes. In its role as controller (website, accounts, prospect and client relations), Avicen does not intentionally collect special categories of data. Users must not submit patient or medical data through the public contact forms.
Data of Third Parties (Article 14)
The records processed on behalf of our professional clients contain personal data of third parties (patients, parties to proceedings) that Avicen does not collect directly from the persons concerned. In accordance with Article 14 GDPR, the professional client, as controller, remains responsible for informing those persons about the processing. Avicen processes these data solely on the controller's documented instructions and does not use them for any other purpose.
Data Sharing
We do not sell your personal data. We may share your data only in the following circumstances:
- Infrastructure providers: Our platform hosting provider is Exoscale (a registered trademark of Akenes SA, CHE-423.524.322), Boulevard de Grancy 19A, 1006 Lausanne, Switzerland. Data is stored and processed on European-hosted cloud infrastructure. Our website is hosted by Vercel Inc., 440 N Barranca Avenue #4133, Covina, CA 91723, United States. Our sub-processors are bound by strict data processing agreements.
- Legal requirements: We may disclose data when required by law, regulation, or valid legal process.
- Business transfers: In the event of a merger, acquisition, or sale of assets, your data may be transferred as part of the transaction, subject to equivalent privacy protections.
- External reference search: when you ask the chat a general knowledge question (guidelines, literature, legal texts, medicines), the platform may query public search engines (Google, Bing and others) through a metasearch engine that we host ourselves on our infrastructure. Only a query phrased in general terms is sent; it is checked automatically before sending so that it contains no data relating to a person (names, dates, identifiers), and every outbound query is logged. The pages consulted are read by our servers, never from your browser, and the references used are shown in the answer with their access date.
We never share medical data with third parties for their own purposes.
International Transfers
The Avicen platform and medical data are hosted with Exoscale, a certified health data host (Hébergeur de Données de Santé, HDS) whose infrastructure is also HIPAA-compatible. Data of Swiss clients is hosted in Switzerland. Data of French and EU clients is hosted in their country of operation or within the European Union, on Exoscale's EU zones. Switzerland benefits from an adequacy decision of the European Commission (Decision of 26 July 2000, maintained under the GDPR): personal data may therefore be hosted there with a level of protection recognised as adequate by the European Union.
If any data is transferred outside of the EEA and outside a country covered by an adequacy decision, we ensure appropriate safeguards are in place, such as Standard Contractual Clauses (SCCs) or equivalent mechanisms.
Data Retention
We retain personal data only for as long as necessary for the purposes for which they were collected. The table below sets out, for each purpose, the legal basis and the applicable retention period:
| Purpose | Legal basis | Retention period |
|---|---|---|
| Contact and demo requests | Legitimate interest and pre-contractual measures (Art. 6(1)(b) and (f) GDPR) | 3 years from the last contact |
| Account data | Performance of the contract (Art. 6(1)(b) GDPR) | Duration of the contract, then the applicable legal retention periods |
| Medical data processed on the platform | Processing as processor on the professional client's documented instructions | As instructed by the controller; exportable for 30 days after the end of the contract, then permanently deleted |
| Technical logs | Legitimate interest in security (Art. 6(1)(f) GDPR) | 12 months |
| Consent records | Legal obligation (Art. 6(1)(c) GDPR) | 5 years |
Upon termination of your account, your data remains available for export for 30 days, after which it is permanently deleted unless a longer retention period is required by law.
Security Measures
We implement comprehensive technical and organizational measures to protect your data, including:
- Encryption at rest (AES-256) and in transit (TLS 1.3)
- Role-based access controls (RBAC) with multi-factor authentication
- Regular security audits, penetration testing, and vulnerability assessments
- Data isolation: each customer's data is logically separated and inaccessible to other customers
Medical Secrecy
All Avicen personnel are bound by strict confidentiality obligations. The processing carried out by the platform is designed to be compatible with medical secrecy (in France, article L.1110-4 of the Public Health Code): the professional user remains the sole custodian of the medical file, Avicen acts exclusively as a processor on documented instructions, and no third party is granted access to the data.
Your Rights
Under the GDPR and applicable data protection laws, you have the following rights regarding your personal data:
- Right of access: You may request a copy of the personal data we hold about you.
- Right to rectification: You may request correction of inaccurate or incomplete personal data.
- Right to erasure: You may request deletion of your personal data, subject to legal retention requirements.
- Right to restriction: You may request that we restrict processing of your personal data in certain circumstances.
- Right to data portability: You may request your data in a structured, commonly used, machine-readable format.
- Right to object: You may object to processing based on legitimate interests or for direct marketing purposes.
- Right to withdraw consent: Where processing is based on your consent, you may withdraw it at any time (Art. 7(3) GDPR), without affecting the lawfulness of processing carried out before the withdrawal.
- Post-mortem directives: Under article 85 of the French Data Protection Act (Loi Informatique et Libertés), you may define directives regarding the retention, erasure and disclosure of your personal data after your death.
Automated decision-making (Art. 22 GDPR): Avicen's automated analysis does not produce legal or medical decisions. All outputs generated by the platform, including AI-assisted analyses, are reviewed and validated by the professional user before any use.
To exercise any of these rights, please contact us at . We will respond to your request within one month, as provided by the GDPR. If you are unsatisfied with our response, you have the right to lodge a complaint with your supervisory authority, in France, the CNIL (www.cnil.fr).
Data Protection Contact
Avicen has designated a data protection contact (référent protection des données) for all matters relating to personal data. You can reach them at , stating "Protection des données" in the subject line, for any question about this policy or to exercise your rights.
Cookies
We use cookies and similar tracking technologies on our website. For detailed information about the cookies we use and how to manage your preferences, please refer to our Cookie Policy.
Changes to This Policy
We may update this Privacy Policy from time to time. When we make material changes, we will notify you by email or by posting a prominent notice on our website. The "Last updated" date at the top of this policy indicates when the latest revisions were made.
Contact Us
If you have any questions or concerns about this Privacy Policy or our data practices, please contact us:
Avicen SAS, 47 rue Vivienne, 75002 Paris, France, SIREN: 105 345 136, RCS Paris, VAT: FR11 105 345 136, Email: