Personal data protection policy

We collect personal data about you from the following sources:

• the personal data you provide to us directly in the course of our relationship, whether current or prospective (for example when you contact us by email, telephone or any other means, or when you give us your business card, or when you visit our premises);
• the personal data we collect from our website when you browse it or use the functions and resources available or accessible through it;
• personal data relating to appointment bookings for our services;
• personal data provided by third parties (such as a credit rating agency or a business information website like Infogreffe).

Notice for visitors and users of our website: use of our website and any personal data shared by users are governed by our Policy and Terms of Use.

Purposes of processing your personal data

We process your personal data in accordance with the following purposes:

• enable our stakeholders to request information about Doxamed and its services* ;
• prepare and submit commercial proposals, participate in calls for tenders or public procurement processes;
• enable tracking of commercial and contractual relationships with our clients (quotation delivery, invoice delivery, order fulfillment, technical support and follow-up, dispute management where applicable, etc.);
• offer our contacts and prospects the opportunity to participate in events organised by Doxamed as part of trade shows, seminars and professional conferences* ;
• to issue calls for proposals or calls for tender and enable monitoring of commercial and contractual relationships with our suppliers, service providers and subcontractors* ;
• meet our contractual obligations;
• conduct customer satisfaction surveys* ;
• carry out promotional activities for our services with clients and prospects* ;
• carry out quality audits* ;
• manage unsolicited applications and those submitted in response to job offers*, and ensure the management of human resources for our employees, interns, apprentices and social representatives;
• ensure the physical security of our premises (including visitor logs and video surveillance records) and the electronic security of our systems* ;
• improve our products and services (identify issues, plan improvements, create new ones)*
• ensure financial, accounting, legal and audit management* ;
• in the context of legal proceedings (establishing, exercising or defending rights in court)* ;
• manage scheduling for teleconsultations and other appointments at sites equipped by Doxamed* ;
• comply with our legal obligations.

Legal foundations

In order to process your personal data in accordance with the purposes set out above, we rely on one or more legal bases:

• Processing may be necessary to fulfil a contract you have concluded with us, or to take the necessary steps to enter into such a contract;
• treatment may be necessary to comply with a legal obligation;
• processing may be based on your prior consent (this legal basis is used only for optional processing, not for necessary or mandatory processing);
• We have a legitimate interest in processing personal data for the purposes listed above and marked with an asterisk (*).

The personal data we may collect varies depending on the purpose of processing. It is primarily intended to enable identification of individuals in the context of their relationships with Doxamed. In any case, the personal data collected will be limited to data necessary for the purposes set out in section 2 above.

Notice for visitors and users of our website: certain features of our site can only be used if specific personal data are provided. You are free to provide, or not provide, all or part of the personal data requested; however, if you choose not to provide them in full, certain services and/or certain site features may not work or may only work in part.

Personal data relating to clients and prospects

• personal details (surname, first name(s)) and contact information (postal address, delivery address, administrative contact details where applicable, telephone number, email address) of contacts within the client or prospective company;
• information about quotes and orders (statements and amounts);
• information about payment methods and terms (payment date, payment statements, amount paid) ;
• information about client needs and constraints, collected through satisfaction surveys, and which may be used to ensure our marketing communications are relevant and timely;
• additional personal data that our customers have chosen to share with us, insofar as necessary to fulfil the purposes set out in section 2 above.

Personal data relating to suppliers, service providers and subcontractors

• personal information (surname, first name(s)) and contact details (postal address, secretary contact details where applicable, telephone number, email address) of our contacts within the supplier, service provider or subcontractor company ;
• additional personal data that our contacts have chosen to share with us, insofar as they are necessary to achieve the purposes set out in section 2 above.

Personal data relating to candidates applying for our job offers

• personal information (name, given name(s), photo) ;
• demographic information (sex, date of birth/age, place of birth, nationality) ;
• professional information (occupation, employment status, professional address) ;
• contact details (postal address, phone number, email address) ;
• professional experience, qualifications and motivations.

Personal data relating to our employees, trainees, work-study participants and corporate officers

We collect all information necessary to effectively manage our workforce, including identity, civil status, personal contact details, professional background, qualifications, banking details, social security information and administrative data, in full compliance with applicable legal and regulatory requirements.

Personal data relating to individuals booking an appointment as part of our services

The personal data you provide on the dedicated website (in practice on the systems of our service providers or processors, such as Doctolib or Anamnèse), namely your first name, surname, telephone number and email address, are collected and processed solely to book your appointment slot (date and time); this programme is specifically designed to help plan appointments, reduce waiting times and optimise and simplify the work of healthcare staff.

Depending on the service, online appointment booking may not be available and appointments may be made through alternative methods or on a walk-in basis — this programme depends on services provided by Doxamed, which evolve over time.

The recipients of personal data are: (i) authorised internal departments of Doxamed, (ii) authorised suppliers, service providers and subcontractors of Doxamed, and (iii) healthcare professionals involved in managing files and delivering services.

Doxamed does not intentionally collect or retain personal data of minors, except as part of its appointment booking service described in section 3 above.

Health data: your health data is neither processed nor retained by Doxamed, but solely by the healthcare professionals involved, working in cooperation with Doxamed, under the applicable regulatory framework.

Doxamed does not seek to collect or process sensitive personal data in the normal course of its activities. This may nevertheless occur only in the following exceptional circumstances:

• compliance with a legal obligation, where processing is required or permitted by applicable law (for example, to meet our various reporting obligations) ;
• the detection and prevention of criminal offences (including fraud prevention);
• consent, where we have obtained, in accordance with applicable law, your prior and explicit consent (this legal basis is used only for optional processing).

If you provide us with sensitive personal data of third parties, you must inform us of this specifically.

We may share your personal data with the third parties listed below, each within their respective scope and only in relation to the personal data concerning them:

• lawfully authorised authorities, whether judicial or administrative, at their request, or for the purpose of reporting actual or suspected security vulnerabilities, in accordance with applicable law;
• Doxamed's external professional advisors—accountants, statutory auditors, lawyers and other consultants—who are bound by confidentiality obligations;
• our service providers, suppliers and subcontractors (suppliers of modules and equipment, payment services, freight and transport companies, IT service providers, etc.) ;
• any potential acquirer, in the event that we sell or transfer all or part of our assets or activities (including in the event of reorganisation, dissolution or liquidation).

When any of our service providers or subcontractors participate in processing your personal data (for example Doctolib or Anamnèse, which provide booking systems, Clever Cloud, which hosts the website, Cloudflare, whose Turnstile service protects forms and back-office access against bots, Resend, which delivers messages sent via forms, or any other supplier), they are subject to contractual obligations requiring them to (i) process your personal data only in accordance with our prior written instructions, (ii) implement appropriate measures to protect the confidentiality and security of that data, and (iii) comply with any other obligation imposed by applicable regulations.

Regarding data on individuals booking an appointment, your personal information is shared only with the staff and healthcare professionals involved in ensuring the smooth scheduling and delivery of your appointments.

We take all appropriate measures to ensure that the volume of personal data we process is limited to what is reasonably necessary for the purposes set out in this Policy, and that such data is retained only for as long as necessary in relation to those same purposes.

The criteria used to determine retention periods are as follows:

• We retain your personal data in a form that allows us to identify you for as long as necessary to fulfil the legitimate purposes described in section 2 of this Policy;
• we retain them for the applicable limitation period (the period during which a person may file a complaint with us or take legal action against us regarding them);
• In any case, no later than five (5) years after the personal data in question is communicated, it will be permanently deleted or anonymised.

Regarding personal data specifically related to your appointment bookings (teleconsultations or otherwise), Doxamed deletes this information within one month following the end of the contract governing the relevant Doxamed website (namely, the agreement concluded between Doxamed and its client who commissioned the deployment of the relevant module or health space). This date can be provided to you upon simple request by email to contact@doxamed.com / pdebondy@lawval.com.

We do not transfer personal data (name, email, message, etc.) outside the European Union. The only exception: if you consent to analytics measurement, Google Analytics may transfer pseudonymised browsing data to Google, including outside the European Union (notably to the United States, under the EU–US Data Privacy Framework).

Regarding Doctolib, its personal data management policy is available at the following address: media.doctolib.com/.../B2C-PrivacyPolicy-Apr-23-FR.pdf.

Regarding Anamnèse, its personal data management policy is available at www.anamnese.care.

Depending on the type of processing, within the framework set by the GDPR, you have certain rights regarding the processing of your personal data:

Right not to share your personal data with us

In this situation, we might be unable to provide you with the full range of our products and services — for example, to process your orders or appointment bookings without the necessary information and contact details.

Right to object (processing based on legitimate interest or public interest)

You may at any time object to our processing of your personal data. Your request will be handled promptly and we will cease the processing in question, unless we can demonstrate legitimate and compelling reasons that override your personal interests, or if the processing is necessary for the establishment, exercise or defence of a legal claim.

Right to withdraw consent

Where a processing activity relies on your consent, you can withdraw it at any time — we will then cease that particular processing, unless there is another lawful basis for continuing it, which we would inform you of. Withdrawal does not affect the lawfulness of processing carried out before the date we received notification of the withdrawal.

Right of access

You can request access to or a copy of your personal data, along with information about the nature of the processing and the individuals who can access it. This access is free, except where a request is manifestly unfounded or abusive, or where you request additional copies (reasonable administrative fees may then apply where permitted by law).

Right to erasure

You can request erasure of your personal data in certain circumstances — particularly when they are no longer necessary for the purposes for which they were collected, when you withdraw your consent, or when they have, in exceptional cases, been processed unlawfully. We may refuse this request on legal grounds (freedom of expression, legal obligations, public health, archival or research purposes, or exercise of legal rights).

Right to restrict processing

You can request restriction of the processing of your personal data in certain circumstances (if you dispute their accuracy, object to the processing, consider the processing unlawful, or the data is kept solely for the establishment, exercise or defence of legal claims).

Right to rectification

You can request correction of inaccurate or incomplete personal data concerning you.

Right to data portability

For data we process based on your consent or in the course of contract performance, you may request to obtain and transfer it to another data controller in a structured, commonly used and machine-readable format.

Right to lodge a complaint with a data protection authority

To exercise any of these rights, or for any questions relating to this Policy, please use the contact details provided in the "Contact" section below. We may ask you to provide proof of your identity before we can process your request.

If you believe, after contacting us, that your data protection rights are not being respected, you may lodge a complaint with the CNIL:

Commission Nationale de l’Informatique et des Libertés
3, place de Fontenoy — TSA 80715
75334 Paris Cedex 07 — France

We are committed to taking all necessary measures to protect your personal data against any misuse, loss, alteration, disclosure, destruction, unauthorised access and any other form of unlawful or unauthorised processing, in accordance with applicable law, through appropriate technical and organisational measures.

Because the internet is an open system, the transmission of information over this network is not entirely secure: although we implement all reasonable measures to protect your personal data, we cannot guarantee the security of information transmitted to us via the internet, and such transmission occurs at your own risk.

Access to personal data is restricted to Doxamed employees, trainees, work-study participants, corporate officers, suppliers, service providers and subcontractors who need to access it as part of their duties. All individuals with access to your personal data are bound by a confidentiality obligation and are subject to disciplinary measures and/or other penalties if they fail to comply.

Although Doxamed has taken all appropriate measures to protect your personal data, no transmission or storage technology is completely foolproof.

If you believe your personal data security has been compromised or misused illegally or abusively, you are invited to contact Doxamed:

• by post to: Doxamed, Head Office — 351 Bureaux de la Colline, 92213 Saint-Cloud Cedex (France) ;
• by email, at the address contact@doxamed.com;
• with a copy to Maître Philippe de Bondy — 51 avenue Raymond Poincaré, 75116 Paris, pdebondy@lawval.com, in his capacity as Doxamed's external data protection officer (DPO).

Doxamed will handle complaints concerning the use and disclosure of your personal data and will endeavour to resolve them in accordance with the principles set out in this Policy. Unauthorised access to personal data or its misuse may constitute an offence under applicable law.

For any questions about our Privacy Policy, to unsubscribe from Doxamed commercial communications, or to exercise your rights regarding your personal data, you can write to contact@doxamed.com where pdebondy@lawval.com.

When you visit our website, we may store cookies on your device, or read cookies already present on your device, provided we have always obtained your prior express consent.

This cookie policy applies to the website operated and controlled by Doxamed at www.doxamed.com.

What is a cookie?

A "cookie" is a small information file stored on your computer's hard drive that records your browsing activity on a website, so that on your next visit we can present you with personalised options based on information from your previous visit. Cookies can also be used to analyse traffic and for advertising and marketing purposes. Nearly all websites use them and they do not damage your system.

There are different types of cookies, which are distinguished by their origin, function and lifespan:

• Session cookiesstored on your computer only for the duration of your web session and deleted automatically when you close your browser — they typically store a session identifier that lets you visit our sites without having to log back in on every page.
• Persistent cookiesstored as a file on your computer and retained after you close your browser, readable by the website that created them on your next visit. The only persistent cookie we use is Google Analytics, and only if you accept it.
• Strictly necessary cookiesEssential for using our site effectively, they cannot be disabled. Without them, certain services cannot be provided. They do not collect information that can be used for commercial purposes or to remember pages you have visited.
• Performance cookiesthey allow us to monitor and improve our website's performance (count visits, identify traffic sources, see which pages are most visited).
• Functionality cookiesThey allow our website to remember your choices (username, language, country, etc.) and provide enhanced functionality—for example, to watch a video or post a comment.
• Personalisation cookiesthey allow us to send you information about solutions that may be of interest to you.

Why do we use cookies?

We use cookies to track how you use our website. This helps us understand your usage patterns and monitor trends across individuals and larger groups, so we can develop and improve our site and services in line with what our visitors need and want.

What is the duration of the cookies we use?

The cookies we use on our website are retained for no longer than twelve (12) months. Associated audience measurement data is kept for a maximum of fourteen (14) months.

The audience measurement cookie is placed by a third party, Google, which is responsible for it. It is only deposited with your consent, which you may refuse or withdraw at any time.

How can you manage cookies?

Most internet browsers are set by default to automatically accept cookies. Depending on your browser type, you can configure it to notify you before cookies are placed — allowing you to accept or reject them — or to reject them automatically. Consult your browser's "Help" button (or equivalent) to learn how to do this. Disabling cookies may affect your browsing experience on our website.

You can change your choice regarding analytics measurement at any time using the 'Cookie management' link located at the bottom of each page. If you access our website from different devices, please ensure that each browser on each device is configured according to your preferences.

You can find more information on allaboutcookies.orgDoxamed is neither affiliated with nor responsible for third-party websites.

You can also opt out of cookies from certain companies by visiting aboutads.info/choices and youronlinechoices.comDoxamed is neither affiliated with nor responsible for these third-party websites.

• Data protection authorityindependent public authority mandated by law to oversee compliance with applicable data protection laws.
• Personal dataany information relating to an identified or identifiable person, in particular by reference to an identifier such as a name, an identification number, location data, an online identifier or one or more specific elements.
• Sensitive personal datadata revealing racial or ethnic origin, political opinions, religion or philosophical beliefs, trade union membership, as well as genetic data, health data, data concerning sexual life, criminal convictions or offences, or related security measures.
• Data controllerentity that determines the purposes and means of personal data processing.
• GDPRRegulation (EU) 2016/679 on data protection.
• Subcontractornatural person or legal entity that processes personal data on behalf of the data controller, other than its employees.
• Treatment / Treatany operation performed on personal data, whether or not using automated processes, such as collection, recording, organisation, structuring, storage, adaptation or alteration, extraction, consultation, use, communication by transmission, dissemination or any other form of making available, matching or interconnection, restriction, erasure or destruction.