PRIVACY POLICY

• Recitals

– The purpose of this Privacy Policy is to inform Web Users and Professionals about how their Personal Data is collected from the Website, how it is processed by the Data Controller and finally the rights enjoyed by Web Users and Professionals with respect to such processing as defined below.

• Definitions

– The following terms, whether used in the singular or plural form in this Privacy Policy, shall have the following meanings or those given in the General Terms and Conditions of Use:

• Legal basis for processing

– In accordance with the Personal Data Regulations, the processing described in this Privacy Policy is the subject of a specific legal basis.

– The Data Subject has consented to the processing of their Personal Data for one or more specific purposes.

– The Website has requested the express consent of the Web User and/or the Professional in order to carry out specific processing as explained when obtaining consent. In accordance with the recommendations of the CNIL on this matter, commercial marketing by email with regard to Professionals is carried out after the latter have been informed, at the time of the collection of their email address, of the use for prospecting purposes and the possibility of objecting to this in a simple and free manner.

– The processing is necessary for the performance of a contract to which the Web User and/or the Professional is party or for the performance of pre-contractual measures taken at their request.

– In order to use the Website and benefit from its services, and in particular to benefit from an Account for the Professional, as a minimum the Data Subject has accepted the General Terms and Conditions of Use. These documents formalise a contractual relationship between the Data Subject and the Data Controller, in particular serving as a legal basis for the collection and processing of the Data Subject’s Personal Data by the Data Controller.

– This Data is necessary for the performance of a certain number of processing measures related to the performance of the contractual relationship between the Data Subject and the Data Controller, the purposes of which are detailed in paragraph 4 – Purposes of processing.

– In the same sense, the website may offer Fill-Med Content which may be the subject of a vote, without subscription to an Account. Under these conditions, the completion of a vote may be subject to the processing of personal data (as a result of retention of logs for example).

– The processing is necessary for compliance with a legal obligation to which the Data Controller is subject.

– Compliance with the legal obligations imposed on the Data Controller by the health vigilance systems provided for in particular by the Public Health Code may be used as the legal basis for the processing of Data.

– Processing is necessary for the purposes of the legitimate interests pursued by the Data Controller or a third party, unless the interests or fundamental rights and freedoms of the Web User and/or the Professional which require protection of personal data take precedence, in particular where the Web User is a child.

– The Data Controller may have a legitimate interest justifying the processing of the Personal Data of the Web User and/or the Professional, such as the processing of the subject of a contact by a Web User and/or a Professional.

– In this case, the Data Controller shall ensure that the processing in question is indeed necessary for the fulfilment of its legitimate interest and assess the consequences of such processing on the Web User and/or the Professional, particularly taking into account the nature of the Data processed, and the manner in which it is processed.

– The Data Controller shall ensure that it does not violate the interests or fundamental rights and freedoms by allowing the Web User and/or the Professional, at any time, to oppose all or part of the processing described in this Privacy Policy, as well as to implement its Specific Rights, under the conditions of paragraph 9 – Exercise of the Specific Rights of Web Users and Professionals.

• Purposes of processing

The Personal Data of the Data Subject is necessary to allow the Website to be accessed, used and improved, as well as the consultation of the Fill-Med Content and to enable the Data Controller to :

– send to the Data Subject who has subscribed to the “Newsletter” and to Professionals who have read Fill-Med Content, information emails relating to the activity of the Data Controller;

– personalise its communication for Professionals, in particular for information emails, according to its noted preferences, its use of the services and/or Fill-Med Content and/or the Website;

– respond to requests for information from the Web User and/or Professional;

– carry out commercial solicitations;

– develop commercial statistics, analyses and marketing tools (in particular classification, score, etc.);

– allow access to the Account by the Professional, in particular Services reserved for Professionals;

– identify the Professional on the databases of the Data Controller’s subsidiaries in order to prevent fraud;

– optimise the Professional’s navigation of the Website by remembering its Identification Elements;

– manage requests to exercise the Specific Rights under the conditions of paragraph 10 – Exercise of the Specific Rights of Web Users and/or Professionals;
preserve evidence in the event of litigation related to the use of the Website;

– comply with its legal obligations, in particular the health vigilance mechanisms provided for by the Public Health Code and in particular the collection, recording, analysis, monitoring, documentation, management of contacts, transmission and storage of Data relating to all adverse health events.

• Storage of Personal Data

– The Website is hosted by the company whose contact details are available by clicking here Legal Notices.

– All precautions have been taken to store the Personal Data of Web Users and/or Professionals in a secure environment and to prevent it from being distorted, damaged or accessed by unauthorised third parties. The information transmitted by the Web User and/or Professional will never be passed on to third parties for a commercial purpose or sold or exchanged.

• Collection of Personal Data on the Website

– Upon request for information made via the contact form here, the Data Controller collects the following Personal Data that the Data Subject provides and which is kept for a period of three (3) years on an active basis from the last request of the Data Subject, and then two (2) years in Intermediate Archiving:

• Surname,
• First name,
• Email address,
• Country,
• Telephone number
• Any comment(s) accompanying the request for information,

– When creating the Account, the Data Controller collects the following Personal Data that the Professional provides or communicates spontaneously during their browsing and which is kept for a period of three (3) years, on an active basis, from the last connection of the Professional to the Website and then two (2) years in Intermediate Archiving :

• Surname,
• First name,
• Email address,
• Country,
• RPPS Number / Physician National Identification Number
• Specialism

– The connection data (date, time, IP address, pages visited) of the Web User and/or the Professional while browsing the Website, including votes made by the Web User, are retained for a period of one (1) year.

– Data collected and processed to manage health vigilance is kept on an active basis during the current period of use of the Data and is then kept in intermediate archiving for the legal or regulatory period applicable to each health vigilance for a maximum of seventy years from the date of withdrawal from the market of the device or product, in the absence of a legal or regulatory period.

• Recipients or categories of recipients where applicable

– Only the authorised employees of the Data Controller may, under the latter’s responsibility, access the Personal Data for each purpose, within the limits of their respective duties.

– In the event of a transfer of Personal Data to a recipient located in a country which is not located within the territory of the European Union and which has not been the subject of an adequacy decision by the European Commission, the Data Controller undertakes to take all appropriate guarantees to ensure its full lawfulness in accordance with the Personal Data Regulations.

• Specific Rights

– In accordance with the Personal Data Regulations, the Data Subject may, at any time, benefit from the following Specific Rights of:

• access,
• rectification,
• erasure,
• limitation of processing,
• portability,
• opposition,
• post-mortem instructions.

– To the extent that the processing related to the management of an adverse health event is based on compliance with a legal obligation, Data Subjects have neither the right to object, nor the right to erasure of the Data, nor the right to the portability of the Data.

• Right of access

– The Web User and the Professional have the option to obtain from the Data Controller confirmation that their Personal Data is or is not processed and, where it is, access to such Personal Data as well as the following information:

• the purposes of the processing;
• the categories of Personal Data;
• the recipients or categories of recipients to whom the Personal Data has been or will be disclosed;
• where possible, the retention period of the Personal Data envisaged or, where this is not possible, the criteria used to determine this period;
• the existence of the right to request rectification or erasure of Personal Data from the Data Controller, or a restriction on the processing of their Personal Data, or the right to object to such processing;
• the right to lodge a complaint with the supervisory authority for personal data (in France, the CNIL);
• where Personal Data is not collected from the Web User and/or the Professional, any information available as to its source;
• the existence of automated decision-making, including profiling, and, at least in such case, useful information concerning the underlying logic, and the extent and intended consequences of such processing for the Web User and/or Professional;

– Where Personal Data is transferred to a third country or international organisation, the Web User and the Professional shall have the right to be informed of the appropriate safeguards in respect of such transfer.

– The Data Controller shall provide a copy of the Personal Data subject to processing.

– The Data Controller may require the payment of reasonable costs based on administrative costs for any additional copies requested by the Web User and/or Professional or in the event of a request to transmit Personal Data in paper and/or physical form.

– When the Web User and/or the Professional submit their request electronically, the information shall be provided in a commonly used electronic form, unless otherwise requested.

– The right of the Web User and the Professional to obtain a copy of their Personal Data must not infringe the rights and freedoms of others.

• Right of rectification

– The Web User and the Professional have the right to obtain from the Data Controller, as soon as possible, the rectification of their Personal Data which is inaccurate. They also have the possibility of having incomplete Personal Data completed, including by providing an additional declaration.

• Right of erasure

– The Web User and the Professional have the option to obtain from the Data Controller, as soon as possible, the erasure of their Personal Data when one of the following applies:

• The Personal Data is no longer necessary for the purposes for which it was collected or otherwise processed by the Data Controller;
• The Web User and/or Professional have withdrawn their consent for the processing of their Personal Data and there is no other legal basis for the processing;
• The Web User and/or Professional exercise their right of objection under the conditions set out below and there are no compelling legitimate grounds for the processing;
• The Personal Data has been unlawfully processed;
• The Personal Data must be deleted to comply with a legal obligation;
• Personal Data has been collected from a child

• Right of limitation

– The Web User and/or Professional have the option to obtain from the Data Controller the restriction of the processing of their Personal Data where one of the following applies:

• The Data Controller verifies the accuracy of the Personal Data following the objection by the Web User and/or the Professional regarding the accuracy of the Personal Data,
• The processing is unlawful and the Web User and/or the Professional oppose the erasure of Personal Data and require the restriction of its use instead;
• The Data Controller no longer needs Personal Data for the purposes of the processing but it is still necessary for the Web User and/or the Professional for the establishment, exercise or defence of legal claims;
• The Web User and/or the Professional has objected to the processing under the conditions set out below and the Data Controller verifies whether the legitimate reasons pursued prevail over the alleged grounds.

• Right of data portability

– The Web User and the Professional have the option to receive their Personal Data from the Data Controller in a structured, commonly used and machine-readable format when:

• The processing of Personal Data is based on consent; and
• Processing is carried out using automated processes.

When the Web User and the Professional exercise their right of portability, they have the right to have Personal Data transmitted directly by the Data Controller to another data controller they designate where technically possible.

The right of portability of the Personal Data of the Web User and the Professional must not infringe the rights and freedoms of others.

• Right of objection

– The Web User and the Professional may object at any time, for reasons relating to their particular situation, to the processing of their Personal Data based on the legitimate interests of the Data Controller. The latter shall then no longer process the Personal Data, unless it demonstrates that there are compelling and legitimate grounds for processing which prevail over the interests and rights and freedoms of the Web User and/or the Professional, or may retain it for the establishment, exercise or defence of legal claims.

– The Professional and the Web User may at any time object to the sending of commercial solicitations, including newsletters. In accordance with the terms and conditions set out in section 9 of this Privacy Policy or by clicking on the link provided in the last commercial solicitation sent by email.

• • Post-mortem instructions

– The Web User and the Professional have the option to communicate instructions to the Data Controller regarding the retention, erasure and sharing of their Personal Data after their death; these instructions may also be recorded with “a certified digital trusted third party”. These instructions, or sort of “digital will”, may designate a person responsible for their execution; failing this, the heirs of the Web User and/or the Professional shall be designated.

– In the absence of any instructions, the heirs of the Web User and the Professional may contact the Data Controller in order to:

• access the processing of Personal Data allowing “the organisation and settlement of the estate of the deceased”;
• receive communication of “digital property” or “data such as family mementos that are transferable to heirs”;
• have the Professional Account closed on the Website and oppose the continued processing of its Personal Data.

– In any event, the Web User and the Professional have the option to inform the Data Controller, at any time, that they do not wish for their Personal Data to be communicated to a third party in the event of their death.

⦁ Exercise of the Specific Rights of Web Users and/or Professionals

These Specific Rights may be exercised at any time with the Data Controller:

By email to the following address:
dpo@ydes-avocats.com

By post to the following address:
Laboratoires FILL-MED
Service en charge des données personnelles
38 cours Albert 1er, 75008 Paris

For the purpose of asserting its Specific Rights in accordance with the conditions set out above, the Data Controller may ask them to prove their identity by mentioning their full name and email address and to accompany their request with a copy of a valid identity document, such as any information or document likely to confirm their identity.

A response will be sent to the Data Subject within a maximum of one (1) month from the date of receipt of the request.

If necessary, this period may be extended by two (2) months by the Data Controller who will notify the Data Subject thereof, taking into account the complexity and/or number of requests.

The Web User and/or the Professional may also lodge a complaint with the competent supervisory authority (In France, the ⦁ CNIL).

⦁ Password security

The Data Controller shall take all necessary precautions to ensure the secure storage of the Professional’s password to access their Account.

However, the security of this password also depends on its design.

The Professional is also reminded that in order to be valid, their password must comprise at least 8 characters, including at least 3 of the following 4 types: capital letters, lower case letters, figures, special characters

Mnemonics make it possible to create complex passwords, such as:

⦁ Keep only the first letters of the words in a sentence; for example, the sentence “One Password to remember!” becomes the password, 1pw@2r!
⦁ Capitalized if the word is a noun (e.g.: word)
⦁ Keeping punctuation marks (e.g.: !)
⦁ Expressing numbers using figures from 0 to 9 (e.g: One -> 1)

Cookies saved on the Web User’s and/or Professional’s Terminal following their browsing on the Website

Cookies are used on the Website.

A cookie is information stored on the Terminal that is used by the Web User and/or the Professional to access the Website.

Cookies are linked to the browsing of the Web User and/or the Professional on the Website and make it possible to determine the pages they have visited, and the date and time of consultation.

At no time do these cookies allow the Data Controller to personally identify the Web User and/or the Professional.

More specifically, the Personal Data collected from cookies issued by the Data Controller or third parties allow:

statistics and volumes of visits and use of the Website to be established in order to improve the interest and ergonomics of the services;

information relating to a form completed by the Professional on the Website (access to your Account) to be stored;

• Objection to cookies

The Web User and/or the Professional are informed, during their first visit, of the presence of cookies and their identity as well as that of their issuer by a banner and are invited to indicate their choice.

Cookies will only be stored if the Web User and/or the Professional accepts them.

The Web User and/or the Professional may at any time find further information and configure cookies by [complete and return to cookie settings]