MN Santé Holding places the protection of personal data at the heart of its missions and the services it offers you. This Policy sets out the principles and guidelines for the protection of your Personal Data and aims to inform you about :
This Policy applies to the processing of Personal Data in the context of the provision of MN Santé Holding services and products, excluding any partner sites. All operations involving your Personal Data are carried out in compliance with the regulations in force and in particular with the European regulations on the protection of personal data, the French law n°78-17 "Informatique, Fichiers et Libertés" of 6 January 1978 as amended and its application decrees.
MN Santé Holding is committed to taking into account the protection of your Personal Data and your private life from the very beginning of the design of new products or services offered to you. To ensure security and guarantee the respect and proper exercise of your rights, measures are implemented to ensure the protection of your personal data.
MN Santé Holding undertakes to only collect data that is strictly necessary for the direct or indirect provision of the services subscribed to when they require the processing of customers' personal data.
In the event that you are asked for optional data, MN Santé Holding will clearly inform you of the Personal Data that is essential for the performance of the subscribed service.
Personal Data is collected directly from you and is used only for the purposes for which you have been notified.
Personal data is used to offer you other services, only if you have agreed to receive commercial communications.
Certain data processed by MN Santé Holding is collected indirectly from the following sources :
In the event of indirect collection, MN Santé Holding undertakes to inform individuals in accordance with the conditions set out in Article 14 of the GDPR.
Some services may be used by minors. In this case, minors must obtain the consent of their parents or legal representatives.
Depending on the personal data processing implemented, MN Santé Holding acts as a Data Controller or Subcontractor for its customers. When MN Santé Holding acts as a Data Controller, the purposes of the processing carried out and the length of time the Personal Data is kept are set by MN Santé Holding.
You can consult the purposes of the processing operations as well as their legal basis and the retention periods for personal data resulting from the processing operations carried out by MN Santé Holding, in its capacity as Data Controller, by clicking on the following link: Processing of Personal Data implemented in the context of MN Santé Holding's services and processing
Generally speaking, the purposes, the retention period and the legal basis differ according to the services and products concerned. At the end of the retention periods, the Personal Data are anonymized or permanently deleted
When MN Santé Holding acts as a Subcontractor for its customers, the purposes of the processing and the length of time the Personal Data is kept are determined by the customer who is responsible for processing. In this context, MN Santé Holding only acts on the instructions of the Data Controller. The processing operations for which MN Santé Holding acts as a Subcontractor are specified in the table accessible by clicking on the following link : Processing for which MN Santé Holding acts as a subcontractor
For any information on the retention periods for Personal Data processed by MN Santé Holding as a subcontractor, we invite you to contact the healthcare establishment, which is responsible for processing, and which provided for the opening of your account on one of MN Santé Holding's solutions for monitoring your health.
Healthcare facilities may be subject to legal obligations to retain Personal Data, on their own environments, for longer periods than those set forth in this Data Protection Policy.
The personal data that you communicate to MN Santé Holding may be transmitted to the following recipients :
The Personal Data processed by MN Santé Holding is hosted within the European Union (EU) or the European Economic Area (EEA). However, for certain specific services, MN Santé Holding may use subcontractors established outside the EU or the EEA (for example, in the United States). These subcontractors may have access to Personal Data that is strictly necessary for the performance of their tasks. In this case, in accordance with the regulations in force, MN Santé Holding requires its subcontractors to provide appropriate guarantees, in particular the signing of standard contractual clauses by the European Commission or the adoption by the latter of Binding Corporate Rules.
MN Santé Holding is committed to taking all measures to ensure the security and confidentiality of Personal Data.
In particular, MN Santé Holding implements all the technical and organisational measures required to guarantee the security and confidentiality of the Personal Data collected and processed and in particular to prevent it from being distorted, damaged or communicated to unauthorised third parties, by ensuring a level of security adapted to the risks associated with the processing and the nature of the personal data to be protected.
The treatments performed may be subject to audit.
Furthermore, in the event of a personal data breach, as defined in Article 4 of the GDPR, affecting your Personal Data (destruction, loss, alteration or disclosure), MN Santé Holding undertakes to comply with the obligation to notify Personal Data breaches, notably to the CNIL.
This includes the right to ask us for additional information on:
The user understands that the aforementioned rights may be tempered, if the legal basis for the processing so justifies, without impeding the principle of non-maleficence.
You can contact the Data Protection Officer at the following address :
MN SANTE - Monsieur le délégué à la Protection des Données
9 RUE DU COLONEL PIERRE AVIA, 75015 PARIS 15
Or by email at the following address :
dpo-mns@careside.care
If you believe, after having contacted us, that your rights on your data are not respected, you can address a complaint to the Commission Nationale de l'Informatique et des Libertés (3 place de Fontenoy - TSA 80715 – 75334 Paris cedex 07 ; tél. : 01 53 73 22 22).
SERVICES | PURPOSE | LEGAL BASES | SHELF LIFE |
---|---|---|---|
Contact requests sent by users via the form « Contact » accessible in the menu and in the footer of the site MN Santé Holding |
|
Consent | Retention for 3 years after the last contact with MN Santé Holding. |
Contact requests sent by : - the professionals of the health institutions transmitted via the form « Tell us about your e-health projects » - or journalists via the "send an email" button accessible in the button « CONTACT » available on the site |
|
Consent | Retention for 3 years after the last contact with MN Santé Holding. |
Subscribe to the Newsletter via the dedicated form on the website |
|
Consent Performance of the service (contract) |
Storage of the necessary data for the duration of the subscription to the newsletter. |
Recruiting Submit your application via the dedicated form available on MN Santé Holding |
|
MN Santé Holding's legitimate interest in recruiting candidates | Data retention for the duration of the recruitment process and 2 years from the last contact with the candidate |
SERVICES | PURPOSE | LEGAL BASES | SHELF LIFE |
---|---|---|---|
Commercial prospecting by MN Santé Holding |
|
Legitimate interest of MN Santé Holding, with regard to prospecting: - by telephone; - by electronic means when it is intended for persons who are already customers and when the prospecting concerns products and services similar< br> to those already subscribed by these persons; Consent of the prospects/customers regarding electronic prospecting (SMS, email) |
Retention for 3 years from the last contact or until consent is withdrawn |
Management of commercial activities |
|
Performance of the service (contract) Consent Legitimate interest (improving the quality of service) |
Conservation for the entire duration of the contractual relationship,
For the realization of satisfaction surveys: |
Health vigilance management |
|
Legal obligation |
Retention of data in the active database for as long as necessary Data retention in intermediate database 10 years after Once the retention periods have expired, the data will be deleted |
Post-Market Surveillance |
|
Legal obligation |
Retention of data from analytical documents At the end of the retention period, |
Official requests from public or judicial authorities empowered to do so |
|
Legal obligation |
Retention for the duration of the procedure, The limitation period of common law in civil and commercial matters |
Detection, prevention and fight against fraud and cybercrime |
|
Legitimate interest (fight against counterfeiting, fight against fraud, fight against cybercrime, ...) |
Retention for the duration of the qualification of an alert for fraud |
Detection, prevention and fight against fraud and cybercrime |
|
Legitimate interest (fight against counterfeiting, fight against fraud, fight against cybercrime, ...) |
Retention for the duration of the qualification of an alert for fraud Alerts not qualified at the end of Qualified alerts are retained for a maximum of five (5) years |
Management of requests to exercise rights |
|
Legal obligation |
Retention of data related to the processing of your requests for 5 years |
SERVICES | PURPOSE | LEGAL BASES | SHELF LIFE |
---|---|---|---|
Creation of a User account on the Solutions implemented by the healthcare facility (patients, employees of the healthcare facility) |
|
Execution of the contract concluded with the Client (Health Care Facility) Consent of the persons collected by the health establishment subscribing the service |
Retention of data necessary for the management of the account until the account is deleted |
Provision of a Remote Medical Monitoring Solution and Services (management of the remote monitoring of patients who have subscribed to the service offered by their health establishment as part of the monitoring of their care pathway) |
|
Execution of the contract concluded with the Client (Health Care Facility) Patient consent collected on behalf of the health establishment, responsible for processing, which implements the remote medical monitoring solution |
Defined by the health care facility : Duration of the patient's course of care with the health care facility + retention period specific to health care institutions in accordance with the regulations applicable to them |
Management of the care pathways of patients in health care institutions according to the health protocols defined by the latter |
|
Execution of the contract concluded with the Client (Health Care Facility) Patient consent collected on behalf of the healthcare facility implementing the Remote Medical Monitoring Solution |
Defined by the health care facility : Duration of the patient's course of care with the health care facility + retention period specific to health care institutions in accordance with the regulations applicable to them |
Management of support requests from healthcare institutions on the operation of the Solutions |
| Execution of the contract concluded with the Client (Health Care Facility) | Retention of data for the duration of the contract concluded with the Customer |
Support for healthcare institutions in the event of complaints and requests to exercise the rights of users of the Solutions (patients, employees of the healthcare institution) (Health care institutions manage their patients' complaints and requests to exercise their rights as data controllers) |
|
Execution of the contract concluded with the Client (Health Care Facility) | Retention of data relating to the processing of requests for assistance from the institution, in the context of a dispute, for 5 years from the receipt of the request. |
Conducting surveys on behalf of the client healthcare institution (example: satisfaction survey, survey on the use of the Solution, quality of the remote monitoring set up...) |
|
Execution of the contract concluded with the Client (Health Care Facility) Legitimate interest of the health care institution Patient consent collected as part of the survey |
Retention for 1 year from the date of the investigation. |
Clinical studies and research conducted by the client healthcare facility using data collected as part of the Remote Monitoring Solution implemented by the healthcare facility |
|
Execution of the contract concluded with the Client (Health Care Facility) Patient consent obtained by the health care institution, responsible for the treatment, within the framework of the study/research protocol set up by it |
Defined by the health care institution: Retention period specific to health care institutions in accordance with the regulations applicable to them for clinical research |