1. About this policy
DiaDeep takes the protection of personal data seriously. This policy explains how we collect, use, share, and protect the personal data of everyone who interacts with us, visitors to www.diadeep.com (the “Website”), prospects, partners, clients, employees, job applicants, contacts, investors, service providers, patients, and contractors (together, “you”).
We process personal data in line with the General Data Protection Regulation (EU) 2016/679 of 27 April 2016 (“GDPR”) and other applicable data protection law. This policy is written to meet our transparency obligations under Articles 12 to 14 of the GDPR: it tells you what data we collect, why, on what legal basis, who can access it, how long we keep it, and how you can exercise your rights.
It covers only the personal data for which DiaDeep acts as data controller. Some of our processing is carried out on our behalf by processors we have appointed; that processing remains within the scope of this policy. Where a specific situation calls for it, a particular product, study, or contractual relationship, we may provide you with a separate, more targeted privacy notice or consent form. That notice takes precedence over this policy for the situation it covers.
A few terms are used throughout this policy:
- Controller means DiaDeep, which decides why and how personal data is processed.
- Processor means any person or organisation that processes personal data on DiaDeep’s behalf.
- Recipient means anyone, inside or outside DiaDeep, who receives personal data from us, including our own staff and external partners such as healthcare organisations, healthcare professionals, suppliers, service providers, clients, banks, or agents.
- You or data subject means the individual the personal data relates to.
- Personal data means any information that can identify you, directly or indirectly, a name, an identification number, location data, an online identifier, or details specific to your physical, physiological, mental, economic, cultural, or social identity.
If we introduce a new use of your data, or change or discontinue an existing one, we will publish an updated version of this policy on the Website. We encourage you to check back periodically.
2. The data we collect
What we collect depends on your relationship with us and, where relevant, on the third parties who share data with us. Depending on the circumstances, this may include:
Identity and contact details, name, date of birth, username, email address, postal address, and phone number, notably where needed to send you a newsletter.
Professional information, your employer, job title, and, if you apply for a role with us, your professional experience and education.
Financial information, bank or payment details, where a transaction requires them.
Contractual information, data relating to agreements currently in place between you and DiaDeep.
Technical and usage data, your browsing activity on the Website (pages viewed, forms completed, links clicked, IP address), and information about the browser, operating system, or device you use.
Some of our research and development work may require us to process special categories of data under Article 9 of the GDPR. When it does, we apply additional contractual, technical, and organisational safeguards to protect it.
3. Why we process your data
We only process personal data that relates to, or is needed for, our activities, and only where that processing is consistent with the GDPR’s core principles. The main purposes are set out below; this list is not exhaustive, and we will update this policy if it changes materially.
Running our business. Managing our relationships with contacts, prospects, partners, clients, suppliers, and service providers; negotiating and administering the agreements we sign with academic partners (hospitals, universities, research centres, healthcare professionals) and non-academic partners (pharmaceutical, software, or other corporate partners); invoicing and accounting.
Research and development. Carrying out market research and scientific studies, clinical, observational, or post-market, including projects that reuse data already held by DiaDeep or its partners, or that draw on human biological samples available through our partners.
Meeting our legal, regulatory, and ethical obligations. Designing, developing, manufacturing, and marketing software as a medical device for diagnostic, prognostic, and screening support in pathology, including the vigilance and post-market surveillance that come with it; administrative filings, registrations, and audits, including those tied to recruitment and to our relationships with healthcare professionals, organisations, and institutions; complying with industry standards and our own internal policies; keeping personal data secure, including processing the names of anyone who has exercised their data protection rights with us, so that we can act on their request.
Marketing. Running campaigns by email, SMS, phone, or media advertising; publishing our newsletter; targeted advertising and audience segmentation; organising or sponsoring events; social media engagement (registrations, posts, likes, comments); surveys and statistics.
Recruitment. Managing job postings and applications, and the pre-contractual relationship this creates with candidates.
Running the Website. Operating features such as case studies and contact forms.
Protecting our rights. Investigating, and where necessary pursuing or defending, legal claims; protecting DiaDeep’s rights and property, including intellectual property, safety, and privacy, and those of third parties; guarding against fraud or other acts that could harm DiaDeep.
We may derive aggregated or anonymised usage statistics from the personal data you provide, to help us understand and improve our services. These statistics do not identify you and remain subject to the same rights described in this policy wherever they are not fully anonymised.
4. Our legal basis for processing
Every use of your data described above rests on one of the following legal grounds.
Legitimate interest. Where we rely on our own or a third party’s legitimate interest, we first weigh that interest against your fundamental rights, to make sure the balance does not tip against you. We do this, for example, to guard against fraud, to carry out research and development, to manage business relationships, and to send professional newsletters to healthcare professionals and contractors we already work with.
Legal obligation. We process some data simply because the law requires it, for instance, to monitor adverse events or product deficiencies, to meet transparency requirements around our relationships with healthcare professionals and institutions, to fulfil financial and tax reporting duties, or to respond to your requests to exercise your rights.
Consent. Where we ask for your explicit agreement, signing up to our newsletter, for example, we process your data only on that basis, and only for the purpose you agreed to.
Performance of a contract. We process data where it is necessary to negotiate or perform a contract with you, your employer, or the organisation you represent, our partners, suppliers, service providers, and clients.
Public interest. Where local law allows it, we may process data in the public interest, for example, to support research aimed at improving the safety or quality of medical devices, whether ours or a third party’s.
5. Where your data comes from
Most of the personal data we hold comes directly from you. Some of it reaches us indirectly, through partners, clients, service providers, or suppliers who are authorised to share it under their own applicable law and privacy practices. When that happens, we take care to check the quality of what we receive; if you have questions about how one of these organisations first collected your data, we can point you to them or to their own privacy policy.
6. Children’s data
The Website is not directed at children under thirteen, and we do not knowingly collect personal data from anyone under that age. If you are a parent or guardian and believe your child has shared personal data with us through the Website, please contact our Data Protection Officer (see Section 14) so we can delete it promptly.
7. Who we share your data with
We limit access to personal data to the people and organisations who genuinely need it for the purposes described above.
Inside DiaDeep, that may include our Communications and Marketing, Partnerships and Business Development, Medical Devices, R&D, Finance, IT, Legal, People, and Product teams, as well as staff responsible for internal control and audit.
Outside DiaDeep, it may include our partners (hospitals, research centres, universities, healthcare professionals, service providers, suppliers, pharmaceutical or other corporate partners); public authorities, where the law requires disclosure; and, in the event of a merger, acquisition, or similar corporate transaction, a prospective acquirer or other party involved in that transaction.
Everyone who receives personal data from us is bound by confidentiality, whether by contract or internal policy, and only ever receives what is strictly necessary. If an authority is legally entitled to receive data from us, we comply, but we are not responsible for how that authority subsequently handles it, and we limit what we hand over to the minimum required.
We do not sell personal data to anyone.
8. Transfers outside the EEA
If any of the processing described in this policy requires us to send data from someone in the European Economic Area to a recipient outside it, a service provider or partner, say, we make sure appropriate safeguards are in place first. Depending on the destination, that might mean relying on a European Commission adequacy decision under Article 45 of the GDPR, or putting Standard Contractual Clauses or another approved legal mechanism in place with the recipient.
9. How long we keep your data
We keep personal data only as long as our legal and contractual obligations require, or as long as is otherwise necessary, guided by the following:
- Clients and partners: for the life of our contractual relationship, including any warranty period, plus five years to cover legal requirements.
- Job applicants: two years from the date we receive your data, unless you ask us to delete it sooner. We may ask whether you would like us to keep it for a further two years.
- Contacts and prospects: three years from our last contact with you, or from when we first collected your data.
- Payment details: until payment is complete, or until the goods or services have been delivered, extended, where applicable, by the statutory withdrawal period for distance sales.
These periods apply without prejudice to any longer retention or limitation period the law may separately require. Once data has been deleted or anonymised, we cannot restore it or reconstruct any link between it and you, which also means that, from that point on, we can no longer act on a request to exercise your rights over that data.
10. Your rights
Data protection law gives you the following rights over your personal data:
Access. You can ask us to confirm whether we hold data about you, and to receive a copy of it. If you ask for it electronically, we will normally provide it in a common electronic format. This right does not extend to confidential information or data whose disclosure is restricted by law, and we may decline requests that are clearly abusive, made, for example, purely to disrupt our operations.
Rectification. You can ask us to correct data that is inaccurate, incomplete, or out of date.
Objection. You can object to our processing of your data, subject to any legal exception that applies. You can unsubscribe from our newsletter at any time using the link at the bottom of every email.
Erasure. You can ask us to delete your data where, for example, it is no longer needed for the purpose it was collected for, you withdraw consent and no other legal basis applies, you object to processing based on our legitimate interest and we have no overriding reason to continue, you object to it being used for marketing, or it has been processed unlawfully. This right does not apply where processing is required by law or needed to establish, exercise, or defend legal claims. Like the other rights listed here, it is personal to you and can only be exercised over your own data.
Restriction. You can ask us to limit how we use your data in certain circumstances, though this right does not apply where processing is required by law or necessary to deliver our services.
Portability. Where data you gave us directly is processed on the basis of your consent through one of our own online services, you can ask to receive it in a structured, commonly used, machine-readable format.
Automated decisions. DiaDeep does not make decisions about you based solely on automated processing.
Instructions after death. You can tell us in advance how you would like your data handled after you die, retained, deleted, or shared, as you specify.
To exercise any of these rights, write to us at dpo@diadeep.com with a copy of a signed identity document. We need this to confirm it is really you asking, and we destroy the document once we have verified your identity. We aim to respond within a reasonable time, though this can take longer if your request is complex or if we are handling a high volume of requests. Even after we act on a deletion request, we keep a limited record of the request itself, so that we can demonstrate we handled it properly.
11. Processors we work with
We may appoint processors to handle personal data on our behalf. When we do, we hold them to the same data protection obligations we follow ourselves, set out in a written contract, and we reserve the right to audit their compliance with the GDPR.
12. How we protect your data
We maintain technical and organisational measures designed to keep your data secure and confidential, calibrated to the state of the art, the cost of implementation, and the nature and risk of the processing involved. These measures include, among others: controlling who can access personal data; maintaining internal back-ups; verifying identity before granting access; running security audits; maintaining an IT security policy; keeping business continuity and disaster recovery plans in place; and using appropriate security protocols and tools.
13. If a data breach happens
If a breach affecting personal data occurs, we will notify the competent supervisory authority as the GDPR requires. Where a breach poses a high risk to you and your data was not adequately protected, we will also notify you directly, along with any guidance you need to protect yourself.
14. Our Data Protection Officer
Our appointed Data Protection Officer can be reached at:
- Name: Life Avocats
- Email: dpo@diadeep.com
- Phone: +33 4 82 54 55 70
You can contact our DPO with any question about how we handle your data, or if you run into a problem you would like us to resolve.
15. Records and complaints
As data controller, we maintain a record of our processing activities and will make it available to a supervisory authority on request, so it can verify that our processing complies with data protection law.
If you believe our processing of your data breaches applicable law, you have the right to lodge a complaint with your local supervisory authority. Within the EU, you can find contact details for each national authority via the European Data Protection Board: https://www.edpb.europa.eu/about-edpb/about-edpb/members_en. In the UK, complaints can be filed with the ICO: https://ico.org.uk/make-a-complaint/.
16. Changes to this policy
We may update this policy from time to time, to reflect a change in the law, guidance from a regulator, or a change in how we operate. The current version is always available on this page, and we encourage you to review it periodically. For general information about data protection beyond the scope of this policy, your local supervisory authority’s website is a good starting point.
17. Contact us
Questions about this policy, or about how we handle your personal data, can be sent to dpo@diadeep.com.