Policies

Privacy policy

Version of December 5th, 2023

‍

1. Recitals

The protection of individuals with regards to the processing of their Personal Data (as defined below) is a fundamental right that Bioptimus, takes very seriously.

Bioptimus processes Personal Data as part of its relations with its visitors, its prospects, partners, clients, employees, job applicants, contacts, investors, services providers, patients, contractors and any users of its website: www.bioptimus.com (the “Website”) (all together the “Individuals”).

Bioptimus is firmly committed to conducting its business in accordance with the applicable data protection regulations and, in particular, the General Data Protection Regulation (EU) 2016/679 of April 27th, 2016 (“GDPR”), which aims to protect individuals’ rights with regards to the collection, use, retention, transfer, disclosure and destruction of their Personal Data.

The purpose of this privacy policy (“Privacy Policy”) is to set forth the types of Personal Data Bioptimus may receive from Individuals’ interactions with Bioptimus notably through its media platforms. 

Bioptimus strives to ensure adequate protection of Individuals’ Personal Data and to preserve the protection and security of Individuals’ Personal Data, as well as inform and uphold Individuals on their rights.

What Personal Data Bioptimus is collecting and processing about Individuals? Why is Bioptimus processing Individuals’ Personal Data? What are the legal basis that entitled Bioptimus to do so? From what sources does Bioptimus collect Individuals’ Personal Data? Who are the authorized parties allowed to process Individuals’ Personal Data by Bioptimus? How does Bioptimus ensure the security and the protection of Individuals’ Personal Data? How long will Bioptimus keep Individuals’ Personal Data? What are Individuals’ rights regarding the processing made by Bioptimus on Individuals’ Personal Data? How can Individuals exercise their rights? 

Please read the following Privacy Policy carefully and note that the following definitions will apply to this Privacy Policy: 

• Data Controller(s): Bioptimus.
• Data Processor(s): natural person or legal entity who processes Personal Data on behalf of Bioptimus. 
• Data Recipient(s): individual or legal entity who receives Personal Data from Bioptimus. Data Recipients may therefore also be employees of Bioptimus or of external entities (e.g. partners such as healthcare organizations or healthcare professionals, suppliers, services providers, clients, exhibitors, banks, agents etc.).
• Data Subject(s): the Individuals.
• Personal Data: refers to any information or pieces of information that can directly or indirectly identify a Data Subject, such as a name, an identification number, location data, an online identifier, or one or more factors specific to the physical, physiological, genetic, mental, economic, cultural, or social identity of that individual.

2. Objective

The purpose of this Privacy Policy is to meet the information obligation of Bioptimus under the GDPR (Article 12 to 14) and to document the rights of the Individuals regarding the processing of their Personal Data.

3. Scope

This Privacy Policy applies to all processing of Individuals’ Personal Data. 

Bioptimus makes every effort to ensure that Personal Data is processed within the framework of strict internal governance. That being said, this Privacy Policy only covers Personal Data of which Bioptimus is the Data Controller and therefore not any processing that may be established or performed outside the scope of governance specified by Bioptimus.

The processing of Personal Data may be managed directly by Bioptumus or via Data Processors specifically designated by Bioptimus.

This Privacy Policy is independent of any other document that may apply in the context of the contractual relationship between Bioptimus and the Individuals. Specific privacy and data protection information’s notices and/or consent or non-opposition form, will be communicated to the concerned Individuals if necessary, regarding specific situations where Bioptimus may process Personal Data.

4. Purposes

Bioptimus does not process any Personal Data of Data Subjects if not relating to the Personal Data collected by or for its departments or processed in association with its departments and if it does not comply with the general principles of the GDPR. 

Bioptimus may process Personal Data for the following purposes:

Although the list is intended to be as exhaustive as possible, any new use or modification or withdrawal of any existing processing will be notified to the concerned Data Subjects by the publication of new versions of this Privacy Policy on the Website. Bioptimus invites the Data Subjects to check online this Privacy Policy on a regular basis to be aware of this new use, modification, or withdrawal of any existing processing.

Bioptimus is granted by the Individuals with a right to process their Personal Data for the aforementioned purposes. However, any data supplemented by the processing and analysis of Bioptimus, otherwise known as supplemented data, shall remain the exclusive property of Bioptimus (usage analysis, statistics, etc.).

5. Lawfulness of the processing conducted by Bioptimus

The purposes for which Bioptimus process Personal Data described above are based on the legal basis described below.

The Personal Data that Bioptimus is processing about Data Subjects, includes a wide range of Personal Data and depends on Bioptimus' relationship with the Data Subjects, as well as the third parties with which Bioptimus is working, and which may provide Bioptimus with the access to Personal Data.

For example, Bioptimus may process the following Personal Data:

In some cases, notably for its research and development activities, Bioptimus may need to process sensitive Personal Data, as defined by the Article 9 of the GDPR. Bioptimus takes the protection of this sensitive Personal Data and more broadly the protection of all the Personal Data very seriously and takes all necessary measures, whether contractual, technical or organization to preserve the protection, integrity, and confidentiality of such Personal Data. 

As provided above, specific privacy and data protection information’s notices and/or consent or non-opposition form, will be communicated to the concerned Data Subjects if necessary, regarding specific situations where Bioptimus may process their Personal Data.

6. Personal data sources

Personal Data is generally collected from Data Subjects directly (direct collection). 

Collection may also be indirect via specialized partners, clients, service providers and suppliers of Bioptimus, which are authorized to do so in compliance with their applicable law and in application of their own privacy and data protection policies.

In such cases, Bioptimus takes the greatest of care to ensure the quality of data it receives. If Data Subjects have any question related to the initial collection of their Personal Data by the partner, client, services provider, or supplier of Bioptimus, where applicable Bioptimus could invite Data Subjects concerned to contact them directly and/or to refer to their data protection policies.

7. Children's personal data

Bioptimus’s Website is not intended for children under thirteen (13) years old. Bioptimus does not knowingly process Personal Data from children under the age of thirteen (13) years old through Bioptimus’ Website. 

If a parent or a guardian becomes aware that his or her children has provided Personal Data to Bioptimus through Bioptimus’ Website, he or she should contact Bioptimus’ Data Protection Officer without delay to require the deletion of the Personal Data concerned in accordance with the applicable data protection laws. 

For more information on how to contact Bioptimus’ Data Protection Officer, please see Article 15 (“Data Protection Officer”) of this Privacy Policy.

8. Personal data recipients

Taking into account the purpose(s) for which Individuals’ Personal Data are processed, Bioptimus will ensure that Personal Data can only be accessed by authorized internal and external Data Recipients which need to know them.

Data Recipients of the Personal Data are bound by a confidentiality obligation. In any case, Bioptimus only provides them with the information strictly needed to process Personal Data in compliance with the purposes identified.

Bioptimus decides which Data Recipients may access to which Personal Data by means of a contract or internal policies. 

Personal Data may also be forwarded to any authority legally entitled to receive it. In such cases, Bioptimus is not liable for the manner in which said authorities access and process the Personal Data but will limit the Personal Data accessed by these authorities to the strict minimum required by such authorities.

Bioptimus will never sell Personal Data to any third parties.

9. Retention period

The retention period of Personal Data is defined by Bioptimus in accordance with its legal and contractual obligations and, failing this, depending on the specific needs, notably in accordance with the following principles:

‍

After the specified periods, Personal Data is either deleted or retained after anonymization, notably for statistical purposes. It may be retained in the event of pre-litigation and litigation.

Data Subjects are reminded that deletion or anonymization are irreversible operations and Personal Data cannot be subsequently restored by Bioptimus. As such, it will no longer be possible to identify any Data Subjects, even indirectly, and any link between you and your data will be deleted. Once Personal Data has been anonymised, no one will be able to link the anonymised data and the initial Personal Data, and Bioptimus will no longer be able to comply with Data Subject’ requests to exercise their rights as described below.

10. Data subjects' rights

As Data Subjects and in accordance with applicable data protection laws, Individuals are entitled to exercise the following rights:

Any request related to the exercise of the rights described above shall be subject to a written request sent by e-mail at dpo@bioptimus.com or by post at Bioptimus – 14-16 Boulevard Poissonnière 75009 Paris - France, accompanied by a copy of a signed identity document. In accordance with data protection laws and regulations, Data Subjects are notified that the rights set forth above are individual rights that may only be exercised by the Data Subjects themselves in relation to their own information, so that for security reasons, Bioptimus must verify Data Subject’s identity before communicating any Personal Data to the concerned Data Subject. 

The response time for Data Subject’s request may vary depending on the complexity of the request or if the Data Subject submitted a large number of requests. 

11. Data processors

Bioptimus notifies Data Subjects that it may engage any Data Processor of its choice to process their Personal Data.

In any such case, Bioptimus ensures that the Data Processor complies with its obligations under applicable data privacy laws and regulations and in particular with the GDPR. 

Bioptimus undertakes to sign a contract with all Data Processor, imposing on the latter the same Personal Data protection obligations that apply to Bioptimus. Furthermore, Bioptimus reserves the right to perform an audit on the Data Processor to verify the latter's compliance with its obligations under the GDPR.

12. Security

Bioptimus has implemented technical and organizational measures to protect the integrity and confidentiality of Data Subjects’ Personal Data. These measures take into account the state of the art, the costs of implementation and the nature, scope, context, and purposes of processing as well as the risk of varying likelihood and severity for the rights and freedoms of the Data Subjects.

This measure includes for instance security techniques of a physical or logical nature which Bioptimusjudges to be appropriate to prevent the destruction, loss, degradation or unauthorized disclosure of Personal Data in an accidental or illegal manner. The main elements of these measures include notably and without limitation:

• Management of Personal Data access rights;
• Internal back-up;
• Identification processes; 
• Security audits;
• Implementation of an IT system security policy;
• Implementation of business continuity and disaster recovery plans;
• Use of security protocols and/or solutions.

13. Personal data breach

In the event of any breach of Personal Data, Bioptimus undertakes to notify competent data supervisory authority (e.g. you can access to the list of the competent supervisory authority within the European Union by visiting the website of the European Data Protection Board) as set out in the GDPR. 

Should any such breach present a high level of risk for Data Subjects and the Personal Data has not been protected, Bioptimus shall: 

• Notify the Data Subjects concerned; 
• Issue the necessary information and recommendations to the Data Subjects concerned.

14. Data protection officer

Bioptimus has appointed a Data Protection Officer. The contact details of the Data Protection Officer are as follows:

• Name: Jean-Philippe VERT - President;
• E-mail address: dpo@bioptimus.com.

Should Data Subjects wish to obtain any particular information or pose a specific question, they may contact the Data Protection Officer who will provide a response within a reasonable period in light of the question posed or information requested. 

In the event of encountering any problem with the processing of Personal Data, Data Subjects may contact the Data Protection Officer.

15. Processing record

As Data Controller, Bioptimus undertakes to maintain a record recording all completed processing activities. This record is a document or software that lists all processing conducted by Bioptimus in its capacity as Data Controller.

Bioptimus undertakes to provide any competent supervisory authority on request with all information enabling said authority to verify the compliance of processing with applicable Personal Data protection regulations.

16. Right to submit a complaint to a supervisory authority

Data Subjects concerned by the processing of their Personal Data have the right to submit a complaint to the competent supervisory authority (e.g. you can access to the list of the competent supervisory authority within European Union by visiting the website of the European Data Protection Board) should they believe that the processing of their Personal Data does not comply with the applicable data protection laws and regulations.

17. Admendment of this privacy policy

This Privacy Policy may be amended or supplemented at any time in the event of legal or judicial developments, or in response to new uses and any decisions or recommendations issued by the competent supervisory authority or in order to reflect the changes of Bioptimus’ practices.

Any new version of this Privacy Policy will be available on this page. Therefore, Bioptimus invites the Data Subjects to check this Privacy Policy on a regular basis.

18. For further information

For any further general information about Personal Data protection, please consult the website of the competent supervisory authority (e.g. you can access to the list of the competent supervisory authority within the European Union by visiting the website of the European Data Protection Board).

19. Information relating to this privacy policy

If Data Subjects need any further information or assistance, do not hesitate to contact Bioptimus at the following address:

• By e-mail at: dpo@bioptimus.com; 
• Or by post at the attention of Bioptimus – 14-16 Boulevard Poissonnière, 75009 Paris - France.