Personal data protection policy : The IMAGERY GIE OF THE IHU OF STRASBOURG is committed to protecting the personal data of patients and users, collaborators and employees, and anyone accessing its website. The purpose of this policy is to inform you about: The objectives pursued by data processing (purposes); The types of personal data we collect about you; How your personal data is processed; The terms and conditions of use of your personal data and your rights in this regard, in accordance with European and French legislation. All operations involving your personal data are carried out in accordance with the regulations in force, in particular Regulation No. 2016/679, known as the General Data Protection Regulation (“GDPR”), Law No. 78-17 of January 6, 1978 on information technology, files, and civil liberties, and any national legislation applicable to data protection. If you disagree with the terms of this policy, you are free not to provide any personal data. However, you are advised that the provision of certain data is a condition of access to the services and that, in the absence of such data, certain features and services may be impaired. 1. Definition The data controller The following terms shall have the following meanings: “Personal data” means any information relating to an identified or identifiable natural person, directly or indirectly. “Processing of personal data” means any operation or set of operations which is performed on personal data, regardless of the process used (collection, recording, organization, storage, adaptation, modification, retrieval, consultation, use, disclosure by transmission or dissemination, or any other form of making available, alignment). The “Data Controller” is the legal or natural person who determines the purposes and means of processing, i.e., the objective and the manner in which it is carried out. In practice and in general, this is the private or public body, represented by its legal representative. A “processor” refers to the natural or legal person or any other body that processes personal data on behalf of the data controller. 2. Data controller and data protection officer The data controller is: Centre d’imagerie médicaleIHU Strasbourg1 place de l’Hôpital67091 STRASBOURG France The legal representative is Mr. Christian Debry, Director of the IHU Strasbourg. The data protection officer is: La société ACTECIL204 avenue de Colmar67100 Strasbourg, France+33 (0)9 722 722 93dpo@gi2s.eu 3. Personal data collected When using the www.ihu-imagerie.eu website, the following information may be collected: the URL of the links through which the user accessed the www.ihu-imagerie.eu website, the user’s internet service provider, and the user’s Internet Protocol (IP) address. Outside of our website, your personal data is collected when you visit the IHU GIE or when you contact our services in order to process your request. The data concerned is as follows: Identification and contact details: surname, first name, postal address, telephone number, email address; Any document enabling your care: identity card, health insurance card, social security card, residence permit, birth certificate; Data relating to health status: health data, medical procedures performed during care, medical history, diagnoses, medical imaging; Data relating to professional life in the event of recruitment: CV; application file, education, training, professional situation, employer’s name, previous jobs, career plans, contact details, identification data (surname, first name, etc.). 4. Purposes of processing The collection and processing of your personal data enables us to fulfill one or more of the purposes listed below: Managing requests for information and contact; Supporting patients throughout their care pathway; Organizing appointments; For communication purposes; For billing purposes; For recruitment and personnel management purposes. 5. The legal basis for processing The processing is based on: your consent to provide us with your personal data; the performance of a contract that may exist between the GIE, its service providers, partners, employees, and suppliers; or the need to satisfy the legitimate interests of the GIE, particularly in the case of recruitment. 6. Retention periods The GIE keeps your personal data in a secure environment for as long as it’s needed to do what it was collected for, or for as long as the law in France says it has to. This duration varies depending on requests, procedures, referrals, and legal requirements. 7. Data recipients The personal data collected is intended for the internal departments of the GIE, which are authorized to access it. In the event that the GIE entrusts data processing activities to subcontractors, only subcontractors who provide sufficient guarantees regarding the implementation of appropriate technical and organizational measures are used, so that the processing meets the reliability and security requirements of the applicable regulations and guarantees the protection of individuals’ rights. In accordance with the regulations in force, your personal data may be transmitted to authorized third parties (public bodies, judicial authorities, court officers and ministerial officers, regional health agencies) by legislative or regulatory provision, in the context of a specific mission or the exercise of a right of communication. No personal information about users of the www.ihu-imagerie.eu website is published without the user’s knowledge, exchanged, transferred, assigned, or sold on any medium whatsoever to third parties. Only in the event of the acquisition of IHU Strasbourg and its rights would it be possible to transfer such information to the potential purchaser, who would in turn be bound by the same obligation to store and modify data with regard to users of the www.ihu-imagerie.eu website. 8. Safety measures Taking into account technological developments, implementation costs, the nature of the data to be protected, and the risks to individuals’ rights and freedoms, the GIE implements all appropriate technical and organizational measures to ensure the confidentiality of the personal data collected and processed and a level of security appropriate to the risk. 9. Transfer outside the EU Personal data collected on the website is reserved exclusively for the IHU economic interest group. No data is transferred outside the European Union. 10. Exercising rights In accordance with the amended French Data Protection Act of January 6, 1978, and Regulation (EU) 2016/679 on the protection of personal data, you have the following rights regarding your data: right of access, right of rectification, right to erasure (right to be forgotten), right to object, right to restriction of processing, right to portability. You may also define guidelines for the storage, erasure, and communication of your personal data after your death. To exercise your GDPR rights, you can contact us by email at dpo@gi2s.eu or by post at the following address: DPO – Medical Imaging Center – IHU Strasbourg – 1 place de l’Hôpital, 67091 STRASBOURG CEDEX. Please specify the subject of your request and the right(s) you wish to exercise. If there is reasonable doubt about your identity, you may be asked to provide proof. If, after contacting us, you feel that your rights regarding your personal data have not been respected, you can lodge a complaint with the CNIL. 11. Cookies When you visit the website www.ihu-imagerie.eu, cookies are stored on your computer. The IHU GIE only uses cookies that are necessary for the proper functioning of this website. A cookie is a small text file stored on your computer’s hard drive or in your browser’s memory when you visit a website. It records certain information about your browsing or online behavior (e.g., a session ID, language selection, or date). Cookies that are “necessary” for the proper functioning of the site facilitate your browsing experience by simplifying essential functions (such as navigation between pages). The proper functioning of the site depends in part on these cookies. The use of necessary cookies does not require your prior consent when you connect to the Site. 12. Changes to this policy In the event of any changes to this Policy by the IHU GIE or if required by law, it will be published on our Website and will take effect upon publication. We therefore invite you to refer to it each time you visit our Website in order to review the latest version, which is always available on our Website.
