MN SANTE HOLDING is a company operating in the creation, design, exploitation, realization, publication, and management of all software, computer programs, communication, and data transmission systems, allowing medical follow-up, the implementation of diagnostic medical devices, the development of connected health including telemedicine and all paramedical assistance services.

In the course of its activities, MN SANTE HOLDING has developed an innovative connected medical monitoring software solution, intended for healthcare establishments and their medical teams, specifically aimed at preparing patient care and securing the return home (the “Solution”).

MN SANTE HOLDING has developed a software solution which consists of offering establishments an information and monitoring service for patients undergoing hospitalization. The maela.fr website is an information site with a login button for Patients and Health Professionals.

The IT Platform implemented by MN SANTE HOLDING allows Patients and Practitioners of a healthcare establishment contracted with MN SANTE HOLDING to be in permanent contact before and after the intervention via the solution.

For MN SANTE HOLDING, the preservation of the personal data of the users of the Solution (including any visitor) is important (the “Users“).

MN SANTE HOLDING undertakes to implement adequate protection, confidentiality, and security measures for the personal data of the Users, in accordance with the applicable European regulation, as derived from Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016, relating to the protection of individuals with regard to the processing of personal data and to the free movement of such data, and repealing Directive 95/46/EC (General Data Protection Regulation), and French law, notably the national regulations implementing said Regulation.

This charter (the “Charter“) aims to inform and enlighten Users about the purposes of collecting and processing their personal data by MN SANTE HOLDING, as the data controller.

Users are consequently invited to read the Charter very carefully, to print it out, and to keep a copy.

By using the Solution, the User accepts all the provisions included in the Charter relating to the collection and processing of their data, for the purposes set out below.

Users are required to provide their personal data in digital format when using the Solution.

1. Categories of collected personal data

The User data that MN SANTE HOLDING may collect and process may include (without limitation) the following data :

1. Identity: title, last name, first names, date and place of birth, company name, address, phone number (landline and/or mobile), fax number, email addresses, identity and contact details (phone/email) of the person to contact in case of emergency, identity and contact details of the attending physician (address/email/phone), internal processing code allowing the identification of the client (this internal processing code cannot be the national identification number (social security number), bank card number, or identity document number), stay number, NIR.
2. Health data of the User-patient: data related to the care pathway, preparation and follow-up, follow-up protocol, pathology, medical data, technical data, pre- or post-hospitalization, questionnaires, treatment reminders, recommendations, analysis requests, taking measurements or photographs, diagnoses, reminders of medical dosages, and any exchanges on the platform related to the patient’s medical follow-up.
3. Data related to contributions from individuals who leave reviews on products, services, or content, including their pseudonym ;
4. Data related to the User’s connections, including the method and time of connection, for security purposes ;
5. Data collected through the actions referred to in Article 32-II of the amended law of January 6, 1978 (electronic communication services).

Due to the very nature of the Solution, MN SANTE HOLDING collects and processes data concerning the health of the User as a natural person.

The collection and processing of this sensitive data is necessary for medical purposes. They are also required for health research. For this, they fall within the framework of the provisions of article 9 of the GDPR.

2. Principles applicable to the collection and processing of personal data

Legal basis for the collection and processing of personal data

The personal data of Users is processed by MN SANTE HOLDING in cases authorized by current regulations and under the following conditions :

• Obtaining the free, specific, informed, and unambiguous consent of the User (or their legal representative in the case of minors or incapacity) for the processing of their personal data ;
• Collection of personal data necessary for the execution of the User’s request ;
• Collection of personal data necessary for medical purposes ;
• Collection of personal data required for health research ;
• Compliance with legal and/or regulatory obligations imposed on MN SANTE HOLDING (such as combating fraud and corruption) ;
• Protection of the legitimate interests of MN SANTE HOLDING (such as protecting the security of its IT network).

Purposes of the collection and processing of personal data

Users cannot use the Solution without providing personal data to MN SANTE HOLDING required for the very functionalities of the service.

MN SANTE HOLDING collects and processes User data for the following purposes :

• To execute the mission entrusted by the User, client of MN SANTE HOLDING, within the framework of the offer execution,
• For the purposes of use, account management, and registration of new Users ;
• For the purposes of use, maintenance, and improvement of the Solution and/or MN SANTE HOLDING’s commercial offers, particularly through surveys, inquiries, and other solicitations,
• For billing purposes and communication with the payment intermediary, for the execution of the offer, in terms of Subscription payments,
• To respond to information requests (online contact forms),
• For any measure or project more broadly aimed at the Users’ interest or improving the customer relationship and experience,
• to comply with current or upcoming regulatory requirements.

Retention period of personal data

The retention period of Users’ personal data depends on the relevant purpose.

In this context, Users’ personal data is retained for the time necessary to fulfill their request.

In the absence of any implementation, personal data is deleted within the deadlines recommended by the Commission Nationale Informatique et Libertés (CNIL), after a period of three years from their collection on the Solution, subject to :

• legal possibilities and obligations regarding archiving,
• obligations to retain certain data for evidentiary purposes, and/or anonymization of such data.

The personal data of the User, client of MN SANTE HOLDING, collected and processed for the execution of offers, is retained for the duration necessary to manage the contractual relationship.

By exception, personal data required to establish proof of a right or contract is archived in accordance with legal provisions (5 or 10 years after the end of the business relationship, as the case may be).

3. Recipients of the collected personal data

The collected personal information is exclusively intended for MN SANTE HOLDING, its clients, and users, as mentioned in the Annex, and will not be sold or exchanged with third parties, except for the purposes mentioned in Article 2 above, for the User client of MN SANTE HOLDING.

Only authorized personnel and duly authorized service providers of MN SANTE HOLDING may have access to the collected personal data and may process it, without prejudice to its possible transmission to bodies responsible for control or inspection missions in accordance with current legislation and/or regulations or to respond to a judicial or administrative decision.

Subject to their complete anonymization, MN SANTE HOLDING is entitled, in compliance with current legal provisions, to use Users’ personal data, particularly for statistical, measurement, transfer, and/or exchange purposes with third parties.

4. Transfer of personal data

The personal data of Users collected is hosted in France.

In the context of its use of affiliates or service providers located outside the European Union, MN SANTE HOLDING undertakes to ensure that appropriate measures have been implemented so that Users’ personal data benefits from an adequate level of protection.

5. Protection measures implemented by MN SANTE HOLDING

MN SANTE HOLDING collects and processes Users’ personal data in compliance with current regulations.

MN SANTE HOLDING uses an HDS-certified health data host for the hosting and protection of data. The data covered by the Services is hosted by an HDS-certified health data host: OVH SAS, 2 rue Kellermann – 59100 Roubaix – France.

When the disclosure of a User’s personal data to third parties is necessary and authorized, MN SANTE HOLDING ensures that these third parties guarantee the same level of protection for the personal data as that implemented by MN SANTE HOLDING. In this context, MN SANTE HOLDING requires each of its contractual partners to confirm compliance with applicable regulations.

MN SANTE HOLDING implements technical and organizational measures to ensure that the retention of Users’ personal data is secure for the duration necessary to achieve the intended purposes.

MN SANTE HOLDING draws Users’ attention to the fact that no transmission or storage technology is completely infallible.

Therefore, in the event of a proven breach of Users’ personal data that could result in a high risk to their rights and freedoms, MN SANTE HOLDING will inform the competent supervisory authority of this violation in accordance with the procedures provided by current regulations.

Users must exercise caution to prevent any unauthorized access to their personal data, particularly to their computer and digital devices (computer, smartphone, tablet, in particular).

6. Rights of users

In accordance with current regulations, Users have the following rights, subject to legal and regulatory limitations :

Right to information on the collection and processing of personal data

MN SANTE HOLDING undertakes to make its best efforts to ensure that the information communicated to Users is accessible, precise, and transparent regarding the conditions of the collection and processing of their personal data.

Right of access / right to erasure (“right to be forgotten”) / right to rectification / right to object / right to restrict processing

Any User may, at any time, access the personal information concerning them held by MN SANTE HOLDING. They have the right to receive a copy in electronic form (for any additional copy, MN SANTE HOLDING will be entitled to charge fees based on the administrative costs incurred).

Each User has the right to request the deletion and/or rectification of their personal data when it is incorrect or outdated. MN SANTE HOLDING may retain certain personal data when required by law or for legitimate reasons.

Users may object at any time for legitimate reasons :

• to the use of their personal data for direct marketing purposes, or
• to the reuse of their personal data for purposes other than those listed in Article 2 above, except in the case of MN SANTE HOLDING fulfilling one of its legal and/or regulatory obligations.

Users have the right to request that the processing of their personal data be limited to what is strictly necessary. This right is applicable only :

• if the concerned User disputes the accuracy of their personal data ;
• if the concerned User justifies that the processing of their personal data is unlawful and requests a limitation of its use rather than deletion ;
• if MN SANTE HOLDING no longer needs the personal data of the concerned User and it is still necessary for the User to establish, exercise, or defend legal claims;
• if the concerned User objects to the processing of their personal data based on the legitimate interest of the data controller, justifying a superior legitimate interest.

Right to lodge a complaint with a supervisory authority

Any User who believes that the efforts made by MN SANTE HOLDING to protect their personal data do not ensure the respect of their rights has the possibility to lodge a complaint with the competent supervisory authority (CNIL or any other authority listed by the European Commission).

Right to data portability

Users have the right to data portability, allowing them to obtain from MN SANTE HOLDING their personal data in a structured, commonly used, and machine-readable format.

Users can also request that their personal data be transmitted to another data controller.

Right to decide the fate of personal data after death

Users also have the right to organize the fate of their personal data after their death by adopting general or specific directives that MN SANTE HOLDING commits to respecting.

In the absence of such directives, MN SANTE HOLDING recognizes the possibility for heirs to exercise certain rights, particularly the right of access if necessary for the settlement of the deceased’s estate and the right to object.