Privacy policy

Our commitment

BIOGROUP and all its medical analysis laboratories are fully aware of the importance of privacy and the protection of personal data, particularly in the digital age.

Within the framework of its normal activity as a medical analysis laboratory, BIOGROUP is likely to receive, to collect directly and/or indirectly and to process numerous personal data relating to its patients, its employees, and all persons in contact with its laboratories.

BIOGROUP undertakes to comply with and respect at all times the legislation relating to the management of personal data, including Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of individuals with regard to the processing of personal data and on the free movement of such data (hereinafter referred to as GDPR) and the “Informatique et Libertés” law no. 78-17 of 6 January 1978 as amended relating to information technology, files and freedoms.

BIOGROUP is committed to ensuring adequate protection of personal data and to clearly informing all persons with whom the BIOGROUP group and its entities maintain relations.

Our Privacy and Personal Data Protection Policy

This Privacy and Personal Data Protection Policy (the “Policy”) describes the general measures implemented by BIOGROUP to ensure adequate protection of personal data, i.e. any information relating to an identified or identifiable natural person (“Personal Data”), for all data processing carried out within the framework of its business relationships and its medical analysis laboratory activities.

The objectives of this Policy are to describe the following:

  • THE PERSONAL DATA WE COLLECT: what information BIOGROUP collects and processes about you;
  • PURPOSES: for what reasons and purposes BIOGROUP processes your Personal Data;
  • BASIS: what are the legal bases on which BIOGROUP processes your Personal Data;
  • HOW : how BIOGROUP collects your Personal Data;
  • WHO are the authorised parties to whom BIOGROUP may disclose your Personal Data;
  • WHERE BIOGROUP and the authorised parties may process your Personal Data;
  • WHICH SECURITY MEASURES BIOGROUP puts in place to protect your Personal Data;
  • HOW LONG BIOGROUP retains your Personal Data and how retention periods are determined;
  • WHICH RIGHTS YOU HAVE and how to exercise them;
  • HOW TO CONTACT US if you wish to exercise your rights or if you have any questions.

Definitions

  • Personal data (article 4.1. of the GDPR): any information relating to an identified or identifiable natural person (hereinafter referred to as “data subject”); an “identifiable natural person” is one who can be identified, directly or indirectly, in particular by reference to an identifier, such as a name, an identification number, location data, an online identifier, or to one or more factors specific to his or her physical, physiological, genetic, mental, economic, cultural or social identity;
  • Processing (article 4.2. of the GDPR): any operation or set of operations which is performed upon personal data or sets of personal data, whether or not by automatic means, such as collection, recording, organisation, structuring, storage, adaptation or alteration, retrieval, consultation, use, disclosure by transmission, dissemination or otherwise making available, alignment or combination, restriction, erasure or destruction;

BIOGROUP’s legal bases for processing Personal Data Depending on the processing of Personal Data

Subject to the processing of personal data, BIOGROUP will process your personal data on the basis of one or other of these legal bases:

  • Prior consent (Article 4.11 and 6.1.a of the GDPR) of the individual concerned: this refers to any free, specific, informed and unambiguous expression of will by which the individual concerned agrees, by a declaration or by a clear positive act, that personal data relating to him/her may be processed. In practice, this will mean that BIOGROUP will ask you to sign a document or to follow an online opt-in procedure, or to follow any useful procedure allowing you to receive all the necessary information and to clearly accept or refuse the processing concerned;
  • Contractual relationship (Article 6.1.b. of the GDPR): the processing is necessary for the performance of a contract to which you are party or the processing is necessary for the implementation of pre-contractual measures taken at your request. For instance, it is necessary for BIOGROUP to process your Personal Data for the purposes of pre-contract negotiations, the signing of a contract or the performance of obligations under a contract; therefore, if you do not wish BIOGROUP to process your Personal Data under these conditions, BIOGROUP may or must refuse to enter into a negotiation or contractual relationship with you or may not be able to provide you with the products or services covered by that contract;
  • Legal obligations (Article 6.1.c. of the GDPR): the processing is necessary for compliance with a legal obligation to which the data controller is subject; for example, BIOGROUP in its activity as a medical analysis laboratory is required to keep information relating to the patient’s medical file for a certain period of time determined by the Law;
  • Legitimate interest (Article 6.1.f. GDPR): processing is necessary for the purposes of the legitimate interests pursued by the controller or by a third party, unless the interests or fundamental rights and freedoms of the individual concerned which require the protection of personal data prevail, in particular where the data subject is a child; in this case, BIOGROUP will take account of your interests and fundamental rights in determining whether the processing is legitimate and lawful.

BIOGROUP may, on a case-by-case basis, rely on other legal bases, such as, for example, safeguarding your vital interests (Article 6.1.d. of the GDPR), in accordance with applicable data protection legislation and as set out in the applicable Statements, if any.

The types of processing covered by this Policy

You are a visitor to the site, click here.
Specific information on the protection of privacy and personal data (“Statements”) and/or consent forms will be provided to you as necessary in the particular situations where BIOGROUP may process your Personal Data. These Statements will further describe how your Personal Data will be used in connection with the processing in question.

BIOGROUP’s Collection of Personal Data

BIOGROUP may collect your Personal Data from, among other things:

  • Data that we collect automatically for example when we track your interactions with our websites, platforms, applications and services, by means of, inter alia, cookies.

BIOGROUP’s sharing of your Personal Data with authorised parties

For the purposes described above, BIOGROUP may have to share your Personal Data with the authorised parties below:

  • BIOGROUP and its affiliated companies
  • our partners (healthcare professionals and organisations, distributors, other members of healthcare professionals)
  • our selected suppliers, including service providers acting under our instructions for the hosting of our sites, medical biology analyses, the performance of transactions, the provision of IT equipment and services, patient service, messaging system, auditing, etc.
  • any administrative or judicial authority, when required under applicable law, including under provisions of foreign law.

Under no circumstances will BIOGROUP pass on your Personal Data to other Third Parties.
In all cases, BIOGROUP ensures that such third parties:

  • undertake to comply with applicable data protection legislation and the principles of this Policy;
  • process Personal Data exclusively for the purposes described in this Policy;
  • implement appropriate technical and organisational security measures to protect the integrity and confidentiality of your Personal Data.

Transfer of your Personal Data by BIOGROUP outside the EU

BIOGROUP informs you that neither the group nor any of its affiliated entities transfer any personal data outside the European Union.

How long BIOGROUP will keep your Personal Data

BIOGROUP will only keep your Personal Data for as long as is necessary to fulfil the purposes described in this Policy. BIOGROUP will specify the exact retention period applicable to you in the relevant Information Statements.

Notwithstanding this, BIOGROUP may retain your Personal Data for a longer period of time as permitted or required by applicable law or as necessary to protect its rights and interests.

The rights of individuals that you may exercise with BIOGROUP

BIOGROUP informs you that you may have, where provided for by applicable law and subject to any restrictions that may apply in respect of legal exceptions or obligations, the following rights:

  • Right of access (article 15 of the GDPR) upon request to your Personal Data, in which case you will receive a copy of it, unless it is made available to you directly, for example, within your personal account;
  • Right of rectification (article 16 of the GDPR) of your Personal Data in the event that it is inaccurate, incomplete or out of date;
  • Right of deletion/erasure “right to be forgotten” (article 17 of the GDPR) of your Personal Data in the situations provided for by the applicable data protection legislation;
  • Right to withdraw your consent to the processing of your Personal Data (without affecting the lawfulness of the processing) where your Personal Data has been processed and collected on the basis of your consent;
  • Right to object to the processing of your Personal Data (Article 21 of the GDPR), when your Personal Data have been collected and processed on the basis of BIOGROUP’s legitimate interests, in which case it will be up to you to justify your request by explaining your particular situation to us;
  • Right to limitation of processing (Article 18 of the GDPR) in the situations referred to by the applicable law;
  • Right to the portability of your Personal Data (Article 20 of the GDPR) for transmission to the third party of your choice, or to obtain the direct transmission of your data to this third party by BIOGROUP where technically feasible (this right is applicable only when the processing is based on your consent) if the processing has as its legal basis the consent or the contractual relationship. To this end, you have the right to receive the personal data you have provided to us in a structured, commonly used and machine-readable format; at your request, you may ask us to transfer your data to another controller without us being able to prevent this.

If you wish to exercise any of these rights, please contact us as indicated in the “Contact Us” section. We will take steps to respond to you as quickly as possible and within a maximum of 1 month.
You may also submit a claim to the competent personal data protection authority regarding the processing of your Personal Data, the Commission Nationale de l’Informatique et des Libertés (CNIL).

Contact us

BIOGROUP is at your disposal for any questions and/or requests to exercise your rights.
You can send your requests to BIOGROUP, enclosing proof of identity:

  • By e-mail: [email protected]
  • By post:
    Délégué à la Protection des Données Personnelles (DPO/DPD)
    BIOGROUP
    1 rue Charles Péguy Strasbourg
    67200 Strasbourg – FRANCE

Filing a privacy complaint with the Commission Nationale de l’Informatique et des Libertés (CNIL)

If you believe that the processing of your personal data by BIOGROUP or one of its entities violates a law, rule or regulation in force, you have the right to formulate a complaint to the Commission Nationale de l’Informatique et des Libertés (CNIL).

  • By the CNIL website: www.cnil.fr
  • By mail by writing to:
    CNIL – 3 Place de Fontenoy – TSA 80715 – 75334 PARIS CEDEX 07 – FRANCE

The validity and evolution of this Personal Data Policy

This Policy may be modified by BIOGROUP over time, in particular to adapt it to developments or changes in applicable law or internal practices of BIOGROUP. Changes will be posted on this page. We invite you to consult this Policy regularly.