GDPR – INFORMATION ON PERSONAL DATA PROCESSING

The ELSAN Group (hereinafter "ELSAN") is committed to maintaining the trust relationship it has with its users. Therefore, ELSAN places great importance on respecting your privacy, confidentiality, security, and the integrity of your personal data. Consequently, ELSAN ensures that the collection and processing of personal data are carried out in compliance with Regulation (EU) No 2016/679 of the European Parliament and of the Council of 27 April 2016 on the Protection of Natural Persons concerning the processing of personal data and on the free movement of such data, hereinafter referred to as "GDPR", and all applicable provisions of French regulations in this regard.

1. Identity of the data controller

The data controller is ELSAN SAS, registered with the Nanterre Trade and Companies Register under number 802 798 934 RCS Paris, whose registered office is located at 58 bis rue La Boétie 75008 Paris, hereinafter "ELSAN".

2. Purposes of data processing

The data are collected directly for:

• Sending newsletters;
• Navigating ELSAN websites (managing cookies);
• Processing your request, contacting you, and sending the information you wish to receive following your message through the Contact form;
• Allowing ELSAN's Communication Department to contact those who wish to be informed about ELSAN news.

Fields marked with an asterisk in the collection forms are mandatory. If you choose not to provide this information, you may not benefit from certain services offered through the Site.

If you provide personal data on behalf of another person, you agree to do so with their consent and after informing them of the conditions under which their data are processed.

3. Legal bases for processing

ELSAN processes your personal data following the applicable regulations (Articles 6 and 9 of the GDPR). The processing of your personal data is based on the following legal grounds:

• Your consent: ELSAN may process your personal data based on the explicit consent you have given (by filling out a form on the website and checking a dedicated box to collect your consent). You can withdraw your consent at any time (without affecting the data processing authorized by you before the withdrawal).
• Our legitimate interest: ELSAN may process your personal data for legitimate interests in improving our services and relationship without infringing your rights and interests and unless you object.

4. Data collected Generally,

ELSAN undertakes to collect only personal data that are strictly necessary for the purposes described above. The categories of data collected are:

• Identification data;
• Personal contact details;
• Anonymized IP address of the User's Internet connection;
• Cookies: a set of information used for website traffic analysis, advertising performance analysis, and targeted advertising.

The data processing concerns:

• People who have visited ELSAN establishments' websites and consented to the use of cookies;
• People who have subscribed to the newsletter;
• People who have completed a contact form.

5. Data recipients

Depending on their respective needs, the recipients of all or part of the data are:

• Members of ELSAN's Communication Department;
• ELSAN establishments;
• The company Doctolib for making appointments with a practitioner;
• Google;
• Facebook;
• Hotjar;
• Matomo Analytics.

6. Data retention period

The data are kept in an active database for 14 months. After this period without contact from the user, their data will be archived.

6. Data transfers outside the European Union

ELSAN retains your personal data within the European Union. However, ELSAN may occasionally transfer data outside the European Union as part of the services offered by our subcontractors or partners. In such cases, ELSAN ensures that the transferred data are anonymized. This does not apply to personal health data.

6. Your data rights

Under legal and regulatory provisions, you have the following rights:

• Right to access your data (GDPR – Art. 15);
• Right to rectification (GDPR – Art. 16);
• Right to erasure (GDPR – Art. 17);
• Right to restrict processing (GDPR – Art. 18);
• Right to object (GDPR – Art. 21);
• Right to communicate your directives concerning the fate of your personal data after your death (Art. 85 of the amended Data Protection Act).

9. Exercising your rights

ELSAN, the Data Controller, is your contact for any request to exercise your rights concerning this processing. Contact the Data Controller:

• By email: news@elsan.care
• By postal mail: Elsan SAS - Communication Department – 58 bis rue la Boétie 75008 Paris

You can also exercise your rights with ELSAN's Data Protection Officer:

• By postal mail: Data Protection Officer ELSAN, 58 bis rue la Boétie 75008 Paris
• By email: dpo@elsan.care

To ensure confidentiality and protection of your personal data, ELSAN may ask you to provide proof of your identity and additional information to process your request. Response times: ELSAN makes every effort to respond to your request within 30 days. However, this period may be extended due to the complexity of your request and the number of requests.

Appeals to competent authorities: If the response is unsatisfactory, you can lodge a complaint with the French Data Protection Authority (CNIL): https://www.cnil.fr/fr/plaintes. Before making any complaint to the CNIL, we encourage you to contact ELSAN to resolve your request.