10.1 Regulatory Compliance

Each party undertakes to comply with applicable regulations regarding the protection of personal data, and in particular:

Regulation (EU) 2016/679 of 27 April 2016 (GDPR);
French Law No. 78-17 of 6 January 1978 as amended, relating to data processing, files, and freedoms;
the recommendations of the French National Commission for Information Technology and Freedoms (CNIL);
the provisions of the French Public Health Code relating to health data.

10.2 Respective Roles

In the context of the performance of these GTCS, the Client acts as the data controller and the Company acts as the data processor within the meaning of the GDPR, for the processing of Personal Data and Health Data carried out on behalf of the Client via the Platform.

10.3 Obligations of the Company as Data Processor

The Company undertakes in particular to:

process Personal Data only on documented instructions from the Client;
ensure the confidentiality of the processed data and ensure that persons authorized to process such data are subject to a confidentiality obligation;
implement appropriate technical and organizational measures to ensure a level of security appropriate to the risk, in accordance with Article 32 of the GDPR;
assist the Client in fulfilling its obligations regarding the rights of data subjects;
notify the Client of any personal data breach as soon as possible and no later than seventy-two (72) hours after becoming aware of it;
delete or return all Personal Data at the end of the service, in accordance with the Client's choices and legal retention obligations.

10.4 Health Data Hosting

Where the Services involve the processing of Health Data, such data is hosted by a provider certified as a Health Data Host (HDS) in accordance with the provisions of Article L.1111-8 of the French Public Health Code and the certification provided for by Decree No. 2018-137 of 26 February 2018.

10.5 Data Processed by the Company for Its Own Purposes

The Company collects and processes certain data relating to the Client and its Authorized Users for the purposes of managing the contractual relationship, including:

identification data (surname, first name, position, professional contact details);
Platform login and usage data;
billing data.

Identity of the data controller: DIAGNORA, SAS, 18 rue Général Fabvier, 54000 Nancy, France.

Legal bases: performance of the contract (Article 6(1)(b) of the GDPR), legitimate interests of the Company (Article 6(1)(f) of the GDPR), compliance with legal obligations (Article 6(1)(c) of the GDPR).

Retention period: data is retained for the duration of the contractual relationship, then archived in accordance with legal retention obligations (in particular accounting and tax obligations), and for a maximum period corresponding to the applicable statutory limitation periods.

10.6 Rights of Data Subjects

In accordance with the GDPR and the French Data Protection Act, data subjects have the following rights over their personal data:

right of access, rectification, and erasure;
right to restriction of processing;
right to data portability;
right to object;
right to define directives regarding the fate of their data after their death.

These rights may be exercised by contacting the Company by email at dpo@diagnora.com or by mail at: DIAGNORA – 18, rue Général Fabvier, 54000 Nancy, France, enclosing proof of identity.

In your lab, they ask you to do more, for less, with less.