Privacy policy
Vertical Health Data places central importance on the protection of personal data. This policy explains what data we collect, why, how we protect it, and what rights you can exercise. It applies to the entire verticalhealthdata.org website and to the processing carried out by the association.
Founding commitment
Vertical Health Data applies the General Data Protection Regulation (GDPR) and national legislation relating to the protection of health data. Any project involving the collection or processing of personal data must obtain prior advice from the data protection officer before its implementation.
This requirement is not a formality. It is consistent with our very mission: we cannot claim to structure the governance of health data if we are not exemplary in the processing of the personal data we collect ourselves.
Data controller
| Item | Value |
|---|---|
| Data controller | Vertical Health Data, association under the French law of 1901 |
| Represented by | Ms NIAMIEN Affoue, President |
| Registered office | 12 rue Jean Pacilly, 91120 Palaiseau, France |
| General contact | contact@verticalhealthdata.org |
| Data Protection Officer (DPO) | Being designated |
| DPO contact | dpo@verticalhealthdata.org |
Data collected and purposes
Vertical Health Data collects only the data strictly necessary for the identified purposes. We apply the principle of minimisation: no data is collected by default, nor for future unspecified uses.
| Purpose | Data collected | Legal basis | Retention |
|---|---|---|---|
| Processing a membership application | Surname, first name, email, profile, organisation where applicable, motivation | Pre-contractual measures · GDPR art. 6.1.b | 1 year after refusal · duration of membership otherwise |
| Processing a partnership request | Surname, first name, email, organisation, role, subject | Pre-contractual measures · GDPR art. 6.1.b | 2 years after last interaction |
| Processing a contact request | Surname, first name, email, subject, message | Legitimate interest · GDPR art. 6.1.f | 1 year after reply |
| Press enquiry | Surname, first name, email, media outlet | Legitimate interest · GDPR art. 6.1.f | 3 years after last interaction |
| Member management | Identity, contact details, college, membership fee | Membership contract + legal obligation · GDPR art. 6.1.b and 6.1.c | Duration of membership + 5 years (accounting obligations) |
| Anonymised audience measurement | Anonymised technical data (pages, browser) | CNIL consent exemption if configuration compliant | 13 months |
Sensitive data (health)
Vertical Health Data works on the governance of health data, but does not collect health data on this website as part of its routine association activities.
If in the future the association were to implement projects involving the collection of health data (research, pilot study, experimentation), such collection would be subject to a reinforced framework: data protection impact assessment (DPIA), explicit consent of the persons concerned, certified HDS (Health Data Hosting) hosting, prior advice from the DPO, and where applicable prior approval from the Board of Directors.
Recipients of the data
The personal data collected by Vertical Health Data is accessible to authorised persons within the association, strictly limited to their duties:
- The Executive General Secretariat, as part of administrative and statutory management.
- The President, for membership decisions and the approval of agreements.
- The DPO, as part of their compliance duties.
- Where applicable, technical service providers under a subcontracting agreement compliant with Article 28 of the GDPR (hosting, email management, audience measurement).
Vertical Health Data does not sell, rent, or transfer your personal data to third parties for commercial purposes.
Transfers outside the European Union
Vertical Health Data gives preference to service providers established in the European Union, in line with its sovereignty doctrine. No transfer of personal data outside the EU is carried out by default.
If a transfer were to prove necessary (for example for a technical service with no European equivalent), it would be governed by the safeguards provided for by the GDPR: standard contractual clauses of the European Commission, adequacy decision, or binding corporate rules. Prior information would be provided in this policy.
Data security
Vertical Health Data implements the appropriate technical and organisational measures to protect personal data against loss, alteration, unauthorised disclosure or unlawful access.
- Sovereign hosting of the data on secure servers.
- Encryption of communications (HTTPS) and encryption of sensitive data in the database.
- Strict management of access authorisations, based on the principle of least privilege.
- Traceability of access to personal data.
- Raising contributors' awareness of confidentiality and security.
In the event of a personal data breach likely to result in a risk to the rights and freedoms of the persons concerned, Vertical Health Data undertakes to notify the CNIL within 72 hours and, where applicable, to inform the persons concerned as soon as possible.
Your rights
In accordance with the GDPR and the amended French Data Protection Act, you have the following rights over your personal data.
| Right | Scope |
|---|---|
| Right of access | Obtain confirmation that data concerning you is being processed and access that data. |
| Right to rectification | Have inaccurate or incomplete data corrected. |
| Right to erasure | Request the deletion of your data under the conditions provided for by the GDPR. |
| Right to restriction | Request the suspension of processing in certain situations. |
| Right to portability | Receive your data in a structured and readable format, or request its direct transmission to another data controller. |
| Right to object | Object to the processing of your data on grounds relating to your particular situation, in particular for processing based on legitimate interest. |
| Post-mortem directives | Give instructions on what happens to your data after your death. |
How to exercise your rights · Send your request by email to dpo@verticalhealthdata.org, specifying your identity and the subject of your request. Proof of identity may be requested in the event of reasonable doubt about your identity.
Response time · A maximum of one month from receipt of the request, extendable by two months in the event of complexity or a large number of requests.
Remedy · If you consider that your rights are not being respected, you may lodge a complaint with the French Data Protection Authority (CNIL), 3 place de Fontenoy, TSA 80715, 75334 Paris Cedex 07, or via www.cnil.fr.
Withdrawal of consent and register · Where processing is based on your consent (boxes ticked when submitting a form), you may withdraw it at any time, without affecting the lawfulness of processing carried out before the withdrawal. In accordance with Article 7 of the GDPR, Vertical Health Data keeps a time-stamped record of each consent collected (date, time, exact wording accepted), for the sole purpose of being able to demonstrate its existence; this record is deleted at the end of the applicable retention period.
Cookies and trackers
The verticalhealthdata.org website keeps the use of cookies and trackers to a strict minimum.
| Type | Purpose | Consent | Duration |
|---|---|---|---|
| Session cookies | Technical operation of the site | No (CNIL exemption) | Duration of the session |
| Preference cookies | Storing the user's choices | No (CNIL exemption if strictly user purpose) | 13 months max |
| Anonymised audience measurement cookies | Visitor statistics compliant with CNIL recommendations | No (CNIL exemption if configuration compliant) | 13 months max |
| Third-party cookies (social networks, advertising, trackers) | — | Not used | — |
Vertical Health Data does not use any advertising cookies, any third-party trackers for commercial purposes, and does not integrate social sharing buttons that would set third-party cookies.
Minors
The verticalhealthdata.org website is not intended for minors under 15 years of age. The contact and membership forms are only accessible to adults. If a minor under 15 years of age wishes to contribute to Vertical Health Data as part of an educational or patient initiative, such contribution is subject to the prior consent of their legal representatives.
Changes to the policy
Vertical Health Data may amend this privacy policy, in particular to take account of legislative, regulatory or technical developments. The date of the last update is indicated below. Substantial changes will be brought to your attention by a visible notice on the site.
Last updated: June 2026