Privacy Policy

1. Scope

This Privacy Policy explains how Invenia Intelligence Médicale SAS collects and uses personal data through the public SantéXA website, including information submitted through the Request a Demo form.

This policy applies to the public website only.

It does not govern personal or health information processed within Dx7, an authorized partner environment, or another deployed SantéXA application. Those environments are governed by their applicable contracts, access rules, data-processing arrangements, and privacy notices.

2. Data controller

The controller of personal data collected through this website is:

Invenia Intelligence Médicale SAS
55 rue Grignan
13006 Marseille
France
SIREN: 994 839 280
RCS Marseille: 994 839 280
Privacy contact: legal@invenia.fr

3. Information collected

Demonstration requests

When a person submits the Request a Demo form, Invenia may collect:

• Full name
• Position or professional role
• Organization
• Work email address
• Country
• Mobile number, when provided
• Organization type
• Area of interest
• Number of branches or facilities, when provided
• Current laboratory or healthcare information system, when provided
• The operational problem or requirement described by the requester
• Preferred demonstration date
• Preferred communication channel
• The date and status of the request and subsequent communications

Do not submit patient information, medical records, test results, diagnoses, credentials, passwords, or other sensitive information through this form.

If sensitive or patient information is submitted contrary to this instruction, Invenia may remove it where practicable and restrict its use to what is necessary to manage the submission securely.

Technical information

When the website is visited, limited technical information may be processed by Invenia or its hosting provider to deliver and protect the website. This may include:

• IP address
• Request date and time
• Requested page or resource
• Browser and device information
• Referring page
• Server, security, and error-log information

The public website is not intended to use this information to identify a visitor for advertising or cross-site tracking.

4. Purposes and legal bases

Invenia processes website information for the following purposes:

Responding to demonstration and contact requests

Purpose:

• Review the request
• Contact the requester
• Prepare an appropriate demonstration
• Understand the organization’s stated operational requirements
• Arrange follow-up requested by the person

Legal basis:

• Steps taken at the requester’s initiative before a possible contractual relationship
• Invenia’s legitimate interest in responding to professional enquiries and developing appropriate business relationships

Website operation and security

Purpose:

• Deliver website pages and forms
• Detect errors, abuse, automated submissions, or security incidents
• Maintain the availability and integrity of the website
• Establish, exercise, or defend legal rights where necessary

Legal basis:

• Invenia’s legitimate interest in operating and protecting its website
• Compliance with applicable legal obligations where relevant

Regulatory and record-keeping requirements

Purpose:

• Satisfy applicable legal, accounting, regulatory, or evidentiary requirements

Legal basis:

• Compliance with a legal obligation
• Invenia’s legitimate interest in maintaining appropriate business records

Invenia does not use demonstration-request information for unrelated promotional campaigns unless a separate lawful basis and, where required, a separate optional consent have been established.

5. Required and optional information

Fields marked with an asterisk are required to assess and respond to a demonstration request.

If the required information is not provided, Invenia may be unable to process the request.

Optional fields allow the requester to provide additional context but are not required.

6. Recipients

Access is limited to people and service providers who need the information for the purposes described above. They may include:

• Authorized Invenia personnel
• Website and hosting providers
• Email and communication providers
• Form-processing, scheduling, or customer-relationship providers actually configured by Invenia
• Professional advisers where necessary
• Public authorities where disclosure is legally required

Service providers must process information under appropriate contractual, confidentiality, and security obligations.

Invenia does not sell personal data.

7. International transfers

Invenia seeks to process website information within the European Economic Area.

Where an authorized provider processes information outside the European Economic Area, Invenia will use a transfer mechanism permitted by applicable data-protection law, such as an adequacy decision, approved contractual clauses, or another lawful safeguard.

8. Retention

Demonstration and professional-enquiry information is retained only as long as necessary to manage the request and the resulting relationship.

Unless a contract, legal obligation, dispute, or continuing professional relationship requires longer retention, an enquiry that does not result in an active relationship should be deleted or anonymized no later than three years after the last substantive contact.

Technical and security logs should normally be retained for no more than twelve months unless a shorter production setting applies or longer retention is necessary to investigate an incident, comply with law, or establish or defend a legal claim.

Information connected with a contractual relationship may be retained for the applicable contractual, accounting, and legal limitation periods.

9. Security

Invenia applies organizational and technical measures intended to protect website information against unauthorized access, alteration, disclosure, loss, or destruction.

No public internet transmission or storage system can be guaranteed to be completely secure. Visitors must not submit passwords, authentication codes, patient records, or medical information through the public website.

10. Individual rights

Subject to applicable conditions, a person may request:

• Access to personal data concerning them
• Correction of inaccurate or incomplete data
• Deletion of data
• Restriction of processing
• Objection to processing based on legitimate interests
• Portability where the right applies
• Withdrawal of consent where processing is based on consent

Requests may be sent to:
legal@invenia.fr

or by post to:

Invenia Intelligence Médicale SAS
Data Protection Request
55 rue Grignan
13006 Marseille
France

Invenia may request information reasonably necessary to verify the requester’s identity. It will not request excessive identification documents.

A person also has the right to lodge a complaint with the French supervisory authority:

Commission nationale de l’informatique et des libertés (CNIL)
3 Place de Fontenoy
TSA 80715
75334 Paris Cedex 07
France
https://www.cnil.fr/

11. Automated decision-making

The public website does not use submitted demonstration-request information to make decisions producing legal or similarly significant effects through fully automated processing.

12. Children

The public website is directed to healthcare organizations, professionals, institutions, and technology partners. It is not directed to children, and the Request a Demo form is not intended for use by minors.

13. External websites

The website may link to external services or authorized application domains. Those services operate under their own privacy notices and terms.

The public SantéXA website’s Privacy Policy does not govern information submitted directly to a third-party service or to an authorized Dx7 environment.

14. Changes to this policy

Invenia may revise this Privacy Policy when website functions, processors, or legal requirements change.

The updated date will appear at the top of the page. Material changes will be communicated through an appropriate notice where required.

15. Contact

Privacy questions and rights requests:
legal@invenia.fr