Privacy Policy

The data controller is AIMS Oncology, publisher of the AIMS Oncology platform.

For any question about your personal data, you can contact us:

• Through the Contact Support form (Privacy category) on the platform;

• By e-mail at the address indicated in the "Contact" section of the platform.

We only collect the data necessary for the operation of the platform:

• Account data: first name, last name, professional e-mail address, password (stored as a hash), role, affiliated institution, language;

• Health data (patients): clinical and biological data required for care and therapeutic decision support (medical history, biomarkers, test results), entered exclusively by authorised healthcare professionals;

• Usage data: audit logs (who accessed or modified what and when), hashed IP address (anti-spam on public forms), browsing language;

• Contact messages: name, e-mail, subject and content of the message you voluntarily send us.

Your data is processed for the following purposes, in accordance with Article 6 of the GDPR:

• Performance of the platform usage contract (Art. 6.1.b): account management, access to features, tracking of test and therapy requests;

• Legal obligations (Art. 6.1.c): accounting retention and legal archiving;

• Legitimate interest (Art. 6.1.f): system security, fraud prevention, technical administration, anonymised statistics;

• Explicit consent (Art. 6.1.a): processing of your messages via the Contact Support form.

Health data is processed under Article 9.2.h of the GDPR (healthcare purpose, in the interest of patients) under the responsibility of healthcare professionals, who are bound by professional secrecy.

Data is accessible only to authorised persons:

• Healthcare professionals and authorised staff of your institution, according to their access rights and role in the platform;

• Technical administrators of AIMS Oncology, strictly for administration and support;

• Hosting and infrastructure providers, solely for the provision of the service.

Your data is never sold, rented or transferred to third parties for commercial purposes.

Data is retained only for as long as necessary for the purposes:

• Account data: for the duration of your use, then deleted or anonymised after account closure;

• Health data: retention period defined by the legal obligations applicable to your institution regarding medical records;

• Audit logs: kept for security and traceability reasons, then archived in accordance with legal obligations;

• Contact messages: kept while your request is being handled, then deleted or anonymised.

We implement appropriate technical and organisational measures: encrypted communications (HTTPS), strictly role-based access control, passwords stored as hashes, access logging, regular backups and hosting on secure infrastructure.

In the event of a data breach, we will notify the competent authorities and the affected persons under the conditions set out in Articles 33 and 34 of the GDPR.

In accordance with the GDPR, you have the following rights:

• Right of access: obtain a copy of your personal data;

• Right to rectification: correct inaccurate data;

• Right to erasure ("right to be forgotten");

• Right to restriction of processing;

• Right to data portability;

• Right to object to processing based on legitimate interest;

• Right to withdraw consent at any time, without prejudice to the lawfulness of prior processing;

• Right not to be subject to a fully automated decision (see section 9).

To exercise these rights, use the Contact Support form (Privacy category). We will respond within one month. You may also lodge a complaint with the competent supervisory authority if you consider that your rights are not respected.

Data is hosted within the European Union. In the event of a transfer to a third country, appropriate safeguards are implemented in accordance with Chapter V of the GDPR (standard contractual clauses, adequacy decisions).

The platform provides therapeutic suggestions as decision support. These suggestions never constitute an automated decision within the meaning of Article 22 of the GDPR: the final therapeutic decision remains exclusively the responsibility of the healthcare professional, who retains full control over patient care.

The platform does not use advertising tracking cookies. An authentication token and your preferences (language) are kept in your browser's local storage for the session and ease of use. You can clear them at any time in your browser settings.

This policy may be updated to reflect legal, technical or functional changes. The applicable version is the one published on the platform, with the date of the last update shown at the top of the document.