Privacy Policy
Complete transparency on the protection and processing of your health data.
1. Data controller
On-Kare, a corporation headquartered at its registered office address.
Data Protection Officer
For any questions regarding data protection, please contact our Data Protection Officer at dpo@on-kare.org. You may also exercise your rights by writing to this address.
2. Data collected
As part of using our service, we collect:
- Identification data (last name, first name, email address)
- Data related to your practice (name, address, registration number)
- Connection data (logs, IP addresses)
3. Processing purposes
Your data is processed for:
- Providing the On-Kare service
- Managing your user account
- Improving our services
- Compliance with our legal obligations
Legal Basis for Processing
We process your personal data based on the following legal grounds, in compliance with the GDPR:
- Consent — For marketing communications, cookie preferences, and newsletter subscriptions. You may withdraw your consent at any time.
- Contract Performance — For delivering our services, managing your account, providing customer support, and processing payments.
- Legitimate Interest — For platform security, fraud prevention, service improvement, and anonymous usage analytics.
Data Retention Periods
We retain your personal data only as long as necessary for the purposes described below:
- Contact form data — 12 months from submission
- Event registration data — 12 months after the event
- Account data — Duration of contract + 3 years
- Cookies — 13 months maximum
Sub-Processors & Third Parties
We use the following third-party services to deliver and improve our platform:
Supabase
Supabase — Database hosting and authentication (USA, with EU Standard Contractual Clauses)
OVHcloud
OVHcloud — Cloud infrastructure and hosting (Roubaix, France, EU)
Google Fonts
Google Fonts — Typography delivery (no personal data collected, fonts served via CDN)
International Data Transfers
Some of our sub-processors operate outside the European Economic Area. In such cases, we ensure an adequate level of protection through EU Standard Contractual Clauses (SCCs) approved by the European Commission, or equivalent safeguards as required by applicable data protection laws.
Data Breach Notification
In the event of a personal data breach that poses a risk to your rights and freedoms, we commit to notifying the competent supervisory authority within 72 hours in accordance with GDPR Article 33. If the breach poses a high risk to you, we will also inform you directly without undue delay.
Cookie Policy
Our website uses cookies to ensure proper functionality and improve your experience. Here are the categories of cookies we use:
Essential Cookies
Required for the website to function properly. These include language preferences and cookie consent status. They cannot be disabled.
Analytics Cookies
Help us understand how visitors interact with our website by collecting anonymized usage data. Currently, no third-party analytics are active.
Preference Cookies
Remember your settings and preferences (such as language selection) to provide a personalized experience across visits.
4. Health data hosting
On-Kare runs on ISO 27001 certified cloud infrastructure covered by a SOC 2 Type II report, meeting international healthcare data protection standards.
5. Your rights
In accordance with applicable data protection regulations, you have the following rights:
To exercise these rights, contact us at:
2,156 clinical and operational capabilities. One single platform.
8 business domains, 25 specialties, 7 care settings and 343 AI-augmented capabilities — without stacking more software.