On-Kare
    Demo
    🔒 Data Security

    Privacy Policy

    Complete transparency on the protection and processing of your health data.

    1. Data controller

    On-Kare, a corporation headquartered at its registered office address.

    Data Protection Officer

    For any questions regarding data protection, please contact our Data Protection Officer at dpo@on-kare.org. You may also exercise your rights by writing to this address.

    2. Data collected

    As part of using our service, we collect:

    • Identification data (last name, first name, email address)
    • Data related to your practice (name, address, registration number)
    • Connection data (logs, IP addresses)

    3. Processing purposes

    Your data is processed for:

    • Providing the On-Kare service
    • Managing your user account
    • Improving our services
    • Compliance with our legal obligations

    Legal Basis for Processing

    We process your personal data based on the following legal grounds, in compliance with the GDPR:

    • Consent — For marketing communications, cookie preferences, and newsletter subscriptions. You may withdraw your consent at any time.
    • Contract Performance — For delivering our services, managing your account, providing customer support, and processing payments.
    • Legitimate Interest — For platform security, fraud prevention, service improvement, and anonymous usage analytics.

    Data Retention Periods

    We retain your personal data only as long as necessary for the purposes described below:

    • Contact form data — 12 months from submission
    • Event registration data — 12 months after the event
    • Account data — Duration of contract + 3 years
    • Cookies — 13 months maximum

    Sub-Processors & Third Parties

    We use the following third-party services to deliver and improve our platform:

    Supabase

    Supabase — Database hosting and authentication (USA, with EU Standard Contractual Clauses)

    OVHcloud

    OVHcloud — Cloud infrastructure and hosting (Roubaix, France, EU)

    Google Fonts

    Google Fonts — Typography delivery (no personal data collected, fonts served via CDN)

    International Data Transfers

    Some of our sub-processors operate outside the European Economic Area. In such cases, we ensure an adequate level of protection through EU Standard Contractual Clauses (SCCs) approved by the European Commission, or equivalent safeguards as required by applicable data protection laws.

    Data Breach Notification

    In the event of a personal data breach that poses a risk to your rights and freedoms, we commit to notifying the competent supervisory authority within 72 hours in accordance with GDPR Article 33. If the breach poses a high risk to you, we will also inform you directly without undue delay.

    Cookie Policy

    Our website uses cookies to ensure proper functionality and improve your experience. Here are the categories of cookies we use:

    Essential Cookies

    Required for the website to function properly. These include language preferences and cookie consent status. They cannot be disabled.

    Analytics Cookies

    Help us understand how visitors interact with our website by collecting anonymized usage data. Currently, no third-party analytics are active.

    Preference Cookies

    Remember your settings and preferences (such as language selection) to provide a personalized experience across visits.

    4. Health data hosting

    On-Kare runs on cloud infrastructure with ISO 27001-ready security controls, following international healthcare data protection standards. ISO 27001 certification is planned and SOC 2 attestation is planned; On-Kare holds no certification or attestation today.

    5. Your rights

    In accordance with applicable data protection regulations, you have the following rights:

    Right to access your data
    Right to rectification
    Right to erasure
    Right to data portability
    Right to object

    To exercise these rights, contact us at:

    2,156 clinical and operational capabilities. One single platform.

    8 business domains, 25 specialties, 7 care settings and 343 AI-augmented capabilities — without stacking more software.

    See the coverage