For the purposes of this article :
(I) Patient Data designates the personal data of Patients, processed within the framework of the use of the Platform and/or the Doctor’s Webshop, relating both to their civil status (“Identifying Data”) and to their health (“Qualifying Data”). Patient Data can be communicated by the Patient himself if he is a User of the Site and/or collected directly by the Doctor via his account on the Platform. To find out more about the treatment of the Patient Data operated by UNIVERSKIN, if necessary, jointly responsible with the Doctor or subcontracted by the latter (see the stipulations below), the Doctor is invited to read the Patients privacy notice available at the following address: https://www.skinxs.com/patient-notice.
(II) Patient designates a patient of the Doctor - User or not of the Site, whose Patient Data is processed through the Platform as part of his medical follow-up by the Doctor.
1. Roles and responsibilities
Given the purposes of the Platform and the Doctor's Webshop, when processing the Patient Data identified below, the Doctor expressly acknowledges and accepts that UNIVERSKIN may have the following qualities, within the meaning of the Regulations applicable to the protection personal data:
- Data controller: UNIVERSKIN then determines the purposes and means of the processing, i.e. the processing is carried out on behalf of UNIVERSKIN, which is responsible for the measures taken to operate this processing;
- Joint controller: UNIVERSKIN determines jointly with the Doctor the purposes of the processing carried out via the Platform and/or the Doctor’s Webshop. UNIVERSKIN and the Doctor are jointly and severally responsible for the security and confidentiality measures implemented to preserve the personal data of Users;
- Subcontractor: UNIVERSKIN acts on behalf of the Physician, qualified as 'data controller', on the latter's instructions and within the limits of the missions entrusted to it contractually.
2. Mapping of Patient Data processing
2.1. Processing carried out on the Platform (https://skinxs.com):
| UNIVERSKIN, together with the Doctor |
Management of the User's connection to the Platform and the provision of the Questionnaire |
Execution of the general conditions of use of the Platform |
- Identifying Data
- IP address
- Connection logs
|
| UNIVERSKIN, together with the Doctor |
Ensure and manage the connection between the User and the Doctor consulted through the Platform (incoming flows when the Doctor registers the User on the Platform, management of the relationship in use and management of outgoing flows) |
Execution of the general conditions of use of the Platform |
- Identifying Data
- Qualifying Data
|
| Doctor, UNIVERSKIN acting as a subcontractor |
Establishment, from the Qualifying Data communicated by the User, of an initial scientific analysis of his Qualifying Data aimed at assisting the Doctor in the diagnosis he will make, with a view to defining a dermatological formulation adapted to the User |
Execution of the general conditions of use of the Platform |
- Identifying Data
- Qualifying Data
|
| Doctor, UNIVERSKIN acting as a subcontractor |
Automation, by the Tool, of the establishment of the diagnosis, the cosmetic formulation and the prescription of the Product |
Execution of the general conditions of use of the Platform |
- Identifying Data, previously pseudonymized
- Qualifying Data
|
| Doctor, UNIVERSKIN acting as a subcontractor |
Data annotation and labeling to improve the quality and accuracy of automated skin assessment |
Execution of the general conditions of use of the Platform and Legitimate interest |
- Identifying Data, previously pseudonymized
- Qualifying Data
|
| Doctor, UNIVERSKIN acting as a subcontractor |
Respond to User requests and provide technical support in their use of the Platform, as well as its maintenance |
Execution of the general conditions of use |
- E-mail address
- Any personal data and other information that the User could communicate to UNIVERSKIN or the Doctor in this context
|
| Doctor, UNIVERSKIN acting as a subcontractor |
Management of any disputes with Users concerning the use of the Platform |
Legitimate interest |
- Identifying Data
- Connection logs
- IP address
- If applicable, identity document (exercise of a right)
|
| UNIVERSKIN |
Operational management of the Platform (ensure its proper functioning, support and maintenance) |
Execution of the general conditions of use |
- Identifying Data
- Connection logs
- IP address
- If applicable, if an anomaly concerns the Qualifying Database, possible access to this data.
|
| UNIVERSKIN |
Prevention and detection of fraud, malware and management of security incidents |
Legitimate interest |
- Connection logs
- IP address
- Last name First Name
- E-mail address
|
| UNIVERSKIN |
Monitoring and analysis of traffic on the Platform in order to improve its functionalities and the user experience |
Legitimate interest |
- Statistical data usage (cookies)
- IP address
- Connection logs
|
| UNIVERSKIN |
Statistics |
Legitimate interest |
- Statistical data usage (cookies)
|
| UNIVERSKIN |
Unless the User objects, for secondary scientific research purposes in order to improve the mechanism for defining the formulation of products designed by UNIVERSKIN |
Processing necessary for scientific research purposes (article 9.1 j of the GDPR) |
- Identifying Data, previously pseudonymized
- Qualifying Data
|
| UNIVERSKIN, together with the Doctor |
Ensure the traceability of data between the Doctor and the User between the Site and the Platform |
Legitimate interest |
|
| Doctor, UNIVERSKIN acting as a subcontractor |
Ensure the order taking, purchase and delivery of products ordered on the Site |
Execution of the general conditions of sales |
- Identifying Data
- Shopping cart
- Delivery postal address and, if different, billing address
|
| Doctor, UNIVERSKIN acting as a subcontractor |
Provide after-sales service |
Execution of the general conditions of sales |
- Identifying Data
- Shopping cart
- Delivery postal address and, if different, billing address
|
| Doctor, UNIVERSKIN acting as a subcontractor |
Claims management |
Legitimate interest |
- Identifying Data
- Shopping cart
- If applicable, if the complaint concerns the quality of the products sold, the Qualifying Data
|
| Doctor, UNIVERSKIN acting as a subcontractor |
Operational management of the Doctor’s Webshop (ensure its proper functioning, support and maintenance) |
Execution of the general conditions of use |
- Identifying Data
- Where applicable, shopping cart and postal addresses (delivery and invoicing), as well as any data that the User may communicate in this context
|
| UNIVERSKIN |
Prevention and detection of fraud, malware and management of security incidents |
Legitimate interest |
- Connection logs
- IP address
- Last name First Name
- E-mail address
|
| UNIVERSKIN |
Platform traffic monitoring and analysis |
Legitimate interest |
- Statistical data usage (cookies)
- Connection logs
- IP address
|
| UNIVERSKIN |
Statistics |
Legitimate interest |
- Statistical data usage (cookies)
|
3. Physician's responsibility for processing Patient Data
Patient Data processed by the Doctor through the Platform and the Doctor’s Webshop is strictly covered by professional secrecy, which the Doctor seeks to respect and to make respect to the members of his team who could gain access to the Patient Data. The Doctor is the sole master of the proper use, with discernment and wit, of the Platform and the Doctor’s Webshop and the data it contains and, in particular, Patient Data.
As responsible - alone or jointly with UNIVERSKIN - for the processing carried out on Patient Data through the Platform and the Doctor's Webshop, the Doctor undertakes :
- To set up and maintain appropriate security and confidentiality measures for its information system, such as to guarantee adequate protection of the personal data it processes, adapted to the risks engendered by their processing on the rights and freedoms of his Patients, in accordance with the Regulations applicable to the protection of personal data and the regulatory and ethical requirements related to his professional activity;
- To respect, at all times and in any event, the rights of Patients whose Patient Data is processed and, in particular, immediately inform UNIVERSKIN if a Patient sends him directly (ie outside of the contact form or the dedicated contact email, available on the Site or the Doctor's Webshop) a request in the event of the exercise of a right by a Patient under the Regulations applicable to the protection of personal data;
- In the event of a personal data breach, proceed within 72 hours of becoming aware of a personal data breach, to notify the competent authorities and the persons concerned by the breach, under the conditions and according to the procedures provided for by the Regulations applicable to the protection of personal data.
The violation may affect the Platform or the Doctor's Webshop, in which case UNIVERSKIN undertakes to notify it under the conditions provided for in section 4 below.
If the violation affects the Doctor's information system (excluding the Platform and/or Doctor's Webshop), the Doctor undertakes to immediately inform UNIVERSKIN in order to allow the latter to take all the security measures necessary to avoid or limit the spread of the violation to its own information system.
With specific regard to the Doctor's Webshop, the Doctor undertakes to inform the Patient of the transmission of his personal data to UNIVERSKIN for the purposes of placing an order. The Doctor undertakes to obtain the prior consent of the Patient to do so and guarantees UNIVERSKIN in this regard. The Doctor also undertakes to obtain the Patient's consent for the sending of notifications by UNIVERSKIN by sms and/or email, for the purpose of informing the Patient of the methods of ordering his products on the Doctor's Webshop.
The Patient is then invited to connect to the Doctor's Webshop.
On the Doctor's Webshop, the Patient will be invited to view his analysis results carried out by the Doctor then, if he wishes, order the product(s) recommended by the Doctor and/or offered in addition by UNIVERSKIN.
The procedure for ordering Products is governed by the general terms and conditions of sale of the Doctor's Webshop, available at the following address: https://skinxs.com/terms-of-sales.
4. Responsibility of UNIVERSKIN for the processing of Patient Data
Whether acting as joint controller or subcontractor of the Doctor, UNIVERKIN undertakes to comply with the following obligations:
- ensure the confidentiality of Patient Data and ensure that each person whom they authorize to process said data seeks to respect confidentiality or is subject to an appropriate obligation of confidentiality ;
- ensure the security and integrity of Patient Data on the Platform. As such, UNIVERSKIN implements and maintains appropriate security measures as specified in article III below ;
- not to use Patient Data for purposes other than those provided for and recalled herein and in the Patient Privacy Policy, and not to keep them beyond the period provided for in these documents. In any case, UNIVERSKIN undertakes to respect the stipulations of point 7 below concerning the fate of Patient Data;
- not to grant, rent, assign or otherwise communicate to another person, all or part of the Patient Data with the exception of the recipients mentioned in the Patient Privacy Policy;
- provide assistance to the Doctor in order to allow him to respond, within the time limits and under the conditions provided for by the Regulations applicable to the protection of personal data, to any request for the exercise of a right, request or complaint by a data protection authority member or any other regulator ;
- not to transfer the Patient Data processed to countries outside the European economic area which have not been recognized by the European Commission as ensuring an adequate level of protection (i) without first obtaining the express written authorization of the Doctor and (ii) without the implementation of legal instruments recognized as appropriate by the Regulations applicable to the protection of personal data to supervise the transfer(s) concerned;
- immediately alert the Doctor in the event of a violation of Patient Data and, when UNIVERSKIN acts as joint manager or subcontractor of the Doctor, to assist the Doctor in the implementation of any action to deal with this data breach, including notifications to the competent authorities and to persons affected by the breaches and provide any useful information enabling the extent of the data breach to be assessed and the means to be remedied to be identified;
5. Secondary use of Patient Data by UNIVERSKIN
The Doctor recognizes and accepts that Patient Data of Patients who have not objected to the secondary use of their personal data by UNIVERSKIN for research purposes with a view to improving the mechanism of definition of the formulation of products designed by UNIVERKSIN, may be processed by UNIVERSKIN for this purpose. In strict compliance with professional secrecy, Patient Data will be pseudonymized beforehand by an automated process based on depletion and the secure hashing by private key of Patient Data, so that the data used for research purposes does not contain any personal data that could directly identify a patient.
The Doctor declares and acknowledges having informed the Patients that he follows, and of which he integrates Patient Data on the Platform, regarding the secondary use of their personal data for research purposes. The Doctor seeks to immediately inform UNIVERSKIN in the event of a Patient's opposition to the secondary use of his personal data. The Doctor guarantees UNIVERSKIN against any action by the Patient in relation to prior information and non-opposition to the processing of data in this context.
6. Release of Patient Data at the end of the use of the Platform and the Doctor’s Webshop by the Doctor
At the end of the use of the Doctor’s account on the Platform, for whatever reason, UNIVERSKIN will return the Patient Data processed on the Platform and the Doctor’s Webshop to the Doctor who requests it.
The Doctor expressly recognizes and accepts that UNIVERSKIN will keep all Patient Data (Identifying Data and Qualifying Data) which have been communicated by the User with a view to creating his User account on the Site, to allow the User to transmit his Personal Data to any other doctor of his choice.
Only the Patient Data collected by the Doctor on the Platform, as part of his care for the User (all data linked to the Doctor’s account) will be deleted.
