Implicity is committed to protecting your privacy. This policy explains, clearly and concisely, what personal data we process, why, for how long, and how you can exercise your rights.
At a glance
| Question | Short answer |
|---|---|
| Who is responsible for your data? | Implicity SAS, a French company, acting as data controller |
| What data? | Identity and contact details, professional information, the content of your communications with us, browsing data |
| Why? | To respond to your requests, inform you about our solutions, manage our contractual relationships, measure website audience and comply with our legal obligations |
| Health data? | No health data is collected through this website |
| Cookies? | Non-essential cookies are only placed with your consent, which you can change at any time |
| Your rights? | Access, rectification, erasure, objection, restriction, portability, withdrawal of consent, instructions regarding your data after death |
| Who to contact? | Our Data Protection Officer: dpo@implicity.com |
Who are we?
Implicity SAS is the controller of your personal data within the meaning of the General Data Protection Regulation (GDPR) and the French Data Protection Act (loi Informatique et Libertés).
- Data controller: Implicity SAS, a French simplified joint-stock company (société par actions simplifiée) with share capital of €343,227.10, whose registered office is at 15 rue des Halles, 75001 Paris, France, registered with the Paris Trade and Companies Register under SIREN number 820 529 089.
- Group: Implicity SAS (France) and its subsidiary Implicity, Inc. (United States).
- Data Protection Officer (DPO): can be contacted at dpo@implicity.com.
- UK representative: Prighter, who can be contacted via prighter.com/q/19160226698.
Implicity is certified as a Health Data Host (HDS) and ISO/IEC 27001.
What does this policy cover?
This policy applies when you:
- visit our website implicity.com;
- contact us by email, telephone or through a form;
- visit our premises or attend our events;
- interact with us as a customer, partner, supplier or service provider;
- and, more generally, communicate with us.
It does not cover patient data processed within our remote monitoring solutions.
What data, for what purpose and for how long?
We only collect the data necessary for each purpose. It comes from three sources:
- you, when you contact us, fill in a form, subscribe to our communications or talk with us at an event;
- third-party sources: professional networks (for example LinkedIn), public sources, business partners, event organisers;
- your browsing on the website, through cookies and similar technologies, with your consent where required.
| Purpose | Data concerned | Legal basis | Retention period |
|---|---|---|---|
| Responding to your requests (contact, demo, quote) | Name, email, telephone, postal address, institution, profession, content of your message | Pre-contractual steps taken at your request, or legitimate interest | Time needed to handle the request, then 3 years after the last contact |
| Keeping you informed about our solutions, events and news | Identity, professional contact details, profession, specialty, institution, public information from professional networks | Legitimate interest for professionals contacted in connection with their professional activity; consent in all other cases | 3 years after your last contact with us |
| Managing our relationship with customers, partners, suppliers and service providers | Identity, contact details, job title, contractual and billing data | Performance of a contract | Term of the contract + 5 years; accounting records: 10 years |
| Welcoming visitors and event attendees | Identity, organisation, contact details | Legitimate interest | Duration of the event + 3 months |
| Measuring audience and improving the website | Anonymised IP address, browser and device information, pages viewed | Consent | Trackers: 24 months maximum; audience data: 25 months maximum |
| Complying with our legal obligations, handling disputes and defending our rights | Any relevant data among the above | Legal obligation; legitimate interest | Applicable statutory limitation periods |
After these periods, your data is deleted or anonymised.
Cookies and other trackers
Cookies that are not essential to the operation of the website are only placed with your consent. On your first visit, a banner lets you accept, refuse or customize cookies, as easily one way as the other. You can change your choices at any time via the link at the bottom of the page or in your browser settings.
Strictly necessary cookies (exempt from consent)
| Service | Purpose | Category (banner) | Controller / third party | Cookies and retention |
|---|---|---|---|---|
| Amazon AWS | Cloud infrastructure | Functional cookies | AWS | AWSALB / AWSALBCORS (load balancing): 7 days by default |
| Stripe | Website security and stability | Functional cookies | Stripe | __stripe_mid (device identifier, anti-fraud): 1 year; __stripe_sid (payment session): 30 minutes |
| Google Fonts | File hosting (fonts) | Functional cookies | No persistent cookie; session cookies deleted when the browser closes | |
| CDN Google | Static content delivery | Functional cookies | — | — |
| CloudFront | Content delivery network | Functional cookies | AWS | — |
| Font Awesome | Icon library | Functional cookies | Font Awesome | fontawesome (session, strictly necessary): deleted when the browser closes; fa_cookie_settings (consent memory): 1 year |
| Google Tag Manager | Marketing tag management | Functional cookies | — | |
| Cloudflare | CDN and network protection | Functional cookies | Cloudflare | __cf_bm: 30 minutes; _cfuvid: session; cf_clearance: 1 year; __cflb: up to 24 hours; __cfruid: session; cf_ob_info / cf_use_ob: 30 seconds |
Cookies subject to your consent
Audience measurement outside the exemption
| Service | Purpose | Category (banner) | Controller / third party | Cookies and retention |
|---|---|---|---|---|
| Matomo | Measure website audience | Audience Measurement & Analytics | Matomo | _pk_id (visitor identifier): up to 13 months; _pk_ses / _pk_cvar (session): 30 minutes; _pk_ref (referrer): 6 months |
| Google Analytics 4 | Measure audience | Audience Measurement & Analytics | _ga cookie: 2 years by default. Server-side retention, separate and configurable in GA4: event data 2 months by default, user data 14 months by default | |
| DoubleClick | Display advertising on the Google network | Audience Measurement & Analytics | IDE (advertising, personalisation): 13 months in the EEA, 24 months outside Europe; DSID (cross-device association, if signed in): up to 24 months; test_cookie (technical check): about 15 minutes | |
| Google Advertising Products | Measure Google campaign performance | Audience Measurement & Analytics | Session cookies: deleted when the browser closes; measurement/effectiveness cookies (e.g. _gcl_au): about 3 months; ad personalisation and display cookies: up to 13 months |
Targeted or personalised advertising
| Service | Purpose | Category (banner) | Controller / third party | Cookies and retention |
|---|---|---|---|---|
| Google (ad personalisation) | Personalise the advertising experience | Audience Measurement & Analytics | IDE and id: 13 months in the EEA, 24 months outside Europe; NID: 6 months after last use | |
| Google (advertising user data) | Share activity data for advertising purposes | Audience Measurement & Analytics | AEC: 6 months; advertising server logs: anonymised or deleted after 18 months; Google Signals data / signed-in users (Analytics): 26 months maximum by default | |
| YouTube (personalised ads) | Embedded videos hosted on YouTube | Targeted Advertising | Google / YouTube | Session cookies: deleted when the browser closes; NID / __Secure-YNID (functionality, analytics): 6 months after last use; __Secure-ENID / __Secure-YENID (persistent audience measurement): up to 13 months |
Social networks
| Service | Purpose | Category (banner) | Controller / third party | Cookies and retention |
|---|---|---|---|---|
| Identify visitors coming from LinkedIn | Social network | lang, uh, sdsc (session): deleted when the browser closes; lidc (short-term functionality): 24 hours; li_gc / li_mc (consent preferences): 6 months; bcookie / li_rm (browsing, sign-in): 1 year |
Other
| Service | Purpose | Category (banner) | Controller / third party | Cookies and retention |
|---|---|---|---|---|
| Calendly | Appointment booking plugin | Other | Calendly | Varies by tracker: anti-bot cookie (e.g. __cf_bm, via Cloudflare) about 1 day; other anonymous identifiers up to 1 year |
| Google reCAPTCHA | Secure contact forms | Other | _GRECAPTCHA (anti-bot analysis): about 6 months; rc::a and rc::f (ongoing traffic assessment): no expiry (persistent); rc::c and rc::b: session only | |
| Brevo | Email and marketing automation | Other | Brevo | _brevo_id (visitor identification): 13 months; _brevo_ses (session tracking): session only; affiliate programme cookie: 90 days |
For all of these cookies, you can withdraw your consent at any time through the cookie management banner. Some of these services are provided by companies located outside the European Union.
Who can access your data?
Your data is only accessible to those who need it, and is never sold.
- Authorised Implicity staff, within the limits of their duties.
- Our subsidiary Implicity, Inc., where your request concerns the US market.
- Our service providers (hosting, systems administration, customer relationship management, emailing and appointment booking tools, accounting). They act on our instructions, under a contract that requires them to provide confidentiality and security guarantees in accordance with Article 28 of the GDPR.
- Public authorities, only where required by law.
Is your data transferred outside the European Union?
Your personal data may be stored and processed by Implicity in France and in the European Union. It may also be transferred outside the European Union, in particular to the United States, to our subsidiary Implicity, Inc. or to certain third-party service providers we use. In such cases, we have put appropriate safeguards in place to ensure the protection of your personal data. These transfers do not involve personal health data.
How do we protect your data?
Security is at the heart of our organisation, as demonstrated by our ISO/IEC 27001 and Health Data Host (HDS) certifications.
We apply technical and organisational measures appropriate to the sensitivity of the data and to the state of the art, in order to prevent any loss, misuse, alteration or unauthorised access: strict access rights management, encryption, logging, staff awareness training and regular assessment of our service providers.
What are your rights?
You have the following rights over your data, under the conditions set out by applicable law:
| Right | What it allows you to do |
|---|---|
| Access | Find out whether we process your data and obtain a copy of it |
| Rectification | Correct inaccurate or incomplete data |
| Erasure | Request the deletion of your data |
| Objection | Object to processing based on our legitimate interest, and object at any time to direct marketing |
| Restriction | Temporarily suspend the use of your data |
| Portability | Receive the data you have provided to us in a machine-readable format |
| Withdrawal of consent | Withdraw your consent at any time, without affecting the lawfulness of prior processing |
| Instructions after death | Set out what should happen to your data after your death (a right provided under French law) |
How to exercise them? Write to our DPO at dpo@implicity.com or to the postal address of our registered office, for the attention of the DPO. We will respond within one month, which may be extended by two months for complex requests. We may ask you for proof of identity if we have reasonable doubts.
In the United Kingdom, you can also exercise your rights through our representative Prighter: prighter.com/q/19160226698.
Complaints and changes to this policy
If, after contacting us, you believe that your rights have not been respected, you can lodge a complaint with the CNIL, the French data protection authority (3 place de Fontenoy, TSA 80715, 75334 Paris Cedex 07 — cnil.fr), or with the data protection authority of your country.
We review this policy regularly to reflect changes in law, regulation and our services. Any new version is published on this page with its update date; in the event of a significant change, we will inform you by appropriate means.