Avicenna.AI is committed to protecting the privacy of everyone who interacts with our website and our communications. This policy explains what personal data we collect, why we collect it, who we share it with, and how you can exercise control over it.
This policy explains how Avicenna.AI processes personal data collected through our website and our marketing and communication activities.
It does not cover the processing of patient or clinical data by our medical-device software (the CINA tool family and related platforms). For those activities, Avicenna.AI acts as a processor on behalf of the healthcare institutions that use our software; that processing is governed by separate data-processing agreements between Avicenna.AI and those institutions (the controllers), not by this policy.
When you submit a form on our website – including a contact request, newsletter sign-up, demo request, or to download a case study, brochure, or webinar replay, the information you provide, which may include your first and last name, job title, email, city, country and company, is captured through our marketing automation platform, HubSpot, and stored there to respond to your request and, where you’ve consented, to send you relevant marketing communications or sales information. We do not use email open or click-tracking (no tracking pixels or link-tracking) in our marketing emails.
We also contact professional contacts for B2B prospecting purposes even where you haven’t submitted a form to us directly. Depending on the contact, this data may come from: (i) a web form you’ve filled in yourself; (ii) contact details exchanged in person at a medical congress, conference, or industry event; or (iii) publicly available professional sources (for example, LinkedIn) where we’ve identified your profile as matching the audience of radiology and healthcare professionals our tools are designed for. Except where you’ve given consent via a web form, we rely on our legitimate interest in promoting our tools to relevant professional contacts (Art. L.34-5 French Post & Electronic Communications Code, soft opt-in), and you can opt out of these communications at any time.
We use cookies and similar technologies, including through HubSpot and Google Analytics 4, to operate the site and, where you consent, to understand how visitors use it.
If you apply for a role at Avicenna.AI, we collect the information you submit (CV, cover letter, contact details) to evaluate your application. We keep your application for 1 year after you submit it, so that we can contact you if another position matching your profile opens. We do not use it to send you newsletters or marketing communications.
We do not take any decision producing legal effects concerning you, or similarly significantly affecting you, based solely on automated processing (Article 22 GDPR). Lead scoring in HubSpot is used only to help us prioritise our own follow-up and does not, by itself, determine any decision about you.
GDPR requires that every processing activity rest on one specific legal basis. Here’s how each activity above maps to one:
| Activity | Data involved | Legal basis |
|---|---|---|
| Prospecting emails | First and last name, job title, email, company, city, country | Legitimate interest in promoting our tools to professional contacts (Art. L.34-5 French Post & Electronic Communications Code, soft opt-in), with opt-out always available – this covers contacts met at a congress/event or sourced from public professional sources (see Section 2). Where you’ve given consent via a web form, we rely on that consent instead. |
| Newsletter sign-up, Content downloads & webinar replay | First and last name, job title, email, company | Consent |
| Analytics & marketing cookies | Usage data, device/browser identifiers | Consent |
| Strictly necessary cookies | Session/functional data | Legitimate interest (no consent required) |
| Job applications | CV, cover letter, contact details | Pre-contractual steps (Art. 6(1)(b) GDPR), to evaluate your application. Keeping your application for 1 year, to contact you if another position matching your profile opens, is based on our legitimate interest. You can object to it at any time. |
Cookies are small text files stored on your device by your browser. Our website uses three categories:
Some pages also embed YouTube videos in privacy-enhanced mode (youtube-nocookie.com), which does not set cookies unless you choose to play the video.
We use Axeptio, a cookie consent management platform, to display a cookie banner where you can accept, decline, or customise your preferences by category. You can change your choice at any time by reopening the Axeptio preference panel (usually available via a link in the site footer), or through your browser settings. Marketing and analytics cookies are not set until you consent. Exact durations per cookie are listed below.
| Cookie | Set by | Category | Purpose | Duration |
|---|---|---|---|---|
| hubspotutk | HubSpot | Marketing | Recognizes a returning visitor and links activity to a contact record | 6 months |
| __hstc | HubSpot | Marketing | Main visitor cookie – tracks visits, source, and pages viewed | 6 months |
| __hssc | HubSpot | Marketing | Tracks sessions to determine if activity should reset | 30 min |
| __hssrc | HubSpot | Marketing | Detects a new browser session | End of browser session |
| _ga / ga* | Google Analytics 4 | Analytics & Stats | Distinguishes unique visitors to measure audience and site usage | Up to 2 years |
| axeptio_cookies | Axeptio | Essential | Stores your cookie consent choices | 6 months |
| axeptio_authorized_vendors | Axeptio | Essential | Stores which vendors/categories you’ve consented to | 6 months |
We work with a small number of service providers who process personal data on our behalf, under confidentiality and data-processing obligations. We do not sell or rent your data to anyone.
| Provider | Purpose | Location |
|---|---|---|
| HubSpot, Inc. / HubSpot Ireland Ltd. | Marketing automation, forms, email delivery | Data hosted in Germany (EU); company headquartered in the United States |
| Google LLC (Google Analytics 4, via gtag.js) | Website analytics – audience measurement and usage statistics | Ireland |
| Axeptio (Agilitation SAS) | Cookie consent management (cookie banner) | Montpellier, France (EU) |
| OVH SAS | Website hosting | France (EU) |
HubSpot hosts our data in Germany (EU). As HubSpot is headquartered in the United States, limited data access (for example, customer support) may still involve the US, for which HubSpot maintains an active certification under the EU-U.S. Data Privacy Framework (DPF). Google (Google Analytics 4) is based in Ireland. Where personal data leaves the EU/EEA through any of our providers, we rely on recognized safeguards – such as Standard Contractual Clauses and/or DPF certification. You can request details of the specific safeguard used for any transfer by contacting our DPO.
GDPR requires that every processing activity rest on one specific legal basis. Here’s how each activity above maps to one:
| Activity | Data involved | Legal basis |
|---|---|---|
| Prospecting emails | First and last name, job title, email, company, city, country | Legitimate interest in promoting our tools to professional contacts (Art. L.34-5 French Post & Electronic Communications Code, soft opt-in), with opt-out always available – this covers contacts met at a congress/event or sourced from public professional sources (see Section 2). Where you’ve given consent via a web form, we rely on that consent instead. |
| Newsletter sign-up, Content downloads & webinar replay | First and last name, job title, email, company | Consent |
| Analytics & marketing cookies | Usage data, device/browser identifiers | Consent |
| Strictly necessary cookies | Session/functional data | Legitimate interest (no consent required) |
| Job applications | CV, cover letter, contact details | Pre-contractual steps (Art. 6(1)(b) GDPR), to evaluate your application. Keeping your application for 1 year, to contact you if another position matching your profile opens, is based on our legitimate interest. You can object to it at any time. |
We apply appropriate technical and organisational measures to protect personal data against unauthorised access, alteration, disclosure, or loss – including access controls, encryption in transit, logging, and supplier security requirements. Our key service providers maintain independently validated security programmes (e.g. ISO 27001). Further detail is available on request to our DPO.
As a data subject under French Law No. 78-17 of 6 January 1978 (as amended in 2018) and EU Regulation 2016/679 (GDPR), you have the following rights with respect to your personal data:
Request a copy of the personal data we hold about you.
Request correction of inaccurate or incomplete data.
Request deletion of your personal data in certain circumstances.
Object to the processing of your data for marketing purposes.
Receive your data in a structured, machine-readable format.
Request that we limit how we use your data in certain situations.
If you believe your data protection rights have not been respected, you have the right to lodge a complaint with the CNIL (Commission Nationale de l’Informatique et des Libertés), the French data protection authority.
For GDPR or HIPAA enquiries, data subject access requests, or regulatory due diligence, our DPO is your dedicated contact.
We acknowledge requests promptly and respond within one month.
Postal address: Bâtiment B Zone Industrielle Athelia 4, 375 Avenue du Mistral, 13600 La Ciotat
Stéphane Berger
Tell us about your challenges and clinical routine. We will show you which CINA tools fit, and how they plug into your PACS.
Get the latest updates and insights from Avicenna.AI.
