GDPR · French Law 78-17 · EU Regulation 2016/679
Avicenna.AI is committed to protecting the privacy of everyone who interacts with our website and our communications. This policy explains what personal data we collect, why we collect it, who we share it with, and how you can exercise control over it.
This policy explains how Avicenna.AI processes personal data collected through our website and our marketing and communication activities.
It does not cover the processing of patient or clinical data by our medical-device software (the CINA product family and related platforms). For those activities, Avicenna.AI acts as a processor on behalf of the healthcare institutions that use our software; that processing is governed by separate data-processing agreements between Avicenna.AI and those institutions (the controllers), not by this policy.
When you submit a form on our website – including a contact request, newsletter sign-up, demo request, or to download a case study, brochure, or webinar replay – the information you provide, which may include your first and last name, job title, email, city, country and company, is captured through our marketing automation platform, HubSpot, and stored there to respond to your request and, where you’ve consented, to send you relevant marketing communications or sales information. We do not use email open or click-tracking (no tracking pixels or link-tracking) in our marketing emails.
We also contact professional contacts for B2B prospecting purposes even where you haven’t submitted a form to us directly. Depending on the contact, this data may come from: (i) a web form you’ve filled in yourself; (ii) contact details exchanged in person at a medical congress, conference, or industry event; or (iii) publicly available professional sources (for example, LinkedIn) where we’ve identified your profile as matching the audience of radiology and healthcare professionals our products are designed for. Except where you’ve given consent via a web form, we rely on our legitimate interest in promoting our products to relevant professional contacts (Art. L.34-5 French Post & Electronic Communications Code, soft opt-in), and you can opt out of these communications at any time.
If you apply for a role at Avicenna.AI, we collect the information you submit (CV, cover letter, contact details) to evaluate your application.
We do not take any decision producing legal effects concerning you, or similarly significantly affecting you, based solely on automated processing (Article 22 GDPR). Lead scoring in HubSpot is used only to help us prioritise our own follow-up and does not, by itself, determine any decision about you.
GDPR requires that every processing activity rest on one specific legal basis. Here’s how each activity above maps to one:
| Activity | Data involved | Legal basis |
|---|---|---|
|
Prospecting emails |
First and last name, job title, email, company, city, country
|
Legitimate interest in promoting our products to professional contacts (Art. L.34-5 French Post & Electronic Communications Code, soft opt-in), with opt-out always available – this covers contacts met at a congress/event or sourced from public professional sources (see Section 2). Where you’ve given consent via a web form, we rely on that consent instead..
|
|
Newsletter sign-up, Content downloads & webinar replay
|
First and last name, job title, email, company
|
Consent
|
|
Analytics & marketing cookies
|
Usage data, device/browser identifiers
|
Consent
|
|
Strictly necessary cookies
|
Session/functional data
|
Legitimate interest (no consent required)
|
|
Job applications
|
CV, cover letter, contact details
|
Pre-contractual steps (Art. 6(1)(b) GDPR), to evaluate your application. If we ask to keep your CV on file for future opportunities beyond this recruitment process, that additional retention is based on your consent
|
Cookies are small text files stored on your device by your browser. Our website uses three categories:
Some pages also embed YouTube videos in privacy-enhanced mode (youtube-nocookie.com), which does not set cookies unless you choose to play the video.
We use Axeptio, a cookie consent management platform, to display a cookie banner where you can accept, decline, or customise your preferences by category. You can change your choice at any time by reopening the Axeptio preference panel (usually available via a link in the site footer), or through your browser settings. Marketing and analytics cookies are not set until you consent. Exact durations per cookie are listed below.
| Cookie | Set by | Category | Purpose | Duration |
|---|---|---|---|---|
|
hubspotutk |
HubSpot
|
Marketing
|
Recognizes a returning visitor and links activity to a contact record
|
6 months
|
|
__hstc
|
HubSpot
|
Marketing
|
Main visitor cookie – tracks visits, source, and pages viewed
|
6 months
|
|
__hssc |
HubSpot
|
Marketing
|
Tracks sessions to determine if activity should reset
|
30 min
|
|
__hssrc
|
HubSpot
|
Marketing
|
Detects a new browser session
|
End of browser session
|
|
_ga / ga* |
Google Analytics 4
|
Analytics & Stats
|
Distinguishes unique visitors to measure audience and site usage
|
Up to 2 years
|
|
axeptio_cookies |
Axeptio
|
Essential
|
Stores your cookie consent choices
|
6 months
|
|
axeptio_authorized_vendors |
Axeptio
|
Essential
|
Stores which vendors/categories you’ve consented to
|
6 months
|
We work with a small number of service providers who process personal data on our behalf, under confidentiality and data-processing obligations. We do not sell or rent your data to anyone.
| Provider | Purpose | Location |
|---|---|---|
|
HubSpot, Inc. / HubSpot Ireland Ltd.
|
Marketing automation, forms, email delivery
|
Data hosted in Germany (EU); company headquartered in the United States
|
|
Google LLC (Google Analytics 4, via gtag.js)
|
Website analytics – audience measurement and usage statistics
|
Ireland
|
|
Axeptio (Agilitation SAS) |
Cookie consent management (cookie banner)
|
Montpellier, France (EU)
|
|
OVH SAS
|
Session/Website hosting
|
France (EU)
|
HubSpot hosts our data in Germany (EU). As HubSpot is headquartered in the United States, limited data access (for example, customer support) may still involve the US, for which HubSpot maintains an active certification under the EU-U.S. Data Privacy Framework (DPF). Google (Google Analytics 4) is based in Ireland. Where personal data leaves the EU/EEA through any of our providers, we rely on recognized safeguards – such as Standard Contractual Clauses and/or DPF certification. You can request details of the specific safeguard used for any transfer by contacting our DPO.
GDPR requires that every processing activity rest on one specific legal basis. Here’s how each activity above maps to one:
| Activity | Data involved | Legal basis |
|---|---|---|
|
Prospecting emails |
First and last name, job title, email, company, city, country
|
Legitimate interest in promoting our products to professional contacts (Art. L.34-5 French Post & Electronic Communications Code, soft opt-in), with opt-out always available – this covers contacts met at a congress/event or sourced from public professional sources (see Section 2). Where you’ve given consent via a web form, we rely on that consent instead..
|
|
Newsletter sign-up, Content downloads & webinar replay
|
First and last name, job title, email, company
|
Consent
|
|
Analytics & marketing cookies
|
Usage data, device/browser identifiers
|
Consent
|
|
Strictly necessary cookies
|
Session/functional data
|
Legitimate interest (no consent required)
|
|
Job applications
|
CV, cover letter, contact details
|
Pre-contractual steps (Art. 6(1)(b) GDPR), to evaluate your application. If we ask to keep your CV on file for future opportunities beyond this recruitment process, that additional retention is based on your consent
|
We apply appropriate technical and organisational measures to protect personal data against unauthorised access, alteration, disclosure, or loss – including access controls, encryption in transit, logging, and supplier security requirements. Our key service providers maintain independently validated security programmes (e.g. ISO 27001). Further detail is available on request to our DPO.
GDPR rights
As a data subject under French Law No. 78-17 of 6 January 1978 (as amended in 2018) and EU Regulation 2016/679 (GDPR), you have the following rights with respect to your personal data:
Request a copy of the personal data we hold about you.
Request correction of inaccurate or incomplete data.
Request deletion of your personal data in certain circumstances.
Object to the processing of your data for marketing purposes, including email open-tracking.
Receive your data in a structured, machine-readable format.
Request that we limit how we use your data in certain situations.
If you believe your data protection rights have not been respected, you have the right to lodge a complaint with the CNIL (Commission Nationale de l’Informatique et des Libertés), the French data protection authority.
Your point of contact
For GDPR or HIPAA enquiries, data subject access requests, or regulatory due diligence, our DPO is your dedicated contact.
We acknowledge requests promptly and respond within one month.
Postal address: Bâtiment B Zone Industrielle Athelia 4, 375 Avenue du Mistral, 13600 La Ciotat
Stéphane Berger
Last updated: 28 juillet 2026
Controller: Avicenna.AI, Bâtiment B Zone Industrielle Athelia 4, 375 Avenue du Mistral, 13600 La Ciotat
Supervisory authority: CNIL (France
