Privacy policy

1. Data controller

MEDLANE, SAS (simplified joint-stock company) with share capital of €1,150,000, 20 rue Jean Rostand, 69740 Genas, France — SIREN 482 295 524 — represented by its Chairman, Belkheir TOUKAL.

Data protection contact : contact@medlane.com

2. General principle

app.medlane.com is designed according to a data minimization principle. The site does not use any advertising tracker, any third-party analytics tool, and does not build any visitor profile. Audience measurement is carried out internally (first-party), with no measurement cookie and no identifier allowing a visitor to be recognized from one visit to another. An opt-out mechanism is made available to you (see 3.4).

3. Processing activities

3.1 Contact request

• Data: name, company, email, phone (optional), subject, message, IP address (anti-abuse), date.
• Purpose: respond to the request, prevent abuse.
• Legal basis: legitimate interest (B2B business relationship); legitimate interest for the IP address (security).
• Retention: message 3 years after the last contact from the person; IP address 30 days.
• Recipients: MEDLANE sales team; transactional email delivery provider.

3.2 Quote request

Each retention period corresponds to a specific purpose; no single retention period is applied to all requests.

• Data: name, company, email, phone, message, references and quantities, commercial origin (any campaign parameters).
• Contact : devis@medlane.com
• Quote with no follow-up (no order, no subsequent exchange): retained for 1 year from the request, then deleted.
• B2B sales prospect : retained for up to 3 years from collection or from the last relevant contact from the prospect.
• Accepted quote / customer : the data moves into the commercial and contractual file and follows the retention periods applicable to the contractual relationship and to accounting and tax obligations.
• Intermediate archiving : only when retention is necessary to establish proof of a right or to comply with a legal obligation, with restricted access and for the period strictly required.
• Legal basis: pre-contractual measures; legitimate interest for B2B prospecting; legal obligation for archiving.

3.3 User account (member area)

• Data: email, username, role, favorites, sets created, last activity.
• Purpose: access to the member area, saving sets, administration.
• Legal basis: performance of the requested service.
• Retention: duration of the account; deletion on request; accounts inactive for 3 years → deletion after notice.

3.4 Audience measurement and usage statistics

• Data: event type, date and time, product reference, family, subcategory, country (inferred from the network, without retaining the IP address), source category (search engine, referrer, direct, email, campaign), campaign parameters, language, device category (mobile, tablet, computer), cleaned search query.
• MEDLANE's measurement system is not designed to collect directly identifying data and applies minimization and filtering mechanisms intended to prevent such data from being recorded: no IP address, no user-agent, no visitor identifier and no browser fingerprint is recorded; search queries are truncated and emails, phone numbers and clearly personal strings are removed before recording.
• Legal basis: legitimate interest (improving the catalog and the service). This processing remains subject to the GDPR.
• Right to object : you can disable audience measurement at any time using the “MEDLANE audience measurement: On / Off” setting available in the footer of every page and reproduced below. When measurement is disabled, no event is sent to our servers. Your choice is stored locally in your browser, without an account or cookie, and can be changed at any time. Clearing the site data resets this choice.
• Retention: detailed events 14 months, then anonymous aggregates retained for 36 months.

3.5 AI Assistant

• The Assistant relies on the Google Gemini inference service, called from our servers via an inference gateway.
• Data transmitted to the AI service: the content of your message, the display language and the MEDLANE catalog context (references, designations, set compositions) needed to generate the response. MEDLANE does not intentionally add your account identity, your IP address or other directly identifying data to the prompt.
• Data you enter yourself : if you write a name, an institution, an email, health data or any other personal information in your message, that information is necessarily transmitted to the provider to generate the response. Therefore, do not enter any unnecessary personal or health data into the Assistant.
• Conversation history : MEDLANE does not retain the history of exchanges with the Assistant in its own databases. The model provider and the gateway operator may apply their own technical retention periods in accordance with the applicable contractual terms.
• Only non-textual indicators are measured on the MEDLANE side: opening, set generated, number of instruments, export, conversion into a quote. The content of the exchanges is not copied into the statistics.
• Place of processing: inference is operated by the model provider on its infrastructure, which may be located outside the European Economic Area.

3.6 Transactional emails

• Data: recipient, delivery status, timestamp, error reason.
• Purpose: proof and monitoring of deliverability.
• Retention: 12 months.

4. Service providers and transfers

Main service providers involved in the processing described above:

When certain providers process data outside the European Economic Area, MEDLANE ensures that these transfers rely on a mechanism provided for by the GDPR. Further information regarding the applicable safeguards may be obtained from MEDLANE at contact@medlane.com.

5. Your rights

Depending on the processing concerned and under the conditions set out in the GDPR, you may have a right of access, rectification, erasure, restriction, objection, and, where the conditions are met, a right to the portability of your data.

To exercise your rights : contact@medlane.com.

You can also object directly to MEDLANE's audience measurement using the setting available in the footer.

You also have the right to lodge a complaint with the CNIL (French data protection authority) — www.cnil.fr.

6. Security

MEDLANE implements appropriate technical and organizational measures: encryption of exchanges with the site, segregation of data access according to per-user authorization rules, named and restricted administrator access, and regular backups of the database.

7. Minors

The site is intended exclusively for professionals; no data relating to minors is knowingly collected.