Privacy policy

Data controller

Medicasure SRL, a company incorporated under Belgian law, publisher of Medicasure Connect. Full details are set out in the legal notice. For any question about your data: dpo@medicasure.com.

Medicasure SRL has appointed a Data Protection Officer, reachable at dpo@medicasure.com. They are the single point of contact for Medicasure Connect as well as the company other services.

What we collect

Several services on the site collect personal data: an institution’s application, the professional account and Passport, expressions of interest, service and help requests, participation certificates, collaborations and the email alert. Each is described below: what is collected, why, who can access it and for how long.

Institution application

The application form addresses organisations, but necessarily identifies a natural person as the point of contact.

  • Contact data: name, role, email address, phone number and correspondence languages of the referring person.
  • Organisation data: legal name, display name, type, country, city, sector, website and description.
  • Uploaded documents: proof of legal existence and logo, stored in a private storage space. They are never publicly accessible and can only be viewed by authorised Medicasure staff, through a temporary signed link.
  • Legal basis: performance of pre-contractual measures taken at your request, with a view to a possible introduction within the ecosystem.
  • Retention periods: an unsuccessful application is kept for three years after the last contact; an active partner, for the duration of the relationship and then five years under Belgian accounting obligations. Uploaded documents follow the same period as the application they belong to.

Publishing your organisation

Approving your file and publishing it are two distinct things. Nothing appears on the public part of the site without explicit consent, given separately and never pre-ticked. That consent can be withdrawn at any time, without calling your approval into question.

Professional account and Passport

If you create a professional account, you build your Passport: your career record, which you complete at your own pace.

  • Data: identity, languages, career, degrees and qualifications, professional registrations, areas of expertise, publications, and the supporting documents you choose to upload.
  • Verification: an item is only verified if you submit it. Authorised Medicasure staff then review the documents relating to it, and the decision is notified to you by email.
  • Visibility: your civil status never appears on a public page. You choose, section by section, what is public, shared with institutions only, or private. Nothing is published without that choice.
  • Reminders: as long as your Passport is not activated, we may send you two email reminders. Each one contains a link to stop receiving them.
  • Legal basis: performance of the service you request by creating your account.
  • Retention period: your Passport is kept for as long as your account exists. It is not deleted automatically; you can ask for its erasure at any time (see “Your rights”).

Importing a CV

  • If you import a CV into your Passport, the file (PDF or Word) is stored in a private storage space, and its text is extracted.
  • The analysis runs on our own servers. No external artificial intelligence service receives your CV.
  • The CV fills in nothing by itself: it suggests items, and you accept or reject each one. No decision is made automatically from its content.
  • Duration: the file is kept until you delete it from your area.

Completing your profile with OpenAlex

  • If you run the “Complete my profile” search, only your usual name is sent to OpenAlex, a public database of scholarly works. Nothing is sent without that action.
  • You choose the profile that matches you. That choice is kept, and counts as agreement for later searches; you can remove the link at any time.
  • OpenAlex is run by OurResearch, a non-profit organisation based in the United States: your usual name therefore leaves the European Union.

Expressing interest in an opportunity

  • Data: first name, last name, email address, profession, speciality, country and, if you wish, a message.
  • Recipients: the institution offering the opportunity, and authorised Medicasure staff. The institution may shortlist you, select you or decline your interest; its decision is sent to you by email.
  • Legal basis: pre-contractual measures taken at your request.
  • Retention period: being set. Until then, nothing is deleted automatically, and you can ask for erasure at any time (see “Your rights”).

Service requests and help requests

  • Service request: organisation name, contact person, role, email address, country, project type, description of the need, deadline if any, and the originating opportunity. No patient data is requested.
  • Help request or complaint: email address, optional name, subject of the request and message.
  • Recipients: authorised Medicasure staff, who handle the request. An acknowledgement is emailed to you. The handling history is kept, so that the reply given can be proven.
  • Legal basis: pre-contractual measures taken at your request for a service; our legitimate interest in answering help requests.
  • Retention period: being set. Until then, nothing is deleted automatically, and you can ask for erasure at any time (see “Your rights”).

Participation certificates

  • When you take part in an opportunity, its organiser may issue you a certificate. They use your name, your email address and the opportunity reference. If the organiser has added you to the list of participants, you receive an email invitation to create your account so that you can receive your certificate.
  • Verification: each certificate carries a reference and a QR code that open a verification page showing your name. That page is not indexed by search engines: only the people you show the document to can reach it.
  • Duration: a valid certificate is kept with your account. The file of a revoked certificate is deleted thirty days after revocation.
  • Legal basis: the organiser’s legitimate interest in certifying participation.

Collaborations

When an institution and professionals work together on the platform, the participants, their roles, the documents and the exchanges are only visible to members of the collaboration and to authorised Medicasure staff. Their history is kept: it is not deleted when the collaboration ends.

Signing in to your area

Whether you have a partner area or a professional area, you sign in with a single-use link or a time-limited code sent by email, or with a password if you have set one. These tokens serve authentication only and expire on their own. No profiling is carried out from your sign-ins.

Sub-processors

Your data is neither sold nor passed to third parties for commercial purposes. It is processed by the technical providers strictly required to run the service:

  • OVH SAS (France): hosting of the site, the database and uploaded files, within the European Union. The database runs on the Supabase software, which we host ourselves at OVH: the Supabase company receives no data.
  • Resend: delivery of emails (acknowledgements, sign-in links, notifications). Resend is a company based in the United States; emails are sent from infrastructure located in the European Union.
  • Plausible Insights OÜ (Estonia, European Union): audience measurement, only once you agree (see “Audience measurement”).
  • OpenAlex, run by OurResearch (United States): receives your usual name, only if you run the search for your publications yourself.

Your rights

You have the right to access, rectify, erase, object to, restrict and port your data. Some of it can be edited directly from your area. For any other request, write to dpo@medicasure.com; we reply within one month. You may also lodge a complaint with the Belgian Data Protection Authority.

Audience measurement

This site uses Plausible Analytics, a cookie-free audience measurement tool. Since 15 August 2026 it is only loaded once you agree: until you consent, no request is sent to Plausible and no measurement takes place.

Cookies

No tracking cookie is set on this site. Only a technical session cookie is used when you sign in to your area, partner or professional; it disappears when you sign out and serves no audience measurement purpose.

Consent to trackers

On your first visit, a banner asks whether you accept audience measurement. No optional purpose is pre-ticked, and refusing takes exactly the same single click as accepting. Here is what your choice entails:

  • Real blocking: until you agree (and if you refuse), the scripts concerned are not loaded at all. It is not merely the banner that goes away.
  • What is kept: your choice is stored in your browser’s local storage, as four pieces of information. Your decision for each purpose, the date of that choice, the version of this policy in force that day, and a random identifier specific to your browser.
  • That local record serves no other purpose: it cannot recognise you from one page to the next, and contains neither your name, nor your email address, nor your IP address.
  • Proof of consent: so that we can demonstrate your choice was properly obtained, as the regulation requires of us, we keep a record of that choice alone on our side, namely the purposes accepted or refused, the date, the version of this policy and your browser’s random identifier. That record contains neither your name, nor your email address, nor your IP address, and is readable by no one outside our authorised team. It is kept for three years, then deleted.
  • Duration: your choice is valid for six months. After that, or if the purposes change, you will be asked again. You can also erase this record at any time by clearing your browser’s site data.
  • Withdrawal: the “Cookie preferences” link at the bottom of every page reopens the banner and lets you reverse your decision as easily as you made it.
  • Legal basis: your consent, for audience measurement. Cookies strictly necessary for the site to work are exempt and are therefore not submitted to you.

The “new opportunities” alert

If you turn on the email alert from the Opportunities page, here is what that entails:

  • Data collected: your email address, and nothing else. No name, no speciality, no countries of interest. We will only ask for those the day the alert can use them to send you fewer messages, not more.
  • Legal basis: your consent. It is only established when you click the confirmation link we send you; until then, your address receives nothing but that one email. You may withdraw this consent at any time.
  • Duration: your address is kept for as long as the alert is of interest to you. A subscription that is never confirmed is deleted after six months.
  • Unsubscribing: a link appears in every email and takes one click, with no account and no justification needed.
  • This address is used for this alert only. It is neither sold, nor passed to a third party, nor used to contact you about anything else.

“Connect Insights” newsletter

If you subscribe to Connect Insights from the home page, the contact page or the preferences of your account, here is what it involves:

  • Data collected: your email address, the type of reader you declare (healthcare professional, institution or other) and the language you choose. No name, no profession, no Passport.
  • Legal basis: your consent, given through an unticked box and only obtained when you select the confirmation link, valid for seven days. We keep proof of this consent: the text shown, its version and its date.
  • Sending: the newsletter is sent by Resend, which receives your address, language and reader type once your subscription is confirmed. Resend is a company based in the United States: this transfer relies on its certification under the EU-US Data Privacy Framework and on the European Commission’s standard contractual clauses.
  • Audience measurement: each issue contains an invisible image and tracked links, which tell us whether it was opened, which links were clicked, and when. For a click, we also keep the type of device (phone, tablet or computer), never your IP address or your browser. This information is only used for statistics per issue, with no individual profile; it is kept for thirteen months, after which only the issue totals are kept. To avoid being counted, simply do not display the images in the message.
  • Retention: your address is kept as long as you remain subscribed. A subscription that is never confirmed is erased about one month after the link expires. After you unsubscribe, we keep a record of your objection so that we never write to you again without new consent.
  • Unsubscribing: a link at the bottom of every issue is enough, in one click, without an account. If you have an account, you can also unsubscribe from its preferences. This address is only used for the newsletter: it is not reused for opportunity alerts, nor the other way round.