PRIVACY POLICY

PRIVACY POLICY ScienceOne undertakes to process Personal Data in accordance with the regulations in force and with Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 (GDPR).

ScienceOne edits a social networking platform for healthcare professionals, academic organizations, and industries (hereinafter “ScienceLeadR”). The ScienceLeadR platform, as a professional community exclusively intended for professionals acting for the needs of their activity, facilitates collaborations between researchers and the entire medical community at French, European and international levels.

ScienceLeadR is a service based on the identification of leading medical experts. ScienceOne has created a Profile for each of the experts listed on ScienceLeadR from publicly available and freely accessible Data. The Data come from Pubmed (scientific publications), ClinicalTrials (clinical studies), ORCID (professional information) and OpenPaymentsData (financial relationships). The Data is cross-referenced to produce a profile for each expert that links and summarize the information concerning them in these databases.

The Persons concerned by the Profiles are informed of the existence of the Processing thus implemented.

1. PURPOSE AND SCOPE OF APPLICATION

The purpose of this Privacy Policy is to:

• to define the conditions under which ScienceOne via its ScienceLeadR service undertakes to carry out the Personal Data Processing operations defined below;

• to inform Users about the methods of collection and Processing of their Personal Data and how to define and guarantee the roles and responsibilities of each of the actors involved in their Processing.

The terms Processor, Data Subject, Personal Data, Personal Data Breach, and Processing shall have the same meanings as defined in the GDPR.

Registered users who have subscribed to ScienceLeadR’s paid service or partner offer have access to all of ScienceLeadR’s Profiles and services (“Member”). Members can share their professional identity, communicate with their network, exchange professional information and views, publish and view content. Registered users who have not subscribed to the paid service have restricted access to the Data (“Non-Members”). All Users of ScienceLeadR, Member and Non-Member, will be referred to as “Users” below.

This Privacy Policy applies to all Users, whenever a person uses ScienceLeadR or is listed on ScienceLeadR.

The Privacy Policy is an integral part of the contractual relationship with Users. By logging on to ScienceLeadR, every User agrees to this Policy in its entirety and use of ScienceLeadR is subject to compliance with it.

2. USE OF THE DATA COLLECTED

User Data is collected for a specific and well-defined purpose(s). The purposes are in accordance with applicable laws and regulations. ScienceLeadR does not use personal information for purposes incompatible with those for which it was collected, unless subsequently approved by the User. If ScienceOne were to use a data subject’s or User’s information in any other way, ScienceOne will inform the person at the time of Processing.

The Processing that ScienceLeadR implements is, in particular, necessary:

• To provide its services;
• To perform a contract or pre-contractual measures;
• To improve its services and the User experience;
• To manage the relationship with Users;
• To fulfil its obligations towards Users;
• To fulfil its legitimate interests or to manage the monitoring, control, and development of its activities;
• To comply with its legal obligations.

The Purposes are:

• To create and manage the Profiles listed in ScienceLeadR;
• To ensure navigation on ScienceLeadR, and to improve the User experience;
• To manage complaints, requests for information, questions ;
• Receive notifications;
• Receive email information;
• Participate in surveys;
• Relay information and Data freely available to Users;
• Follow the career paths of physicians;
• Invite other physicians to join ScienceLeadR;
• Create/participate in discussion groups;
• Communicate with other Users;
• Interact with other Users (comments, opinions…);
• Improve the experience on ScienceLeadR;
• Ensure account security (number of visits, account verification…);
• Allow Members to receive targeted communications from ScienceOne partners on topics related to their expertise.

It is specified that the consent of the Member for the transmission of the information that he has provided to ScienceOne on subjects related to his expertise, must be obtained when registering for the services offered.

3. DATA COLLECTION

3.1. PUBLIC DATA

ScienceLeadR is a service based on the identification of leading medical experts. ScienceOne has created a Profile for each of the experts listed on ScienceLeadR from publicly available and freely accessible Data. The Persons concerned by the Profiles are informed of the existence of the Processing thus implemented. Public Data comes from the following websites:

• Pubmed: PubMed (nih.gov)
• Clinical Trials: Clinicaltrials.gov
• Orcid: ORCID
• Transparence: Transparence-santé - data.gouv.fr
• Open Payments Data: Home | Open Payments Data - CMS

3.2. ADDITIONAL DATA

Additional Data is created and collected by ScienceOne. Using an algorithm for managing author homonyms, ScienceOne maintain a daily list of Pubmed articles and ClinicalTrials studies linked to each expert. From this list, ScienceOne derives the following Data:

• Name, first name, initials.
• Number of years of practice.
• History of organizations, with in particular: Name of organizations, Start/end year, City, coun- try, location of the organization, Exercise department if available, Last organization/coun- try/city of practice
• List of professional emails entered.
• List of professional emails associated with active organizations.
• List of publication journals.
• List of clinical studies reported in publications.
• List of associated clinical studies based on name and current organizations or professional emails.
• Statistics linked to the list of clinical studies: List of roles within studies, List of study statuses, List of study phases, List of study sponsors, List of drugs and diseases studied, SLR level metric, based on the age of studies, their status, types and phases, the number of patients, sites and countries, as well as the role of the expert.
• Statistics linked to the list of publications: List of associated journals and Impact Factor, List of publication types, Years of publications, Position of the expert in the list of authors, Number of citations, Classic level H-index and i10 metrics, based on number of publications and cita- tions, SLR level metric, based on the number of articles, the number and age of citations, the age of articles, the position of the expert in the list of authors as well as the number of au- thors.
• Financial information from public information required to be provided within the framework of local or international regulations linked to “transparency” in the context of monitoring declara- tions of interest, based on the name and current organizations, and associated statistics: Identification number in the bases in question (Transparency, Open Payments), Total amount collected, Details of amounts received and donor organizations, Expert collaboration network (list of experts with whom he has collaborated on scientific work), List and number of occur- rences of MeSH terms associated with publications and studies.
• Deduction of the expert's main specialty of practice.

3.3. DATA PROVIDED BY USERS

ScienceLeadR also collects Data from Users when they use ScienceLeadR. Users can add to their Profile.

In addition, to create an account, Users must provide their name, email address and/or phone number, and a password. If they subscribe to the paid service, Members will have to provide payment information (e.g., credit card) and Billing Data.

3.4. LIMITATION OF COLLECTED DATA

The purpose of the Processing determines the relevance of the Data that ScienceLeadR collects. Only Data that is adequate, relevant, and strictly necessary to achieve the purpose will be collected and processed. In addition, ScienceOne ensures that the Data is updated throughout the Processing to maintain its validity.

In the context of the Processing of Personal Data, the purposes, and legal bases of which have been previously specified, ScienceLeadR may collect and process the following categories of Data in particular:

• Personal information: Last name, First name, email, professional photo.
• Information relating to professional life: institution, employer(s) (current and past), diplomas, awards, prizes, decorations, honors, professional or patient association mem- berships, congress participation, role in professional journals, field of research, pas sions, articles written (title and abstract), clinical studies in which the expert has partici- pated, localization of employers, drugs for which the expert has conducted studies, people with whom the expert has collaborated (co-authors of articles, co-investigators of clinical studies, co-workers -from the same institution, the same specialty);
• Billing and payment data.

4. EXERCISE OF RIGHTS

ScienceOne is particularly concerned about respecting the rights granted to Users to ensure transparent, relevant Processing.

Whether it concerns the freely accessible Data collected by ScienceLeadR or all the Data provided by the Users, the person concerned (listed expert) by the Processing may request the rectification, correction, updating of his/her Data if they are inaccurate, incomplete, equivocal, outdated or the withdrawal of his/her Data and oppose their Processing by contacting ScienceOne at corporate@scienceone.eu. In addition, the data subject has the right to request a copy of his/her Data and information.

The Data collected by ScienceOne from external sources will be a true copy of the Data from that source. ScienceOne cannot technically modify the Data from the source. Nor can it be modified via ScienceLeadR. Any request for modification must be made to the source. ScienceOne can only remove access to the source.

Right to erasure of Data. The User may request the deletion of his/her Personal Data. This can only be done for one of the reasons provided for in the applicable regulations. If none of the reasons justifies the request, ScienceOne will not be able to respond favorably. This will be the case if ScienceOne is required to retain the Data due to a legal or regulatory obligation or for the establishment, exercise, or defense of legal claims.

Right to limit Data Processing. The user may request the limitation of the Processing of his/her personal Data in the cases provided for by the legislation and regulations.

Right to object to Data Processing. The user has the right to object at any time, for reasons related to his/her situation, to a Processing whose legal basis is the legitimate interest pursued by the Data Controller. In the event of exercising such a right to object, ScienceOne will ensure that the Personal Data is no longer processed in the context of the Processing concerned unless ScienceOne can demonstrate compelling legitimate grounds for continuing such processing. These grounds shall outweigh the interests and rights and freedoms of the User or the Data Subject. The Processing may be justified for the establishment, exercise, or defense of legal claims.

Right to withdraw consent. When the Data Processing that ScienceOne implements is based on consent, the user may withdraw it at any time. ScienceOne then ceases to process the User’s or Data Subject’s Personal Data without affecting the previous operations for which they had consented.

These rights may be exercised with ScienceOne by email at corporate@scienceone.eu or by mail at ScienceOne – 128, rue la Boétie – 75 008 PARIS – FRANCE accompanied by a photocopy of any signed identity document and, if necessary, a mandate.

The User may lodge a complaint with the CNIL, without prejudice to any other administrative or judicial remedy, by post: CNIL – Service des plaintes: 3, place de Fontenoy – TSA 80715 – 75334 Paris Cedex 07 or online.

It is recalled that if the requests of a data subject are manifestly unfounded or excessive, in particular because of their repetitive nature, ScienceOne may either require the payment of reasonable fees that take into account the administrative costs incurred to provide the information, make the communications, or take the measures requested, or refuse to comply with these requests.

For any other more general information on the protection of Personal Data, the person concerned may consult the CNIL website (www.cnil.fr).

5. SHARING INFORMATION

ScienceLeadR allows for the posting and sharing of information, including through posts, subscriptions, likes and comments.

All Profile Data as well as any Data that the User posts or interacts with or takes actions on ScienceLeadR (such as likes, subscriptions, comments, and shares…) are visible to other Users and to ScienceLeadR.

6. DATA RETENTION

6.1. RETENTION OF DATA PROFILE

A Profile is created by ScienceLeadR from freely available information. The Profile is visible to the Users of ScienceLeadR, and the Data in the Profile is retained as long as the person concerned by the Profile does not object to the Processing. The person who wishes to exercise his or her rights may ask ScienceOne to withdraw, modify or delete his or her Data under the conditions described in Article 4. In the case of a request for deletion, the Profile will be deleted as soon as possible.

6.2. ACCOUNT RETENTION

When a User creates an Account on ScienceLeadR, the Data necessary for the management of the Account will be kept for as long as the User maintains the Account to provide the services. The Account remains active until a request to close the Account is made for non-Members or for the duration of the Contract plus two (2) years for Members. Thereafter, after this period or in the event of a request to delete the Account, the Account Data will be deleted.

7. SECURITY MEASURES

Appropriate technical and organizational measures are implemented to ensure that the Data is processed in such a way as to guarantee its protection against accidental loss, destruction or damage that could impair its confidentiality or integrity.

ScienceOne determines and implements the means necessary to protect Personal Data Processing from intrusion and thus prevent any loss of confidentiality, unwanted modification, or destruction of Data.

8. PROCESSOR

The Data are hosted on the servers of the company OVH located in France.

Users authorize ScienceOne to process the Data through subcontractors. ScienceOne will provide the list upon written request from the Users.

Where ScienceOne uses a service provider (such as OVH), ScienceOne will only process Personal Data after obtaining a commitment and guarantees from the service provider regarding its ability to meet the security and confidentiality requirements described in Article 7. ScienceOne concludes contracts with its Processors, in compliance with legal and regulatory obligations, which precisely define the conditions and modalities of Processing of Personal Data by the latter. If the Processor does not fulfil these obligations, ScienceOne remains fully responsible to the data subjects and Users for the performance of the data protection obligations.

9. DATA BREACH

In the event of a breach of Personal Data, ScienceOne undertakes to notify the French Commission Nationale de l’Informatique et des Libertés (CNIL) in accordance with the requirements of the GDPR.

If the said breach poses a high risk to the Users and persons concerned and the Data has not been protected, ScienceOne will notify the Users and persons concerned, and ScienceOne will provide them with the necessary information and recommendations by email.

This email shall include at least the following information a summary, the circumstances and nature of the incident, the content and quantity of the Personal Data involved (records), the categories and number of individuals affected, the likely consequences, the measures taken or proposed to remedy the Personal Data breach (including, if applicable, measures to mitigate any negative consequences), the date and time of the incident and of the detection of the incident, and the name and contact details of the Data Protection Officer or a point of contact from whom further information may be obtained.

15 – 03 - 2024