Privacy policy

1. Data controller

Company

MedQara

Legal form

Sole proprietorship registered with the French National Business Register

SIREN

108 783 465

Registered office

7 rue Pierre Laplace, 25000 Besançon, France

Data controller

Fidèle M'PO

Questions about your data

fidele@veillemedqara.fr

2. The data we process

2.1 Your account

• Email address and name: to identify you and write to you.
• Organisation and role (optional): to adapt your monitoring to your job.
• Password: stored hashed (bcrypt), never readable, not even by us.

2.2 Your monitoring

• Your scope: device segments, markets, standards, keywords.
• Your declared devices and your equipment fleet.
• Your clients' scopes, if you use the Consultancy plan.
• Alert follow-up: read alerts, compliance statuses, relevant / not relevant feedback, event reminders.
• Your notification preferences.

2.3 Your content

• Your conversations with the QARA Assistant, which you can delete at any time.
• The generated documents you choose to save.
• A file you attach to the Assistant or to Document IA is read to extract its text, used for the answer, and not kept.

2.4 Payment

Payment is handled by Stripe (PCI-DSS Level 1). We never see or store your card number: we keep only your Stripe customer ID and your subscription status.

2.5 Technical data

• Audience measurement by Cloudflare Web Analytics: no cookies, no individual tracking.
• Server logs (IP address, browser, date), kept 30 days at most, for security.
• Clicks on the links in our emails, to know whether they are useful. No open-tracking pixel.

3. Why, and on what legal basis

• Performance of the contract (Art. 6.1.b GDPR): creating and running your account, producing your monitoring, sending your alerts and digests (which you can switch off at any time in Settings).
• Legitimate interest (Art. 6.1.f): platform security, fraud prevention, service improvement, and prospecting professionals (see section 11).
• Consent (Art. 6.1.a): the newsletter, which you can leave at any time with a simple message.
• Legal obligation (Art. 6.1.c): invoicing and accounting.

4. Who has access to your data

Your data is never sold, rented or transferred. It is visible to you and, if you invite colleagues, to your team: the database enforces separation between accounts and organisations. MedQara accesses it only for support and security.

We rely on the following providers, bound by contract and acting only on our instructions:

• Supabase: database and authentication. Paris, France.
• Render: application hosting. Frankfurt, Germany.
• Resend: sending emails. Ireland.
• Stripe: payments. Ireland.
• Cloudflare: site delivery, protection against attacks and bots, cookieless audience measurement. Global network, closest to the visitor.
• Anthropic and Groq: answers from the QARA Assistant and Document IA. United States.
• OpenAI: turning your question into a search vector to find the relevant texts. United States.

5. Artificial intelligence: what is sent, and what is not

Two features use AI models hosted in the United States: the QARA Assistant and Document IA. They are the only ones that send your content outside the EU, and only when you use them.

What is sent. For the Assistant: your question, the current conversation, the text of any attached document and, to tailor the answer, your role, your scope (segments, markets, standards, keywords) and up to 15 of your declared devices (name, category, class, regulation, status). For Document IA: what you enter and the text of the source document.

What is never sent. Your name, your email address and your billing data.

Safeguards.The API terms of these providers exclude training their models on submitted content. Transfers rely on the European Commission's Standard Contractual Clauses.

If your organisation cannot accept any transfer outside the EU, do not use these two features: monitoring, filters, alerts and exports work without them.

6. Where your data is hosted

Your account, scope, devices, conversations and documents are hosted and kept in the European Union. Apart from the AI features above, only Cloudflare and Stripe may process technical metadata outside the EU, under the same contractual safeguards.

7. How long we keep it

• Account and content: as long as your account exists, then erased within 30 days of its deletion.
• Invoices: 10 years (French accounting obligation).
• Server logs: 30 days at most.
• Prospecting data: 3 years after the last contact (see section 11).

8. Your rights

Under Articles 15 to 22 GDPR, you may at any time:

• access the data we hold about you;
• correct it, directly in Settings or on request;
• erase it, including your entire account;
• retrieve it in an open format (portability);
• object to a processing operation, or ask for it to be restricted.

Write to fidele@veillemedqara.fr. We reply within 30 days at most, free of charge, and may ask you to confirm your identity. If you are not satisfied with our answer, you may lodge a complaint with the CNIL (cnil.fr/fr/plaintes).

9. Security

• HTTPS required on every exchange (TLS, HSTS preloaded).
• Data encrypted at rest (AES-256).
• Two-factor authentication with an authenticator app, in Settings > Security.
• Passwords hashed with bcrypt.
• Separation between accounts and organisations enforced by the database (row-level security).
• Bot protection at sign-up (Cloudflare Turnstile) and security headers (CSP, HSTS, X-Frame-Options).
• In the event of a data breach: notification to the CNIL within 72 hours, and to the people concerned when the risk is high.

More details: Security.

10. Cookies

MedQara uses only the cookies needed for the service to work: your login session and your language. No advertising cookies, no audience-measurement cookies. When you pay, the Stripe payment page sets its own security cookies.

11. Business prospecting

You received a message from MedQara without being a customer. Here is where your details come from, what we do with them, and how to stop any contact.

Why you. We write to medical device professionals (PRRC, quality and regulatory affairs managers) about regulatory monitoring, a subject directly related to their duties.

Where your details come from. Publicly accessible professional sources: mainly the European EUDAMED database, in which manufacturers must declare this information, and, for LinkedIn messages, your public profile.

Data processed. Name, role, company, business email address, devices your company has declared in EUDAMED, and the history of our exchanges (send dates, replies and clicks on our links). Some messages link to a monitoring page prepared for your company from its public EUDAMED data, reachable only through that link and not indexed by search engines.

Legal basis. Legitimate interest (Art. 6.1.f GDPR): informing a professional about a service related to their duties. This information is provided from the first contact, as required by Article 14 GDPR.

Recipients. The MedQara sales team and the providers listed in section 4. Never sold or transferred.

Retention. Three years from the last exchange. If you object, we keep only what is needed to never write to you again.

Stop any contact.Reply « STOP » to any of our messages, or write to fidele@veillemedqara.fr. Your objection is recorded automatically and permanently. You also have all the rights listed in section 8.

12. Changes

We may update this policy. Users are notified by email of any substantial change. The date of the last update is shown at the top of this page.