Privacy Policy
26/02/2026 version
The ASKARA company may be required to process data identifying natural persons when accessing and/or using the ASKARA Software Package by any person. This may be the data of any ASKARA customer who has subscribed to the ASKARA Software Package, including any free subscription or free trial request, (hereinafter referred to as the “” Customer ”) or of all patients of these Customers (hereinafter referred to as the” Patient ”).
The company ASKARA (143 Boulevard Haussmann, 75008 Paris, SAS with a share capital of 20,000€, registered with the RCS of PARIS under the number 931 957 831, Telephone: 06.66.07.68.93, Email: contact@askara.ai) is committed as data controller (hereinafter referred to as the” ASKARA Company ” or the” Responsible for the treatment ”) to comply with the legal provisions applicable to the protection of personal data, in particular those resulting from the General Data Protection Regulation (EU) No. 2016/679 and Law No. 78-17 of January 6, 1978, known as the “Data Protection Act”.
1) What are the purpose (s) of the treatments carried out by ASKARA Company, the categories of data processed and the retention periods of these data?
| Purposes | Legal basis | Data category | Retention Period |
|---|---|---|---|
| Create a user account by the Customer to allow him to access and use the Software in a secure manner (including user authentication) | Contract | Civil status, identity, identification data | Data is kept until the account is deleted |
| Allow the Customer to have a history of the services used, in particular the services provided (Patient database, contact database, document database) | Consent* | Patient Data, Contacts, and Generated Documents | The data is kept until the data is withdrawn by the Customer. The documents are deleted within 7 days from their generation |
| Pre-fill the documents with the Customer's professional contact details to allow their automatic integration into all documents generated during the use of the Software | Consent* | Civil status, identity, identification data, professional data (RPPS number and AM number) | Data is kept until the account is deleted |
| Transcribe audio recordings into written documents | Contract | Voice, Patient Health Data (Data relating to the health status, interventions and treatments of the User's patients) | The data is kept for the processing time necessary for the transcription and until validation of the document by the Customer and for a maximum of 7 days from the time of the voice dictation and the documents. |
| Identify Patients and link documents to the patients concerned (history) | Contract | First name, Last name, Gender, Date of birth | The data is kept until the account, the Patient file or the last document concerning the Patient is deleted. |
| Identify the recipient of the documents and send the documents to the identified recipients | Contract | First name, Last name, Email address | The data is kept until the account, contact form or last document concerning the Patient is deleted. |
| Take out a paid subscription | Contract | Identification data, Information and codes written on the bank card used (including the name of the cardholder), Billing address (if it is an address of a natural person) | The data relating to the information and codes entered on the bank card are deleted immediately after the first payment. For other data: the data is kept until the last payment due according to the subscription chosen is made (except for data kept for the purpose allowing ASKARA to keep its accounts) |
| Allow ASKARA to track payments and maintain or open access and use of the Software | Contract | Identification data, payment package/formula, effectiveness of payment and amount paid | Data is kept in intermediate archiving (maximum 5 years) for evidentiary purposes. |
| Allow ASKARA to draw up invoices and keep its accounts | Legal | Identification data, Subscription taken out, Amount paid | Data is kept in intermediate archiving for up to 10 years (tax requirement) |
| Ensure the maintenance of the Software | Contract | Identification data, Login data, Internet | Data is kept in intermediate archiving (maximum 5 years) for evidentiary purposes. |
| Ensuring the security of the Software | Legitimate interest of ASKARA to ensure the security of the Software | Identification data, Login data (including computer system data), Internet | The data is kept in intermediate archiving for a maximum of 5 years for evidentiary purposes, except for journaling data, which is deleted after 6 months. |
| Ensuring compliance with RGPD rights | Legal | Identification data, type of request and response provided | Data is kept in intermediate archiving (maximum 5 years) for evidentiary purposes. |
* The Customer and/or the Patient are informed of their right to withdraw their consent at any time for any purpose based on their consent. The withdrawal of consent does not compromise the legality of the processing based on the consent carried out before this withdrawal.
**The storage periods indicated above are without prejudice to longer retention in order to exercise ASKARA's rights in the event of a dispute.
2) What is the source of the data?
The Customer and/or Patient data that may be subject to personal data processing is only data directly entered by the Customer when accessing and/or using the Software (direct collection) as well as data collected indirectly (indirect collection) and/or generated during access and/or use of the Software Package, the categories of which are specified above.
3) Do data have to be provided?
Only a field marked with an asterisk requires a mandatory response to allow ASKARA Company to process the request submitted to it. The other fields are optional and do not prevent the use of the Software.
4) Who are the recipients of the data?
The personal data processed are communicated only to the persons authorized to receive them, namely:
- The Customer who, as a user of the Software, is the recipient of any data generated during the use of the Software.
- Recipients of document correspondence (Patients and/or contacts): the latter will only have access to the only documents that the Customer has voluntarily chosen to send to them.
- ASKARA's data subcontractors, in particular the providers of the Software's data (the data host is certified as a health data host) and the service provider (s) in charge of subscription payments.
IMPORTANT INFORMATION: The Customer is aware that ASKARA Company may be required to process Patient data in connection with the access and use of its Software, in particular when creating and generating documents based on the information provided by the Customer. The Customer acknowledges and accepts that ASKARA Company may process this data in order to provide its services to the Customer. The Client must ensure that it has the explicit consent of the Patients to this treatment and undertakes to inform Patients about the content of these treatments by providing, for example, the link to access this information note.
5) Can data be transferred outside the EU?
No transfer of personal data is carried out outside the EU by ASKARA Company. If, for the purposes of using the Software, such a transfer should however be made, the Customer's agreement will be requested beforehand by ASKARA Company. In this case, the transfer will be governed by a data transfer agreement in compliance with the applicable legal provisions on the protection of personal data.
6) What are the rights of Customers?
In accordance with the provisions of the Data Protection Act and Regulation (EU) 2016/679, any person concerned by the processing of their data, in particular any Customer or Patient has, subject to legal conditions, a right to information, access, rectify and delete their personal data, to oppose the processing of personal data, to oppose the processing of personal data, to request the limitation of the processing or the portability of their personal data as well as the right to Define guidelines concerning the fate of his data after he died.
7) How to exercise your rights?
Any person concerned by the processing of their personal data can exercise their rights directly with the ASKARA Company by letter sent to the address 143 Boulevard Haussmann 75008 Paris or by email to the address: contact@askara.ai.
If the person concerned should not be satisfied with the response provided following the exercise of one of his rights, he may send a complaint to the CNIL by postal mail sent to CNIL, Complaints Department 3 Place de Fontenoy - TSA 80715 - 75715 - 75334 PARIS CEDEX 07, Tel: 01 53 73 22 22 22 or on its dedicated form on the web.
9) Security and data protection
ASKARA implements appropriate technical and organizational measures to protect personal data against unauthorized access, loss, destruction, or disclosure. These measures include in particular:
- Encryption of data in transit (TLS/HTTPS protocol) and at rest;
- Access control procedures restricting data access to authorized personnel only;
- An HDS-certified infrastructure (Health Data Hosting certification) ensuring a level of security appropriate for health data;
- ISO 27001 certification attesting to the implementation of an information security management system;
- Regular security audits and assessments to identify and remediate vulnerabilities.
10) Data from Google Services (Gmail Integration)
As part of its integration with Google services, ASKARA may access certain data from the User’s Google account via Google APIs and the OAuth 2.0 protocol, subject to the User’s explicit consent.
Data Accessible via Google: Access is limited to the email-sending permission (gmail.send). ASKARA does not access the content of the User’s mailbox, received emails, or any other Google data beyond what is strictly necessary to enable the functionality of sending documents to patients.
Use of Google Data: Data obtained through the Google integration is used exclusively to send medical documents to patients, at the User’s express request. This data is not used for advertising purposes, profiling, resale, or transferred to third parties.
Revocation of Access: The User may revoke Askara’s access to their Google account at any time via their Google account security settings (myaccount.google.com/permissions) or from their Askara account. Revocation immediately terminates any access to the User’s Google data.