Relyens Commitment Charter on the protection of personal data

Preamble

Purpose of the Charter

This Charter embodies the commitments made by the companies of the Relyens group to ensure the security and confidentiality of personal data processed in the course of their activities.

As a company with a mission, Relyens’ ambition is to build, alongside healthcare players and territories, a world of trust that is based in particular on the protection of data, whether it is that of a prospect, a customer, a partner, a patient or any other beneficiary of Relyens guarantees or services.

Regulations on the protection of personal data

In the course of their activities, the companies of the Relyens Group process personal data either as data controllers, as joint data controllers or as processors (within the meaning of Article 28 of the GDPR).
The Data Protection Officers (DPOs) appointed within the Relyens Group can be contacted through the channels indicated in the section “Exercising your rights at Relyens”.

The collection and processing of personal data carried out by the Relyens Group is in strict compliance with the regulations, and in particular with the European General Data Protection Regulation No. 2016/679 of 27 April 2016 (known as the “GDPR”) and specific national texts:

Presentation of the Relyens Group

Relyens, a European mutual risk management group, specialising in healthcare players and territories, is organised as follows (Click here to consult the organisation of the Relyens group in graphic version):

Glossary

Personal data

This is any information relating to an identified or identifiable natural person. An identifiable natural person is one who can be identified, directly or indirectly, by cross-referencing a number of pieces of information, in particular by reference to an identifier such as a name, an identification number, location data, an online identifier or to one or more factors specific to the physical, physiological or genetic identity of that natural person, psychological, economic, cultural or social.

“Sensitive» personal data

special categories of personal data are those that reveal racial or ethnic origin, political opinions, religious or philosophical beliefs or trade union membership, but also genetic data, biometric data for the purpose of uniquely identifying a natural person, data concerning health and data concerning sex life or the sexual orientation of a natural person (Article 9 of the GDPR).
In France, the following are also assimilated to this category:

• the N.I.R (Social Security Number) and the I. N.S (National Health Identifier)
• data relating to criminal convictions or offences (Article 10 of the GDPR)
• data containing assessments of people’s social difficulties.

Processing

Processing means any operation or set of operations which is performed on personal data, whether or not by automated means, such as collection, recording, storage, alteration, retrieval, consultation, transmission, dissemination or otherwise making available, alignment or combination, restriction, erasure or destruction.

Pseudonymization and anonymization

Pseudonymization is a technique that consists of replacing personal data with a pseudonym. For example, in a dataset, a person’s first and last name is replaced by an identifier: ‘Norbert Durand’ becomes ‘Client2983-AN’. To re-identify ‘Norbert Durand’ a posteriori, it is necessary to have a file containing the correspondence between his surname and first name and the associated identifier (pseudonym).

A dataset is considered anonymized if it is impossible to re-identify individuals by any means. Anonymization is irreversible, while pseudonymization is reversible, i.e. there is a possibility of re-identifying people by cross-referencing information or files.

In short, anonymization provides a higher level of protection than pseudonymization.

Data controller

this is the legal person, public authority, agency or other body which, alone or jointly with others, determines the purposes and means of the processing of personal data.

Processor

A processor is the legal person, public authority, agency or body that processes personal data on behalf of the controller.

Data subject

This is the identified or identifiable natural person to whom the personal data relates (e.g. healthcare professional who is a client of Relyens, beneficiary of Relyens guarantees, agent of the Relyens customer, etc.).

Data Protection Officer

Better known by its Anglo-Saxon acronym “DPO” (for Data Protection Officer), this is the person within Relyens responsible for ensuring compliance with the regulations on the protection of personal data. This is the person to contact for any question relating to the processing of personal data carried out by the Relyens Group and to exercise the rights provided for by the regulations (for more details, see the dedicated section of this Charter).

Collection and processing of personal data at Relyens

Purposes and legal bases of the processing carried out by the companies of the Relyens group in their capacity as data controllers

The personal data collected by the companies of the Relyens group meet specific objectives (purposes) that are systematically brought to the attention of the persons concerned.

In addition, in order to be lawful, any processing of personal data carried out must be based on a legal basis (also known as a “legal basis”).

For the companies of the Relyens group, this lawfulness is based on one of these four legal bases:

• The execution of pre-contractual or contractual measures: Art. 6.1.b) GDPR;
• The consent of the data subject: Art. 6.1.a) GDPR;
• The legitimate interest pursued by the companies of the Relyens group: Art. 6.1.f) GDPR;
• A legal or regulatory obligation: Art. 6.1.c) GDPR.

The main purposes pursued by the companies of the Relyens group are:

In certain situations, companies of the Relyens group may act as subcontractors for their customers: this is the case for Relyens Technology Services and QualNet.

Compliance of data processing by design and by default

The companies of the Relyens group integrate privacy protection from the design phase of their products and services, and throughout their life cycle, from the collection of personal data to its deletion or anonymization.

The Relyens Group is committed to applying by default to personal data a level of protection that meets the requirements of the applicable regulations in this area.

The Relyens Group applies the principle of data minimization to each processing, which is concretely reflected as follows:

• Only personal data that is strictly necessary for the purposes of the processing concerned is collected and processed;
• Personal data is not kept beyond the time required for these purposes (deletion or anonymization if necessary);
• Personal data is only accessible to Relyens employees and authorized recipients;
• Personal data is, as soon as possible, pseudonymised or even anonymised

In addition, prior to any new project involving the processing of personal data, the DPO of the Relyens company concerned is consulted in order to obtain his recommendations to ensure the security and confidentiality of the data.

Transparency and information on the processing carried out

No collection of personal data is carried out by the companies of the Relyens group without the data subjects being informed.
For example, in quotes, contracts, contact forms on the Web, information mentions specify (non-exhaustive list):

• The identity of the Data Controller;
• The purposes of the processing of personal data;
• The legal basis (legal basis) legitimizing the processing;
• The (categories of) recipients of the data;
• The maximum data retention period.

Categories of Personal Data Collected

The categories of personal data collected by Relyens Group companies may vary depending on the purpose of the processing, the type of data subjects and the product or service concerned.

Depending on the case, this may include:

(1) See definition in the glossary.
Sensitive data is specific personal data that must be subject to specific protections and whose processing is strictly regulated by regulations.
The lawfulness of the processing of special categories of personal data, in particular health-related data, is based on one of the conditions of Article 9.2 of the GDPR.
For the Relyens group, the possible scenarios are as follows:
(a) the data subject has given his or her explicit consent to the processing of such personal data for one or more specific purposes, except where Union law or the law of the Member State provides that the prohibition referred to in paragraph 1 cannot be lifted by the data subject;
(b) the processing is necessary for the performance of the obligations and the exercise of the rights of the controller or the data subject in the field of employment, social security and social protection law, in so far as such processing is permitted by Union law, by the law of a Member State or by a collective agreement concluded under the law of a Member State which provides for appropriate safeguards for the fundamental rights and interests of the data subject;
f) data processing is necessary for the establishment, exercise or defence of legal claims or whenever courts are acting in the exercise of their judicial function;
h) data processing is necessary for the purposes of preventive or occupational medicine, the assessment of the worker’s capacity to work, medical diagnosis, health or social care, or the management of health care or social protection systems and services on the basis of Union law, the law of a Member State or under a contract concluded with a health professional and subject to the conditions and guarantees referred to in paragraph 3;(2) Data relating to criminal convictions or offences are collected and processed mainly in the context of motor vehicle and legal protection contracts.(3) Sensitive data other than those relating to health and criminal convictions/offences are only collected and processed on an exceptional basis by the Relyens Group, and only when the situation justifies it.

When personal data is collected directly by the companies of the Relyens group, it is specified whether the information to be provided is mandatory (generally indicated by the presence of an asterisk at the level of the section) or optional.

If certain mandatory information is not provided, the companies of the Relyens group may find themselves unable to respond to a request, to draw up a price proposal, to manage/execute an insurance contract or to provide a service.

Categories of recipients to whom the data are communicated

With regard to and depending on the processing purposes pursued, personal data may be exchanged within the companies of the Relyens group to enable them to carry out their missions, in compliance with the principle of data minimisation (lowest possible volume of data, lowest possible number of recipients, etc.).

Data may also be communicated to other stakeholders involved in the processing of personal data.

The table below specifies, by major categories, the potential recipients of personal data of the companies of the Relyens group (non-exhaustive list):

Place of data processing

The companies of the Relyens group prefer the processing and storage of personal data in the European Union.

However, if a transfer of personal data outside the European Union is necessary to carry out certain specific processing, this transfer is only made with countries with an adequate level of protection. Otherwise, the transfer of personal data is subject to an appropriate technical and legal framework and after prior consultation with the DPO of the Relyens group.
In any case, this transfer will be carried out in compliance with the provisions of Chapter V of the GDPR entitled: “Transfers of personal data to third countries or international organisations”.

Depending on their role in the context of the processing, these external recipients will process the data either as autonomous data controllers or as subcontractors duly appointed by the companies of the Relyens group, in accordance with the legislation on the protection of personal data.

Duration of data retention

The companies of the Relyens group endeavour to set the appropriate retention periods for personal data with regard to the purpose of the processing concerned, while taking into account any applicable legal limitation periods.

When the data has reached its retention period according to the reference system defined by the Relyens group, the companies of the Relyens group delete or anonymize it (a process that excludes any possibility of re-identification of the data subject).

The following table indicates the maximum retention period for personal data used by the companies of the Relyens group as data controllers (non-exhaustive list):

(*) For practical reasons, due to the multitude of products and services historically marketed by the companies of the Relyens group, it is not possible within the framework of this Charter to exhaustively reproduce the different applicable retention periods, which vary in particular according to the insurance product, the guarantees taken out and whether or not claims have occurred on the contract.
To find out the retention period applicable to a particular data processing, contact the DPO of the Relyens company concerned.

Data security at Relyens

Relyens’ Information System (IS) is at the heart of the system for delivering services to its customers. This Information System is built to guarantee an efficient and adapted quality of service.

Relyens has a team of more than 100 professionals and IS experts who work on a daily basis to manage and continuously develop this Information System.

The Information System is built on robust and secure technical infrastructures, with the use of modern and innovative technologies. These infrastructures are based on equipment that is constantly renewed.

The entire infrastructure is hosted in two cross-border data centers, located in two geographically distant locations. Based on this redundant infrastructure, the Business Continuity Plan is designed and tested annually to ensure the continuity of services in the event of a major disaster or cyber attack.

Both the business management applications and the customer areas are developed and maintained in-house and are based on standard and market-leading technologies.

A chain of dematerialization of all incoming mail allows Relyens to build efficient management processes.

The security of access to information is based on a proven and recognized authentication and access control solution as well as on traceability of the actions carried out.

The IS Security Manager manages an IS Security Management System (ISMS) within Relyens. This ISMS is based on a security policy describing the organization and the security principles followed. Continuous monitoring is carried out through internal or external audits and allows for regular adjustment of security measures.
The changes are aimed at a continuous improvement of the ISMS and an adjustment of the measures in view of the evolution of IS risks.

A process of certification of the ISMS with regard to the ISO 27001 standard is underway.

A more detailed document on the protections implemented by the Group is available to customers and prospects upon request.

Exercising your rights over personal data at Relyens

GDPR rights

In accordance with applicable regulations, individuals have the following rights over their personal data:

Exercising your rights at Relyens

Persons wishing to exercise any of the rights listed above may contact the Data Protection Officer (DPO) of Relyens, whose contact details are indicated below:

(*) Add @relyens.eu to the address indicated in this section to reconstitute the contact email address of the DPO (anti-spam measure)

When the situation justifies it, the Data Protection Officer (DPO) may ask the person exercising his or her rights to provide a supporting document (national identity card, etc.) to verify his or her identity.

If the response provided by the Relyens Group does not satisfy him/her, the data subject has the possibility of lodging a complaint with the competent supervisory authority (refer to the section “Personal data protection regulations” in the preamble to this Charter for contact details).