Privacy policy

Data controller

Christian Dides, sole trader operating Sansomed, 194 route du Loroux-Bottereau, 44115 Basse-Goulaine. For any question about personal data: contact@sansomed.fr or +33 6 82 61 20 70.

Data processed

Depending on the service used, Sansomed may process: professional identity and title, contact details, practice name and address, the professional’s date of birth when entered in Direction, technologies or equipment concerned, appointment preferences, messages, consumables requests, BPC Method progression, equipment references, certificates and professional signatures.

No information that could identify a patient should be entered on the website or in the BPC Method Assistant.

Purposes and legal bases

• Responding to an enquiry, assessing a project and arranging an appointment: pre-contractual steps requested by the professional.
• Managing equipment, support, a consumables request or a certificate: performance of the contractual relationship and Sansomed’s legitimate interest in providing follow-up.
• Protecting the website, preventing misuse and retaining evidence where necessary: legitimate interest and legal obligations.
• Sending appointment confirmations and reminders: performance of the request, without automated marketing.
• Displaying an internal birthday reminder in Direction when a professional’s date of birth has been entered: Sansomed’s legitimate interest in maintaining the professional relationship. This information is not displayed in the partner portal.
• Using the BPC Method Assistant with OpenAI: the professional’s explicit consent, which can be withdrawn through “AI privacy” in the Assistant.

Recipients and service providers

Data are accessible to Christian Dides and, only when the relevant function is used, to the technical providers required for hosting, email, calendar services, notifications, commercial management and artificial intelligence. The principal services used or planned are Scalingo for application and database hosting in France, the OpenAI API for the BPC Method Assistant, IONOS for the domain, email and Dolibarr, Brevo for transactional emails and SMS, and Google Calendar when the connection is active.

Some providers may process data outside the European Union. In such cases, Sansomed relies on safeguards provided for under the GDPR and the contractual commitments of the provider concerned. Sansomed requires any third party with whom user data is shared to provide the same or equal protection of user data as stated in this privacy policy and required by applicable rules.

BPC Method Assistant

The BPC Method Assistant uses the API of the artificial intelligence provider OpenAI to generate its responses. This use is based on your explicit consent. After you agree, the messages you voluntarily enter and the previous responses in the current conversation are sent to OpenAI. The Assistant mode, language and, where relevant, the category of solution you viewed are also included.

In Practice Mode, only minimal technical context may be added automatically: equipment types and models, verified technical information, compatible consumables, available resources and the actual equipment lifecycle status when it is needed to answer the request. When a technical question requires the documentation for the selected product, the associated technical manual may also be sent to OpenAI so that the relevant answer can be found; it is not attached to questions that do not need it. Model labels outside the catalogue are filtered; no unverified specifications are added. The professional’s name and title, practice name, address, email, telephone number, serial numbers, customer-specific references and installation, contract or follow-up dates are not added to the OpenAI context. This information remains available in Sansomed. However, personal information you type yourself is part of the message transmitted: do not enter any information that could identify a patient.

A dialog explains this processing and requests your explicit consent before the first transmission to OpenAI. If you decline, no OpenAI call is made and the other Sansomed features remain available. The “AI privacy” link lets you review this information and withdraw your consent for future messages.

Requests to OpenAI use store: false to disable application-level storage of the response. This setting does not guarantee the absence of technical security logs at the provider; the applicable conditions are described in the OpenAI API data protection documentation. For personal data sent to its API through the BPC Method Assistant, OpenAI acts as a data processor on behalf of Sansomed under its Data Processing Addendum. This agreement imposes contractual confidentiality, security and data protection obligations in accordance with applicable laws, together with technical and organisational measures designed to provide an appropriate level of protection for the transmitted data.

Sansomed does not retain conversation history in the BPC portal. Sansomed retains a summary only if the professional chooses to submit it. The Assistant does not make automated decisions that produce legal or similarly significant effects, provide medical diagnoses or clinical interpretations, or give legal advice.

When a partner voluntarily chooses “Recommend Sansomed”, Sansomed creates an opaque referral link associated with that partner’s account and counts initiated recommendations, visits to that link and enquiries resulting from it. Sansomed does not access the partner’s address book and receives no colleague contact details when the link is shared. A recipient’s contact details are processed only if that person chooses to contact Sansomed or submit the form on the referral page.

Retention periods

• Contact, project or appointment requests that do not result in a commercial relationship: three years after collection or the professional’s most recent contact.
• Partner portal data: for the duration of the relationship with Sansomed, followed by archiving limited to the period required for evidence and applicable obligations.
• Certificates and contractual follow-up records: five years after the end of the relevant relationship, unless a different obligation applies.
• Unsuccessful access recovery requests and technical security logs: deletion or anonymisation no later than twelve months afterwards.

Cookies and local storage

The website currently uses no advertising cookies or audience measurement tools. The partner portal uses only a secure technical cookie required for authentication and session continuity. This cookie does not require prior consent. If an optional tool is added later, information and consent procedures will be adapted before it is activated.

Your consent to use the Assistant is remembered in the current browser using a versioned local storage key, so you are not asked again for each message. If storage is unavailable, consent applies only to the current page. You can withdraw it through “AI privacy”; using another browser or clearing local storage will require fresh consent.

Your rights

You may request access, rectification, erasure, restriction or portability of your data and may object to processing based on legitimate interest. Email contact@sansomed.fr with details of your request. Sansomed responds within the statutory period and may request proof only where there is reasonable doubt about identity.

If you believe your rights have not been respected after contacting Sansomed, you may lodge a complaint with the French data protection authority, the CNIL.

Security

Partner access uses hashed codes and tokens, secure cookies and server-side authorisation checks. As no system can guarantee zero risk, Sansomed limits the data collected to what is necessary for the requested service.

Last updated: 2 October 2026.