Privacy policy

This page is a translation. In case of discrepancy, the French version prevails.

Last updated: 27 September 2026

1. Data controller

The controller of the personal data collected in the Thalivia intrathecal community is Thalensis SAS, a French simplified joint-stock company (société par actions simplifiée), registered office 1 rue Aimée Antignac, 35000 Rennes, France, SIREN 989 242 458, represented by Charles Dupoiron, President.

Contact for any question relating to your data: contact@thalivia.care.

Thalensis SAS has not appointed a data protection officer.

2. Data processed and purposes

Creation and management of your account

Data: Name, email address, login identifier, specialty, country, language, role in the community, date of acceptance of the terms of use
Legal basis (Art. 6 GDPR): Performance of the terms of use you accept (Art. 6(1)(b))

Inviting a colleague

Data: Email address and language of the invited person, identity of the inviter
Legal basis (Art. 6 GDPR): Legitimate interest of the inviter and of Thalensis in making the community known to healthcare professionals (Art. 6(1)(f))

Public invitation request and moderation decision

Data: Last name, first name, professional email, specialty, institution, language, request status, decision, date and moderator identity, and any link to an invitation
Legal basis (Art. 6 GDPR): Legitimate interest of Thalensis in reviewing requests for access to the community (Art. 6(1)(f))

Publishing and exchanges

Data: Discussions, replies, reports, and their date
Legal basis (Art. 6 GDPR): Performance of the terms of use (Art. 6(1)(b))

Notification emails

Data: Email address, language, notification preference
Legal basis (Art. 6 GDPR): Performance of the terms of use (Art. 6(1)(b)). You can unsubscribe at any time using the link included in every email

In-app notifications

Data: Events relating to the discussions you take part in
Legal basis (Art. 6 GDPR): Performance of the terms of use (Art. 6(1)(b))

Moderation and security

Data: History of content changes, moderation actions, technical connection logs
Legal basis (Art. 6 GDPR): Legitimate interest in ensuring the security of the service and compliance with the charter (Art. 6(1)(f))

If your request is accepted, the specialty you entered is suggested when you first sign in, as is the name you entered if your Thalivia account does not provide one. You can correct them before confirming your profile. Your institution is used only to review the request and is not shown to members.

Health data. The community is not intended to process patients' health data. The confidentiality charter prohibits any data that would identify a patient, directly or indirectly. Any content containing such data is removed or redacted by the moderation team.

3. Recipients and processors

Your data is accessible to community members for what you publish (name, specialty, content), and to the moderation team for all content.

Thalensis SAS uses the following processors:

Clever Cloud

Role: Hosting of the application and database, certified Health Data Hosting provider (HDS)
Location: France

Clever Cloud, host of login.thalivia.care

Role: Authentication service (Keycloak)
Location: France

MailPace

Role: Email delivery
Location: European Union

No data is sold or used for advertising purposes.

4. Transfers outside the European Union

No data is transferred outside the European Union.

5. Retention periods

Account

For as long as you take part, then deleted within three months of your account deletion request. Deleted after three years without login.

Published content

For the lifetime of the community. If your account is deleted, your content is deleted.

Invitations

Valid for fourteen days. Invitations not accepted are deleted after expiry.

Invitation requests, including decisions

Fourteen days from sending the request, then deletion at the next pruning run (within one minute in normal operation). An invitation created from it follows its own retention period.

In-app notifications

Three months after they are read, and at most twelve months after they are created.

6. Your rights

You have the right of access, rectification, erasure, restriction of processing, objection and data portability. You can edit your profile yourself within the community. To exercise your other rights, write to contact@thalivia.care. You will receive a response within one month.

You may at any time lodge a complaint with the French data protection authority, the Commission nationale de l'informatique et des libertés (CNIL), 3 place de Fontenoy, TSA 80715, 75334 Paris Cedex 07, France, www.cnil.fr.

7. Security

Data is hosted in France by an HDS-certified host and encrypted in transit. Access to the community requires authentication and an invitation. Notification emails contain no clinical content, only a neutral title and a link.

8. Changes

This policy may be updated. The date of the last update is shown at the top of the page.