New SDK Release: Build secure medical apps faster with our tools for EHRs, devices, and patient-doctor solutions. Explore CardinalSDK

Hoofdmenu
Producten
Cardinal Backend & SDK Cardinal Data Exchange Module Cardinal Free Health Connector Gebruikscases
Nieuws
Neem contact op
Back to blog

July 31, 2023

A Startup`s Guide to GDPR and Privacy

post illustration

Are you a startup venturing into the exciting world of technology or medical innovation? While starting a project in the technology and medical area can be an exciting experience, it is crucial to consider the implications of the General Data Protection Regulation (GDPR), even if you’re a startup.

In this blog post, we are providing you with simple and fundamental steps to comply with GDPR and gain awareness about privacy regulations, especially when dealing with sensitive medical data.

Let’s start by understanding the basics before diving into practical implementation.

Familiarize yourself with the core principles of GDPR and the legal requirements for processing personal data.

Differentiating between Data Controllers and Data Processors is essential. This distinction determines your obligations, which vary depending on your role. Establishing a register of processing activities is a crucial step in your compliance journey.

It is important to distinguish sensitive data and personal data because sensitive data requires additional protection due to its potential impact on an individual’s rights and freedoms. You can find a sample register on the CNIL website for guidance. Understanding the purpose of processing means having a clear understanding of why you collect and use personal data, and under which legal basis.

GDPR requires organizations to have a lawful basis for processing personal data, such as fulfilling a contract, complying with a legal obligation, or obtaining consent. You also need to take into account the principles of the GDPR which are:

  • Lawfulness, fairness, and transparency: Have a valid reason for handling personal data and be transparent about its usage.
  • Purpose limitation: Collect and use personal data only for specific, legitimate purposes. Communicate these purposes clearly to individuals and seek consent for any new purposes.
  • Data minimization: Collect only necessary data for your intended purposes, avoiding irrelevant information.
  • Accuracy: Ensure the data you collect is accurate and up-to-date. Implement checks to maintain data reliability.
  • Storage limitation: Justify the duration for which data is kept and establish appropriate retention periods. Anonymize or delete data when it’s no longer needed.
  • Integrity and confidentiality: Safeguard personal data from unauthorized access or loss, ensuring security and confidentiality.
  • Accountability: Take responsibility for complying with data protection principles, maintain records to demonstrate compliance, and cooperate with authorities if required.

Our advice is to establish the Registers and Data Flow mapping simultaneously, as they complement each other. By employing this method, you can create a comprehensive Data Flow mapping, allowing your company, all the departments, and your colleagues to gain a clearer view of data flows within your company. This mapping exercise will help you in defining policies for data retention, deletion, and internal data transfers.

Additionally, conduct a Data Protection Impact Assessment (DPIA) when processing data that may pose a high risk to individuals’ rights and freedoms, especially sensitive data.

DPIAs are vital tools to assess and mitigate privacy risks associated with data processing activities. Identify and evaluate potential risks, implement appropriate safeguards, and demonstrate GDPR compliance.

Data security is crucial, particularly in the medical domain and sensitive data processing. Prioritize privacy by design and by default to comply with GDPR. Adopt robust end-to-end encryption solutions to secure personal data and limit access. With iCure, you can effectively secure your data and achieve compliance with privacy by design and by default principles mandated by the GDPR. Learn more here.

Also, even if you are a start-up, with a low activity in processing personal data, you will need to create a dedicated portal for data subject requests, allowing individuals to exercise their rights under GDPR, which include the right to access, rectify, and erase their personal data.

Establish an incident management plan and implement measures to mitigate risks. Refer to our blog post on preventing data loss for valuable insights.

You will also need to review and establish contracts, such as Data Processing Agreements, with your suppliers and clients. Develop internal procedures in case of a data breach or incident.

You’ll need to be able to promptly notify the supervisory authority and affected individuals of any data breach that poses a risk to their rights and freedoms within 72 hours of awareness. If you’re a data processor, you must also notify the data controller about any data breaches. In case the data breach poses a high risk to individuals, it’s important to inform them unless effective measures are in place to mitigate the risk.

For certain organizations, depending on their activities, the appointment of a Data Protection Officer (DPO) may be mandatory. This requirement applies to public authorities or bodies, as well as organizations whose core activities involve large-scale regular and systematic monitoring of individuals or processing of sensitive personal data.

Lastly, startups developing medical solutions should consider local regulations regarding patient rights and their medical record. For example, in some European countries, medical records must not be kept for more than 50 years. These regulations are additional to the GDPR.

Secure your sensitive data to achieve GDPR compliance by using iCure’s database management and encryption solutions. Explore iCure’s products and services now to safeguard your data!

Our upcoming blog post will dive into the specifics of cookie regulations, providing you with comprehensive knowledge on this topic.

Please note that this information is for guidance and should not be considered legal advice and achieving full GDPR compliance may require further research.

Back

Terms of use

www.iCure.com

1. RECITALS

ICure SA is incorporated in Geneva, Switzerland, with a registered office at Rue de la Fontaine 7, 1211 Geneva, Switzerland registered in the commercial registry under CHE-270.492.477 (“iCure”).

These Terms of Use constitute a legally binding agreement made between you, whether personally or on behalf of an entity (“you”) and iCure SA (“we,” “us” or “our”), concerning your access to and use of the https://www.icure.com website as well as any other media form, media channel, mobile website or mobile application related, linked, or otherwise connected thereto (collectively, the “Website”).

When you accept, these Terms form a legally binding agreement between you and iCure. If you are entering into these Terms on behalf of an entity, such as your employer or the company you work for, you represent that you have the legal authority to bind that entity.

PLEASE READ THESE TERMS CAREFULLY. BY REGISTERING FOR, ACCESSING, BROWSING, AND/OR OTHERWISE USING THE iCURE, YOU ACKNOWLEDGE THAT YOU HAVE READ, UNDERSTOOD, AND AGREE TO BE BOUND BY THESE TERMS. IF YOU DO NOT AGREE TO BE BOUND BY THESE TERMS, DO NOT ACCESS, BROWSE, OR OTHERWISE USE THE ICURE WEBSITE.

iCure may, in its sole discretion, elect to suspend or terminate access to, or use of the iCure to anyone who violates these Terms.

All users who are minors in the jurisdiction in which they reside (generally under the age of 18) must have the permission of, and be directly supervised by, their parent or guardian to use the Website. If you are a minor, you must have your parent or guardian read and agree to these Terms of Use prior to you using the Website.

The original language of these Terms and Use is English. In case of other translations provided by iCure, the English version shall prevail.

2. INTELLECTUAL PROPERTY RIGHTS

The Content of the documentation stated on this Website is ours. All Marks, Content that concern iCure cannot be copied, reproduced, aggregated, republished, uploaded, posted, publicly displayed, encoded, translated, transmitted, distributed, sold, licensed, or otherwise exploited for any commercial purpose whatsoever, without our express prior written permission.

Provided that you are eligible to use the Website, you are granted a limited license to access and use the Website and to download or print a copy of any portion of the Content to which you have properly gained access solely for your personal, non-commercial use. We reserve all rights not expressly granted to you in and to the Website, the Content, and the Marks.

3. USER REPRESENTATIONS

By using the Website, you represent and warrant that:

  1. All registration information you submit will be true, accurate, current, and complete; you will maintain the accuracy of such information and promptly update such registration information as necessary.
  2. You have the legal capacity, and you agree to comply with these Terms of Use.
  3. You are not under the age of 13.
  4. Not a minor in the jurisdiction in which you reside, or if a minor, you have received parental permission to use the Website.
  5. You will not access the Website through automated or non-human means, whether through a bot, script, or otherwise.
  6. You will not use the Website for any illegal or unauthorized purpose.
  7. Your use of the Website will not violate any applicable law or regulation.

4. PROHIBITED ACTIVITIES

You may not access or use the Website for any purpose other than that for which we make the Website available. The Website may not be used in connection with any commercial endeavors except those that are specifically endorsed or approved between you and iCure.

As a user of the Website, you agree not to:

  1. Publishing any Website material in any other media.
  2. Selling, sublicensing, and or otherwise commercializing any Website material.
  3. Publicly performing and or showing any Website material.
  4. Using this Website in any way that is or may be damaging to this Website.
  5. Using this Website in any way that impacts user access to this Website.
  6. Using this Website contrary to applicable laws and regulations, or in any way may cause harm to the Website, or to any person or business entity.
  7. Engaging in any data mining, data harvesting, data extracting, or any other similar activity in relation to this Website.
  8. Using this Website to engage in any advertising or marketing.

5. NO WARRANTIES

This Website is provided “as is,” with all faults, and iCure expresses no representations or warranties, of any kind related to this Website or the materials contained on this Website. Also, nothing contained on this Website shall be interpreted as advising you.

6. LIMITATION OF LIABILITY

In no event shall iCure, nor any of its officers, directors, and employees shall be held liable for anything arising out of or in any way connected with your use of this Website whether such liability is under this agreement. iCure, including its officers, directors, and employees shall not be held liable for any indirect, consequential, or special liability arising out of or in any way related to your use of this Website.

7. INDEMNIFICATION

You hereby fully indemnify iCure from and against any and/or all liabilities, costs, demands, causes of action, damages, and expenses arising in any way related to your breach of any of the provisions of these Terms.

8. SEVERABILITY

If any provision of these Terms is found to be invalid under any applicable law, such provisions shall be deleted without affecting the remaining provisions herein.

9. VARIATION OF TERMS

iCure is permitted to revise these Terms at any time as it sees fit, and by using this Website you are expected to review these Terms on a regular basis.

10. ASSIGNMENT

iCure is allowed to assign, transfer, and subcontract its rights and/or obligations under these Terms without any notification. However, you are not allowed to assign, transfer, or subcontract any of your rights and/or obligations under these Terms.

11. ENTIRE AGREEMENT

These Terms constitute the entire agreement between iCure and you in relation to your use of this Website and supersede all prior agreements and understandings.

12. GOVERNING LAW & JURISDICTION

These Terms shall be governed by and construed in accordance with the laws of Switzerland, without regard to its conflict of law provisions.

The parties shall attempt to solve the matter amicably in mutual negotiations. In case of a non-amicable settlement that has been found between the parties, the Court of Geneva will be competent.

13. PRIVACY

Please refer to our Privacy Policy and Cookie Notice for the Data that we collected from the contact form and the Matomo cookie.

IMAGE ATTRIBUTION

In the development of our website, we have incorporated various icons to enhance visual appeal and convey information effectively. We extend our sincere appreciation to the talented designers and contributors who have generously shared their work with the community. Below is an acknowledgment of the resources we have utilized:

SVG Repo: A repository SVG icons. We integrated their icons into our website. Specifically:

  1. Work by author vmware, Key Badged SVG Vector under MIT License
  2. Work by author Twitter, Cloud SVG Vector under MIT License
  3. Work by author Garuda Technology, Node Js SVG Vector and React SVG Vector under MIT License

Thanks to the authors who contributed to the: SVGRepo, Unsplash, Maxipanels community.

iCure features logos from various products, libraries, technologies, and frameworks that our project interacts with. It is important to note that iCure does not hold any proprietary rights to these logos or the products they represent.

iCure SA

Contact: contact@icure.com

Last update: February 20th, 2024.

Information Security Policy

www.iCure.com

1. Introduction

The iCure universe is built on trust. Guaranteeing the confidentiality of the data that are entrusted to us is our highest priority.

The Information Security Policy of iCure abstracts the security concept that permeates every activity and abides by the ISO 27001:2013 requirements for Information Security, so that we ensure the security of the data that iCure and its clients manage.

Every employee, contractor, consultant, supplier and client of iCure is bound by our Information Security Policy.

2. Our Policy

iCure is committed to protecting the confidentiality, integrity and availability of the service it provides and the data it manages. iCure also considers protecting the privacy of its employees, partners, suppliers, clients and their customers as a fundamental security aspect.

iCure complies with all applicable laws and regulations regarding the protection of information assets and voluntarily commits itself to the provisions of the ISO 27001:2013.

3. Information Security Definitions

Confidentiality refers to iCure’s ability to protect information against disclosure. Attacks, such as network reconnaissance, database breaches or electronic eavesdropping or inadvertent information revealing through poor practices.

Integrity is about ensuring that information is not tampered with during or after submission. Data integrity can be compromised by accident or on purpose, by evading intrusion detection or changing file configurations to allow unwanted access.

Availability requires organizations to have up-and-running systems, networks, and applications to guarantee authorized users’ access to information without any interruption or waiting. The nature of data entrusted to us requires a higher-than-average availability.

Privacy is the right of individuals to control the collection, use, and disclosure of their personal information. Our privacy policies are based on the GDPR(https://gdpr-info.eu/) and can be augmented by added requirements of specific clients or law areas.

4. Risk Assessment

The main threats iCure is facing as a company are:

  1. Data Theft;
  2. Data Deletion;
  3. Denial of Service attacks;
  4. Malware;
  5. Blackmail and Extortion.

As providers of a solution used by developers active in Healthcare, we also have to anticipate the risks of:

  1. Attacks on our clients’ data, which could lead to major social damages and a loss of trust in our solution;
  2. Abuse of our solution by ill-intentioned clients, that could impact the quality of the service provided to the rest of our clients.

The motivation of the attackers in the latter cases can range from financial gain to political or ideological motivations.

A last risk is linked to the nature of the healthcare data we handle. We must ensure, that the data we handle are not used for purposes other than those for which they were collected:

A piece of data collected from a patient for the purpose of a medical consultation should not be available to third parties, not even a government agency.

5. Risk Management

The main principles we apply to manage the risks we face are:

  1. Confidentiality by design: All sensitive data is encrypted end-to-end before being stored in our databases. We do not have any access to the data we store. Our client’s customers are the only ones who can decrypt the data we store.
  2. Anonymization by design: Healthcare information that has to be stored unencrypted is always anonymized using end-to-end encryption scheme. This means that the link between the healthcare and administrative information must be encrypted.

Those two principles allow us to minimize the risks of data theft, blackmail, extortion, and coercion by government agency.

  1. Multiple real-time replicas, with automatic failover: We use a distributed database architecture to ensure that our data is available at all times. We use a master-master architecture, each data is replicated at least 3 times. Snapshots are taken every day to ensure that we can restore the data in case of a malevolent deletion event.
  2. Automatic password rotations: no single password can be used for more than 48 hours. Passwords are automatically rotated every 24 hours. In case of a password leak, we can limit the window of opportunity for an attack.

Those two principles allow us to minimise the risks of data deletion, denial of service attacks, and malware.

  1. Minimization of the attack surface: we deploy our systems in the most minimal way. We only expose the network services that are strictly necessary.
  2. Strict dependency management: we only use open-source software that is regularly updated and audited by the community. We favor dependency management software and providers that minimize the risk of supply chain poisoning.

Those two principles allow iCure to minimise the risks of intrusion by vulnerability exploit or supply chain attacks, two risks that could lead to data theft or data deletion.

6. Further Information

This policy is valid as of November 10th, 2022. For futher information please connect with us at privacy@icure.com

Impressum

iCure SA

Place de la Bourse-aux-Fleurs 2, Case postale 45, 1022 Chavannes-près-Renens, Switzerland

CHE-270.492.477

Website: https://icure.com/

Contact email: client@icure.com

Privacy request: privacy@icure.com

cookie

Deze website gebruikt cookies

We gebruiken slechts één cookie-applicatie voor intern onderzoek naar hoe we onze service voor alle gebruikers kunnen verbeteren. Het heet Matomo en slaat de informatie geanonimiseerd en voor beperkte tijd op in Europa. Voor meer details verwijzen we u naar onze Privacybeleid en .

Cookie Notice

www.iCure.com

1. Cookies basic information

Cookies are text files placed on your computer to collect standard Internet log information and visitor behavior information. When you visit our websites, we may collect information from you automatically through cookies or similar technology (for further information, visit allaboutcookies.org.)

You can set your browser not to accept cookies, and the above website tells you how to remove cookies from your browser. However, in a few cases, some of our website features may not function as a result.

2. Types of cookies

Types of cookies depending on the organisation managing them:

Own cookies: these cookies are sent to the user’s terminal from a computer or domain managed by the owner of the website from which the service requested by the user is provided.

Third-party cookies: these cookies are sent to the user’s terminal from a computer or domain not managed by the owner of the website from which the service requested by the user is provided, but by another organisation that processes the data obtained through the cookies. In addition, if the cookies are installed from a computer or domain managed by the Website owner but the information collected by them is managed by a third party, they will also be considered third-party cookies.

Types of cookies according to the length of time they remain active:

Session cookies: these cookies are designed to collect and store data when the user accesses a website. They are generally used to store information that only needs to be kept for the provision of the service requested by the user on a single occasion (for example, a list of products bought) and disappear when the user logs off or ends the session.

Persistent cookies: with these cookies, the data continue to be stored in the terminal and may be accessed and processed for a period defined by the person/entity responsible for the cookie, which may range from a few minutes to several years.

3. How and what cookies do we use

Strictly necessary/ functional cookies (these cookies are Mandatory): are essential to help you move around a website and use its features. They don’t collect information that identifies a visitor.

Analytical cookies (with your consent): collect information about how visitors use a website and help website owners improve site performance. They don’t collect information that identifies a visitor.

4. Cookies used on our website

Our web analytics open-source program, Matomo, uses two types of cookies for analyzing page usage: a session cookie ("MATOMO_SESSID") that lasts for 30 minutes and a persistent cookie ("_pk_id.xxx") that remains beyond the browsing session, allowing anonymous tracking of website usage for up to 13 months (without collecting personal information). Matomo temporarily stores user data, including IP addresses, on our server in anonymized form for evaluation before deletion. This data is solely used for our personnal analysis, with no sharing with third parties.

  • Host: Matomo
  • Cookie name: MATOMO_SESSID
  • Expiration: Session 30 min

  • Host: Matomo
  • Cookie name: _pk_id.xxx
  • Expiration: 13 months

For the purposes of analyzing website usage and to optimize its services. The legal basis for the use of Matomo is Article 6, 1 (a) of the GDPR (consent).

5. Users preference

The user can, at any time, allow, block or delete the cookies installed on his/her device by changing the settings on the browser installed on his/her computer:

  • Chrome Chrome Settings -> Advanced -> Privacy -> Content settings. For more information, consult Google support or your browser Help.
  • Explorer or Edge: Tools -> Internet options -> Privacy -> Settings. For more information, consult Microsoft support or your browser Help.
  • Firefox Firefox: Tools – > Options -> Privacy -> History -> Customised Settings. For more information, consult Mozilla support or your browser Help
  • Safari Safari Preferences -> Security. For more information, consult Apple support or your browser Help.
  • You will not access the Website through automated or non-human means, whether through a bot, script, or otherwise.
  • You will not use the Website for any illegal or unauthorized purpose.
  • Your use of the Website will not violate any applicable law or regulation.

6. Withdrawing consent

The user may withdraw his/her consent relating to the Cookies Policy at any time, and may delete the cookies stored on his/her device by adjusting his/her internet browser settings, as described above.

7. Cookie settings

This Cookies Policy may be modified when required by the legislation in force at any time or when there is a change in the type of cookies used on the website. For this reason, we recommend that you review this policy every time you access our website so that you are appropriately informed of how and why we use cookies.

8. Contact

Please contact us with any questions or comments about this Policy, your Personal Data, and our use and disclosure practices by email at privacy@icure.com

iCure SA

Contact: contact@icure.com

Last update: September 13th, 2023

Quality Policy

www.iCure.com

At iCure SA, we are committed to excellence in all aspects of our work. Our quality policy is designed to provide a framework for measuring and improving our performance within the QMS.

1. Purpose of the Organization

The purpose of the QMS is to ensure consistent quality in the design, development, production, installation, and delivery of Data processing, security, archival, technical support and protection solutions for medical device software, while ensuring we meet customer and regulatory requirements. The document applies to all documentation and activities within the QMS. Users of this document are members of the iCure Management Team involved in the processes covered by the scope.

2. Compliance and Effectiveness

We are committed to complying with all applicable regulatory and statutory requirements, including ISO 13485: 2016 and ISO 27001:2013. We strive to maintain and continually improve the effectiveness of our quality management system.

3. Quality Objectives

Our quality objectives are set within the framework of this policy and as defined by our Software Development Lifecycle and are reviewed regularly to ensure they align with our business goals. These objectives serve as benchmarks for measuring our performance and guide our decision-making processes.

4. Communication

We ensure that our quality policy is communicated and understood at all levels of the organization. We encourage every member of our team to uphold these standards in their daily work whether they are employees, contractors, consultants, suppliers, clients or any other person involved in building our medical data management software.

5. Continuing Suitability

We regularly review our quality policy to ensure it remains suitable for our organization. This includes considering new regulatory requirements, feedback from customers, and changes in our business environment. By adhering to this policy, we aim to enhance customer satisfaction, improve our performance, and contribute to the advancement of medical technology

iCure SA

Contact: contact@icure.com

Last update: April 17th, 2024