Privacy policy

PRIVACY POLICY

At Juisci, protecting your personal data is our priority.

When you use the website www.juisci.com (the "Website") or the Juisci application, available on the web, iOS and Android (the "Application"), and when we manage our relationship with our clients, we collect personal data about you.

The purpose of this policy is to inform you about how we process your personal data in compliance with Regulation (EU) 2016/679 of 27 April 2016 (the "GDPR") and French Data Protection Law n° 78-17 of 6 January 1978 as amended (together the "Applicable Regulations").

1. Who is the data controller?

The data controller is JUISCI, a French société par actions simplifiée registered with the Registry of Trade and Companies of Nanterre under number 894 416 544, whose head office is located at 22 TER, boulevard du Général Leclerc, 92200 Neuilly-sur-Seine, France ("Us" or "We").

We have appointed a Data Protection Officer (DPO), whom you can reach at the address given in the "Contact" section below.

This policy does not apply to processing for which Juisci acts as a data processor. When a client organisation gives you access to a private space in the Application, that organisation is the controller of the processing it decides (for example the management of its guest list) and we act on its behalf. In that case, please also refer to its own privacy policy.

2. What personal data do we collect?

Personal data is any data that identifies you directly or indirectly. We collect the following categories:

• Identification data: first name, last name, email address, and a profile picture if you add one.
• Professional data: profession, medical specialty, institution or employer, country and, where required to access certain content, your professional registration number. When you sign up, we may complete these data with publicly available professional information (directories, institution web pages) searched from your first name, last name and the domain of your professional email address, in order to offer you a pre-filled profile that you confirm or correct.
• Interests and preferences: the specialties and topics you choose, your language, your preferred formats, and the interest profile we infer from your use of the Application to personalise your feed.
• Login and authentication data: technical identifier, IP address, connection logs, encrypted password. If you sign in with Google or Apple, those services send us your name and email address; we never receive the password of your third-party account.
• Usage data: content viewed, saved or shared, playlists created, search queries, questions asked to the AI assistant and the answers returned, dates and times of use, device type, browser and operating system, a technical notification token if you accept notifications, and recordings of your navigation and interactions within the Application (session replay) in which the text you type is masked.
• Correspondence: any information you send us by email or through support.

We do not collect precise geolocation data; your country is derived from your IP address or from what you declare.

Mandatory data are indicated as such when they are collected.

3. On what legal basis, for what purposes and for how long do we keep your personal data?

Purpose	Legal basis	Retention period
To provide the services of the Website and the Application through your account	Performance of the contract	For the duration of your account. When you delete your account, your data is deleted immediately from our live systems; residual technical copies then expire with their own cycles (see "Your rights").
To verify that you are a healthcare professional and to pre-fill your professional profile at sign-up from public sources	Our legitimate interest in reserving the Application to healthcare professionals and in simplifying sign-up; you may object at any time	The proposed profile is kept with your account; intermediate search results are not kept
To personalise your feed, recommendations and notifications	Performance of the contract (this is the core of the service) and our legitimate interest in improving the relevance of content; you may object (see "Your rights")	For the duration of your account
To provide the AI assistant (JuisciGPT, discussion with an article)	Performance of the contract	Your conversations are kept with your account and deleted with it; see the "Artificial intelligence" section
To secure the Website and the Application and to prevent fraud and abuse	Our legitimate interest in securing our services; legal obligations	Technical logs: 30 days
To manage our relationship with client organisations and their administrators	Performance of the contract with the organisation	For the duration of the contract, then returned or deleted at the client's choice within one month after its end
To build and maintain a customer and prospect database	Our legitimate interest in developing our business	Customers: duration of the relationship. Prospects: 3 years from the last contact
To send newsletters and information about our services	Our legitimate interest in informing our users and clients; you may unsubscribe at any time	3 years from the last contact; your objection is kept for 3 years
To measure the audience and usage of the Website and the Application and to improve our services	Your consent for trackers subject to consent; our legitimate interest for strictly necessary measurement	Pseudonymised usage data: 25 months. Consent choices: 12 months
To answer your information and support requests	Our legitimate interest in answering you	24 months after the request is closed
To handle requests to exercise your rights	Legal obligation	A proof of identity, if requested, is deleted once verification is done; the record of the request is kept for 5 years
To comply with our legal and accounting obligations	Legal obligation	Applicable legal periods (10 years for accounting records)

4. Artificial intelligence

Juisci uses artificial intelligence models provided by third parties to summarise, translate and classify scientific publications, to answer your questions in the AI assistant and to interpret your search queries. Juisci does not train any model and does not share your data for training purposes; our providers commit contractually not to use the data they receive to train their models.

What these providers receive: the scientific content being processed, the text of your search queries and questions, and a pseudonymous technical identifier that lets us attribute the cost of a request to an account. They do not receive your name, email address or IP address, except for the professional profile pre-fill described above, for which your name and the domain of your email address are used.

You remain in control of what you write: the AI assistant is not designed to receive information that could identify a patient. Do not enter names, dates of birth or any other identifying data about a third party.

No decision producing legal effects on you is taken in an automated way.

5. Who are the recipients of your personal data?

The following have access to your data, within the limits of their duties:

• Authorised Juisci staff.
• Our processors, by category: hosting and database (Google Cloud, European Union, Netherlands); authentication (Google Firebase Authentication, United States); file storage such as profile pictures (Google Cloud Storage); email sending (Resend, United States); contact and campaign management (ActiveCampaign); audience measurement and session replay (Mixpanel, European Union); technical monitoring and error tracking (Sentry, United States); notifications (Google Firebase Cloud Messaging); AI model providers through a technical gateway (Portkey; OpenAI, Microsoft Azure OpenAI, Mistral, Google); search for public professional information at sign-up (Exa, United States); web traffic protection (Cloudflare); office and support tools (Google Workspace).
• The organisations that sponsor a private space you have joined: they receive aggregated usage statistics for their space. Where the organisation administers its space itself, the administrators it has designated also have access to, and can export, the identification, professional and usage data of the members of that space: first name, last name, email address, date of birth, professional registration number, country, profession, specialties, institution, journals and formats followed, device, sign-up origin, sign-up date, last login, and the marketing consent choices for that space. The organisation is then the controller for that use.
• Where applicable, authorities and authorised bodies, solely to comply with our legal obligations.

The current list of our processors is available from our DPO on request.

6. Are your personal data transferred outside the European Union?

Your account data, your content and our backups are hosted in the European Union (Google Cloud, Netherlands).

Some of our providers process data in the United States: authentication (Firebase Authentication), error tracking (Sentry), file storage (Google Cloud Storage), the AI gateway and some AI model providers (Portkey, OpenAI, Microsoft Azure OpenAI), the search for public professional information (Exa), email sending (Resend) and, depending on the configuration of our account, contact management (ActiveCampaign). These transfers are governed by the safeguards provided for in Chapter V of the GDPR: the European Commission's adequacy decision for organisations certified under the EU-US Data Privacy Framework, and Standard Contractual Clauses approved by the European Commission in the other cases. A copy of these safeguards is available from our DPO on request.

7. How do we protect your personal data?

Your data is encrypted in transit (TLS 1.2 or higher) and at rest (AES-256). Access to our systems is restricted to authorised staff, protected by multi-factor authentication and reviewed periodically. Our backups are encrypted and kept in the European Union. We run regular vulnerability scans.

8. What rights can you exercise on your personal data?

You have the following rights:

• Right of access (Article 15 GDPR): obtain a copy of your data.
• Right to rectification (Article 16): correct inaccurate or incomplete data, including the elements of your pre-filled professional profile, directly from the Application.
• Right to erasure (Article 17): you can delete your account at any time from the Application settings. Erasure from our live systems is immediate and irreversible. Residual technical copies then expire with their own cycles: 15 days for backups, 14 days for point-in-time recovery logs, 30 days for application logs. Usage data already collected for audience measurement is kept in pseudonymised form for the period stated in section 3: it is held under a technical identifier and is not erased together with your account.
• Right to restriction of processing (Article 18).
• Right to data portability (Article 20): receive the data you have provided to us in a structured, machine-readable format.
• Right to object (Article 21): you may object at any time to direct marketing, and to the personalisation of your feed based on your interest profile; in that case you receive a non-personalised feed.
• Right to withdraw your consent at any time, without affecting the lawfulness of processing carried out before withdrawal.
• Right to give instructions about what happens to your data after your death.
• Right to lodge a complaint with the CNIL (www.cnil.fr) or with the supervisory authority of your country of residence.

You can exercise these rights from your account settings or by writing to our DPO. We may ask you for proof of identity where necessary.

9. What cookies do we use?

For more information on cookies and trackers, please consult our Cookies Policy. Your consent choices are kept for 12 months and can be changed at any time.

10. Contact

Data Protection Officer: Tugdual de Kerviler

Contact email: admin@juisci.com

To review, update or delete your information: the Settings section of the Application.

Contact address: Juisci, 22 TER, boulevard du Général Leclerc, 92200 Neuilly-sur-Seine, France

11. Modifications

We may modify this privacy policy to reflect regulatory, technical or service changes. The applicable version is the one published in the Application. We will inform you of any significant change.

Entry into force: September 2026