This processing is based on:

• the performance of a task carried out in the public interest (Article 6(1)(e) of the European General Data Protection Regulation—GDPR),

• compliance with a legal obligation for the exercise of your rights regarding your personal data (Article 6(1)(c) of the European General Data Protection Regulation (GDPR)).

The data you provide will be processed by the relevant staff at Santé publique France to respond to your requests and, strictly limited to what is necessary for the performance of their services, by their subcontractors (e.g., organizing conferences, ordering documents, distributing newsletters).

Under no circumstances will your data be transmitted or transferred to a third party.

The data collected on the contact forms includes the identity and contact information of the user submitting a request to Santé publique France, the purpose of the request, a description of the request, and the follow-up actions taken in response to the request.

The data collected on the subscription form pertains to the user’s identity and contact information, their profession, and the type of professional organization they belong to.

Data is collected directly from the user.

If all the data marked as mandatory on the web form is not provided, the request cannot be processed.

When you subscribe to a scientific journal or to newsletters from Santé publique France, or when you create an account to order documents, your data will be retained until you unsubscribe.

For other services, data will be retained for the period necessary to provide the requested service, which will not exceed 5 years.

In accordance with the provisions of Article 21 of Law No. 78-17 of January 6, 1978, on information technology, data files, and civil liberties, you may object to the processing of your data by contacting:

• For subscriptions to newsletters or scientific journals, please contact webmestre@santepubliquefrance.fr or write to the following address: Santé publique France – DIRCOM-Web Division - 12 rue du Val d’Osne - 94415 Saint-Maurice cedex

• For all other services: by mail to Santé publique France – DPO – 12 rue du Val d’Osne – 94415 Saint-Maurice cedex

You may also exercise your right to access, correct, delete your data, or even restrict its processing under the same terms.

To exercise these rights, you may be asked to verify your identity.

For more information on the processing of personal data by Santé publique France, please contact the Data Protection Officer at Santé publique France: by mail at Santé publique France – DPO – 12 rue du Val d’Osne – 94415 Saint-Maurice cedex.

If you believe that Santé publique France has not respected your rights, you may file a complaint with the National Commission on Information Technology and Civil Liberties (CNIL). However, we recommend that you first contact Santé publique France’s Data Protection Officer (DPO), who is available to assist you with this matter.

To facilitate the implementation of public interest missions related to health surveillance, monitoring, and alerting, the law requires certain public interest organizations, as well as healthcare professionals and facilities, to provide Santé publique France with the information necessary to carry out these missions.

This obligation to provide information also applies when such information is covered by medical, business, or professional confidentiality (see Articles L. 1413-7, L. 1413-8, and L. 1413-12-3 of the Public Health Code).

The procedures for these transmissions are set forth in Articles R1413-34 et seq. of the Public Health Code.

These provisions allow Santé publique France to qualify as an authorized third party (see the CNIL website page: “Authorized Third Parties” and specifically “Compendium of Procedures for Authorized Third Parties”).

The implementation of these transfers must comply with the principles established by the Data Protection Act** and the GDPR***, as well as the provisions regarding health data set forth in the Public Health Code.

Santé publique France carries out these activities either independently or with the support of institutional partners. For example, in the context of surveillance, studies, or epidemiological investigations, Santé publique France collaborates in particular with the Regional Health Agencies, as well as with numerous partners such as Inserm, Anses, Inca, national reference centers for the control of communicable diseases (CNR), population-based registries (cancer, congenital malformations, stroke, etc.), and support centers for the prevention of healthcare-associated infections (CPias).

As part of their support for Santé publique France’s public health surveillance missions, these partners hold the status of members of the National Public Health Network (RNSP). They are either responsible for collecting or transmitting the necessary data to Santé publique France, or they are recipients of data held by Santé publique France.

In this regard, virological surveillance is carried out by the CNRs.

Individuals affected by this processing have various rights regarding their data, depending on the legal framework governing each specific processing activity: the right to object, the right of access, the right to rectification, the right to erasure, the right to restriction, and, for certain processing activities, the right to data portability.

Note: The right to object and the right to erasure may not apply to:

• certain processing operations required by law, such as processing related to so-called “notifiable” diseases (Art. L.3113-1 and R.3113-1 et seq. of the Public Health Code);

• in certain cases, if a legitimate and compelling reason takes precedence over the rights and freedoms of individuals.

To ensure that these processing activities comply with the requirements of the French Data Protection Act** and the GDPR***, and in particular to facilitate the exercise of data subjects’ rights regarding their data, Santé publique France has appointed a Data Protection Officer.

Contact the Data Protection Officer: Data Protection Officer, Santé publique France, 12 rue du Val d’Osne, 94415 Saint-Maurice Cedex. Email: dpo@santepubliquefrance.fr

For general information on the processing of personal data and its regulatory framework, please visit the website of the Commission Nationale de l’Informatique et des Libertés (CNIL).

If you believe that your data rights are not being respected, you may file a complaint with the Commission Nationale de l’Informatique et des Libertés (CNIL): submit a complaint to the CNIL.

Santé publique France maintains surveillance databases containing pseudonymized data (databases that do not include last names, first names, social security numbers, mailing addresses, or other contact information of the individuals concerned) that meet the criteria for inclusion in the SNDS (National Health Data System) catalog and may be reused for health research purposes (see Articles L. 1461-1, R1461-2, and R1461-4 of the Public Health Code).

To date, the following have been included in this catalog, in accordance with the decree of May 12, 2022, regarding data feeding the main database and the databases of the National Health Data System catalog:

• the Oscour database: data catalog | Health Data Hub

• the databases of so-called notifiable diseases: data catalog | Health Data Hub

To learn about all research projects that reuse data from the OSCOUR and notifiable disease databases and to understand your full rights, you can visit the Health Data Hub website.

Individuals affected by this processing may exercise their right to object to the reuse of their data for research purposes by contacting: dpo@santepubliquefrance.fr or the HDH Data Protection Officer at "dpd@health-data-hub.fr".

Exercising these rights will require verification of your identity and will be limited to Santé publique France’s ability to identify you, given the pseudonymization measures implemented.