This privacy policy describes how the CRS Report website (https://crs-report.com, hereinafter the "Site") processes its users' data, in accordance with the General Data Protection Regulation (GDPR — EU Regulation 2016/679) and the French "Informatique et Libertés" Act. Protecting your privacy is a priority. The Site is designed to process the strict minimum of data necessary for its operation.
1. Data controller
The data controller is:
Research Unit 3738 - CICLY (Centre for Innovation in Cancer of Lyon)
165 chemin du Grand Revoyet, 69921 OULLINS Cedex, France
URL: https://www.laboratoire-cicly.fr/
Contact: https://www.laboratoire-cicly.fr/contact/
2. Core principle: no health data retained
The Site does not collect, durably store, archive or analyse any medical or patient-related data.
The clinical data entered by the user as part of an evaluation (score calculation, report generation):
- are never durably retained on the Site's servers;
- are never used for analysis, research or marketing purposes;
- are never shared with third parties;
- are automatically deleted at the end of the session, after no more than 20 minutes of inactivity.
The operative reports and exported files (.pdf, .csv, .json) are placed under the sole responsibility of the user, who ensures their download, retention and security on their own media.
3. Data processed and purposes
3.1 Evaluation data (tool operation)
To enable the tool to operate during a session, a temporary technical cookie (evaluation_session) is associated with a user session. The corresponding evaluation and report data are automatically deleted after no more than 20 minutes of inactivity.
- Purpose: ensure the proper operation of the tool during the working session.
- Legal basis: legitimate interest in providing a functional service / performance of the service requested by the user.
- Retention period: 20 minutes of inactivity maximum, then automatic deletion.
3.2 Contact form
Information submitted via the contact form is sent by e-mail to the Site's publisher. It is not stored on the Site, is never used for marketing purposes and is never shared with third parties.
- Purpose: respond to user requests.
- Legal basis: legitimate interest in handling the requests received.
- Retention period: the time necessary to process the request.
3.3 Audience measurement (optional cookies)
Subject to your consent, the Site uses Google Analytics to measure audience and improve its content. These cookies collect no medical or patient-related data.
- Purpose: audience measurement and improvement of the Site.
- Legal basis: user consent (revocable at any time).
You may accept or refuse these cookies via the cookie management banner, or disable them in your browser.
4. Cookies
The Site uses two categories of cookies:
- Necessary cookies (no consent required): for example the
evaluation_sessioncookie, essential for identifying your session and operating the evaluation tool. - Optional analytics cookies (subject to consent): Google Analytics, for audience measurement purposes.
You may set your preferences at any time via the Cookie Management page or your browser settings.
5. Embedded content from third-party sites
The Site's pages may embed content from third parties (for example YouTube videos). This content behaves as if you were visiting the third-party site concerned and may collect data about you. No YouTube cookie is placed and your IP address is not transmitted to YouTube until you have consented. These services have their own privacy policies, over which the publisher has no control.
6. Data recipients and technical service providers
Given the Site's architecture, no clinical or patient data is shared with third parties. The only persons able to access evaluation data temporarily (during the window of no more than 20 minutes preceding their deletion) are:
- the technical administrator of the Site;
- the publication management.
For navigation and the technical operation of the Site, the following providers act as data processors and may process technical data (such as your IP address, user-agent or page URL), to the exclusion of any medical or patient data:
- Hostinger International Ltd. — host (EU, Cyprus);
- Google LLC — Google Analytics — audience measurement, placed only subject to your consent, configured with
send_default_pii: false; - Sentry — technical error monitoring on EU servers (
ingest.de.sentry.io); receives the error trace, the URL and the user-agent, but no medical or patient data.
No data is sold, rented or transmitted to third parties for commercial purposes.
7. Security
The Site uses the SSL/HTTPS protocol on all of its pages to encrypt communications between the user and the servers. In the event of a data breach, the publisher will take the necessary measures without delay to preserve the integrity of the system and will, where applicable, inform the data subjects and the competent authorities in accordance with the regulations.
8. Your rights
In accordance with the GDPR, you have the following rights over your data: right of access, rectification, erasure, restriction, objection and portability.
Given the automatic deletion of evaluation data within 20 minutes, in practice no such data persists beyond this period; a request to exercise these rights over evaluation data can therefore only be acted upon while the data still exists.
To exercise your rights, you may contact the data controller at the address indicated in article 1. You also have the right to lodge a complaint with the CNIL (Commission Nationale de l'Informatique et des Libertés — www.cnil.fr).
9. Changes to this privacy policy
The publisher reserves the right to modify this privacy policy at any time in order to adapt it to developments of the Site or the regulations. The applicable version is the one in force at the time of your visit.
10. Contact
Centre for Innovation in Cancer of Lyon (CICLY)
UFR Faculté de Médecine Lyon-Sud Charles Mérieux – BP12
165 chemin du Grand Revoyet, 69921 OULLINS Cedex, France
URL: https://www.laboratoire-cicly.fr/
Contact: https://www.laboratoire-cicly.fr/contact/
