Last updated: April 15, 2026
THERA SOFT SAS (hereinafter "the Publisher"), as the publisher of the R-PACS software, acts as a data processor within the meaning of Article 28 of Regulation (EU) 2016/679 (GDPR) for the processing of health data. The healthcare facility or healthcare professional using the Software (hereinafter "the Data Controller") retains the status of data controller within the meaning of Article 4 of the GDPR.
For any question relating to the protection of personal data, you may contact the Publisher by email at the address indicated in your license agreement, or by postal mail to the registered office of THERA SOFT SAS.
In the context of using the R-PACS Software, the following categories of data are processed:
User identification data: last name, first name, professional email address, role within the organization, connection logs (IP address, timestamp, user-agent). Legal basis: performance of the license contract (Article 6.1.b GDPR) and legitimate interest of security (Article 6.1.f GDPR).
Patient health data: patient identifiers (IPP, INS, DICOM identifiers), demographic data (name, first name, date of birth, sex, address), DICOM medical images (X-rays, CT scans, MRI, ultrasounds), examination reports and associated metadata, history of stays and examination requests. Legal basis: vital interest (Article 6.1.d GDPR) and public interest mission in the field of health (Article 9.2.h GDPR), under the responsibility of the Data Controller.
Technical and logging data: image access traces (DICOM audit trail), system logs for maintenance and troubleshooting, DICOM transfer performance metrics. Legal basis: legitimate interest of the Publisher for maintenance, security and improvement of the Software (Article 6.1.f GDPR) and legal obligation of traceability of access to health data (Article L.1110-4-1 of the French Public Health Code).
Data is processed for the following purposes: (a) archiving and retrieval of medical images in accordance with legal obligations for medical record retention; (b) making images available to authorized healthcare professionals as part of patient care; (c) interoperability with hospital information systems (HL7, DICOMweb); (d) traceability of access in accordance with regulatory requirements; (e) technical maintenance and continuous improvement of the Software.
No processing of data for commercial, advertising, profiling or research purposes is carried out by the Publisher without the prior and informed consent of the Data Controller and the data subjects.
Health data (DICOM images, patient records) is retained for the period determined by the Data Controller, in accordance with the legal obligations for medical record retention provided by Article R.1112-7 of the French Public Health Code (twenty years from the patient's last visit for public healthcare facilities, or according to the facility's policy for other structures).
User identification data is retained for the duration of the contractual relationship and deleted within six (6) months after the termination of the license agreement.
Access logs (audit trail) are retained for a minimum of six (6) months and a maximum of five (5) years, in accordance with CNIL recommendations and HDS certification requirements.
Health data is accessible exclusively to healthcare professionals authorized by the Data Controller, within the limits of permissions defined by role (radiologist, technologist, secretary, etc.). The Software implements role-based access control (RBAC) in accordance with the principle of least privilege.
The Publisher, as a data processor, may access data strictly within the framework of technical maintenance and support, in accordance with the provisions of the data processing agreement (Article 28 GDPR). No transfer of data outside the European Union is carried out, unless previously agreed in writing by the Data Controller and appropriate safeguards are in place (European Commission standard contractual clauses).
In accordance with Articles 15 to 22 of the GDPR and Articles 48 to 56 of the French Data Protection Act, every data subject has the following rights. These rights must be exercised with the Data Controller (the healthcare facility or healthcare professional using the Software), not with the Publisher in its capacity as data processor. The Publisher will assist the Data Controller in handling such requests in accordance with Article 28.3.e of the GDPR:
Right of access (Article 15 GDPR): obtain confirmation that data concerning them is being processed and receive a copy thereof.
Right to rectification (Article 16 GDPR): have inaccurate or incomplete data corrected.
Right to erasure (Article 17 GDPR): request the deletion of data. This right is limited by Article 17.3.b of the GDPR (public interest in the area of public health) and by Article R.1112-7 of the French Public Health Code which mandates retention of medical records for twenty (20) years from the patient's last visit.
Right to restriction of processing (Article 18 GDPR): obtain the restriction of processing in cases provided for by the Regulation.
Right to data portability (Article 20 GDPR): receive the data provided in a structured, commonly used and machine-readable format, and transmit it to another data controller.
Right to object (Article 21 GDPR): object to processing based on legitimate interest, subject to the compelling legitimate grounds of the data controller, in particular the legal obligation to retain medical records.
Right to lodge a complaint with the CNIL (Commission Nationale de l'Informatique et des Libertes, www.cnil.fr) or with the relevant data protection authority in the data subject's country of residence.
The Publisher implements appropriate technical and organizational measures to ensure a level of security appropriate to the risk, in accordance with Article 32 of the GDPR, including: encryption of communications (TLS 1.2+); JWT token authentication with httpOnly cookies and automatic rotation; role-based access control with the principle of least privilege; comprehensive logging of access to health data (audit trail); encrypted backups and business continuity plans; multi-tenant isolation by organization; password hashing using Argon2id.
In the event of a personal data breach, the Publisher undertakes to notify the Data Controller without undue delay and no later than 72 hours after becoming aware of the breach, in accordance with Article 33 of the GDPR.
The Publisher undertakes not to engage any other sub-processor for the processing of health data without the prior written authorization of the Data Controller, in accordance with Article 28.2 of the GDPR.
A data processing agreement in accordance with Article 28.3 of the GDPR is concluded between the Publisher and the Data Controller, detailing the processing instructions, security measures and obligations of each party.
Given the nature of the data processed (health data), the Data Controller is invited to carry out a Data Protection Impact Assessment (DPIA) in accordance with Article 35 of the GDPR. The Publisher undertakes to provide the Data Controller with all information necessary for carrying out this assessment.
This privacy policy is governed by French law and Regulation (EU) 2016/679 (GDPR). In case of conflict between national and European provisions, the provisions most protective of data subjects' rights shall prevail.
Any complaint or dispute relating to the protection of personal data may be brought before the CNIL or before the competent courts of the registered office of the Publisher.
THERA SOFT SAS — Publisher of R-PACS software. Personal data protection in compliance with GDPR and the French Public Health Code.