Privacy policy

Preamble

This privacy policy describes how the publisher of the Naturactive Pro site (available at naturactive.pro, hereinafter "the site") collects, processes and protects users' personal data, in accordance with Regulation (EU) 2016/679 of 27 April 2016 (the "GDPR") and French law no. 78-17 of 6 January 1978 as amended.

Data controller

The data controller is Naturactive, a division of Pierre Fabre Médicament. Envalia acts exclusively as a technical processor within the meaning of Article 28 GDPR (development, operation and maintenance of the platform), on the controller's instructions and with no control over the content.

GDPR contact: DPOFR@pierre-fabre.com

Data collected

As part of your use of the site, we collect:

• Identification data: surname, first name, individual e-mail address (it is your login), individual phone number.
• Professional data: the profession you declare at sign-up and, depending on it, your RPPS number (the French national health-professional identifier) and city of practice. These verify that you are a healthcare professional and determine which content is addressed to you.
• Account data: role (access type), affiliated pharmacy where applicable, account status.
• Connection and security data: sign-in timestamps, IP address, browser used, session tokens (technical cookies), account activity log.
• Proof of your consents: for each grant or withdrawal, the date, the IP address it was expressed from, and the version of the text you were shown. These let us demonstrate, as the law requires, that consent was obtained and what it covered — and that we stopped processing as soon as you withdrew it.
• Usage data: pages and content viewed, documents downloaded, searches performed. These feed two separate processes: the anonymous audience measurement described below, which does not identify you, and the security logging attached to your account.
• Engagement-programme data (only if you take part): content read, quizzes taken and scores obtained, points awarded, benefits and invitations sent.

If your account was created by invitation, your work email address was provided to us by the person who invited you (information under Article 14 GDPR). No other data about you is collected from third parties.

We do not collect any health data nor any data relating to end-patients.

Purposes and legal basis for processing

Audience measurement

To understand how the site is used — which pages are read, by which paths, how often — we use Matomo, an audience-measurement tool installed on our own servers. No data is passed to any third-party provider, nothing leaves the European Union, and these measurements are never matched against your account.

This measurement works without a cookie and does not identify you: your IP address is truncated before anything is stored, no account identifier is ever sent with it, and the technical marker that allows a single visit to be reconstructed is reset every day. We therefore cannot recognise you from one visit to the next, build a profile, or follow you across other sites.

Because it meets those conditions, this measurement falls under the consent exemption the CNIL provides for audience measurement — which is why you are shown no cookie banner. Raw data is deleted after 24 months; only aggregated, non-identifying statistics remain beyond that. If your browser sends the “Do Not Track” signal, it is honoured and no measurement takes place.

Engagement programme (points, quizzes and benefits)

When the engagement programme is active and you take part in it, the platform records some of your actions in order to award you points and benefits: first reading of a content item, quiz participation and scores obtained, invitations sent, daily sign-ins.

This data is used exclusively to run the programme. Your ranking is visible to you alone: no individual name, score or rank is ever published or shared with other users, with your employer or with the brand's teams — only aggregated, anonymised statistics are used.

Taking part in the programme is optional: you can turn it off at any time from your profile. Recording of your actions then stops immediately and you keep full access to the service's standard documentation; only programme-specific benefits (exclusive content, early access) are reserved for participants.

Data recipients

Your data is accessible to authorised teams at Naturactive responsible for the platform, and to Envalia, the technical processor in charge of development, operation and maintenance. Other technical sub-processors (site hosting, transactional email delivery) act on the controller's instructions; all are bound by a contract compliant with Article 28 GDPR.

To support you in using the platform, your Naturactive representative in charge of your area will be informed of your registration and will receive your first name, last name and the details of the point of sale you designated.

Your data is not sold nor transferred to third parties for commercial purposes. No individual reading, score or ranking data is shared with your employer.

Your data is hosted in the European Union and is not transferred outside the EU.

Retention period

• Account data: for the entire active period of the account, then deleted or anonymised no later than 2 years after your last sign-in.
• Connection data and technical logs: 12 months maximum (CNIL logging recommendation).
• Engagement-programme data: anonymised no later than 24 months after being recorded (aggregated, non-identifying statistics may be kept).
• Audience measurement: raw data deleted after 24 months; only aggregated, non-identifying statistics are kept beyond that.
• Consent proof: kept for as long as the account exists, then deleted with it (it does not outlive the account).
• Support data and access requests: 3 years from the last contact.

Your rights

In accordance with the GDPR, you have the following rights at all times:

• Right of access to your personal data.
• Right to rectification of inaccurate data.
• Right to erasure ("right to be forgotten").
• Right to portability of your data in a readable format.
• Right to restriction of processing.
• Right to object to processing.
• Right to withdraw consent at any time, where processing is based on consent.

Several of these rights are directly available from your "My account" space (data download, deletion request).

For any other request, contact the data protection officer at DPOFR@pierre-fabre.com. You also have the right to lodge a complaint with the CNIL (cnil.fr).

Security

We implement appropriate technical and organisational measures to protect your data against unauthorised access, alteration, disclosure or destruction: encrypted communications (HTTPS), authentication via short-lived tokens, role-based access controls, administrator-access logging, regular backups.

Cookies

The use of cookies is detailed on our dedicated page.

Changes to this policy

This policy may evolve to reflect legal, technical or organisational changes. The last-updated date appears at the top of the page. We encourage you to review it regularly.