Patient information

Waiv and its partners are using pseudonymized and/or de-identified data for their own research projects, especially involving AI technologies. Examples of their research projects include:

• developing precision tests and diagnostics to improve how diseases are diagnosed or predicted.
• identifying new biomarkers or new targets that could lead to new treatments.

When conducting its research project, Waiv and its partners only used patient data which is strictly necessary and always processed it securely as described on this page.

When conducting its research project, Waiv and its partners, both acting as independent controllers, commit to the following:

Non-direct identifying information

Waiv and its partners only use patient’s personal data that has been pseudonymized or de-identified before they access it. Except for specific cases, like quality control as allowed by applicable laws and regulations, Waiv and its partners never access information that could directly identify the patients. Each patient’s data is assigned a code, and only Waiv Network members who provide the data keep a record linking this code to the patient’s identity in their own healthcare databases. As a result, the data shared with Waiv and its partners does not contain any information that could directly reveal a patient’s identity.

Data privacy compliance

Waiv and its partners are committed to processing personal data — especially sensitive information like health data — in line with all applicable laws and regulations. Because Waiv is a French based company, it follows French data protection laws, which are among the strictest in the European Union when it comes to protecting individuals’ rights.

International transfer of data

Waiv uses cloud service providers with servers located in the same region as the region as its research partners providing access to the data is established. For example, data from European centers is stored in Europe by providers certified under the French health data hosting standard (HDS), while data from North Americans centers is mainly stored in North America.

Furthermore, when technically possible, Waiv encourages the processing of European citizens’ data by its employees, affiliates, partners and service providers, located in the European Economic Area. However, if for the needs of their research activities, Waiv and/or its partners has to transfer data of European patients (including British and/or Switzerland), to partners, service providers and/or Waiv’s affiliates established outside of Europe, Waiv will ensure that adequate and appropriate safeguards are implemented, as required by the GDPR, the UK Data Protection Act and the Swiss Data Protection Act when applicable. For example, this could be done by entering into standard contractual clauses approved by the European Commission, as well as the specific clauses approved by the UK Information Commissioner Office and/or the Swiss Federal Data Protection and Information Commissioner when applicable. For more detailed information on the safeguards, patients can contact Owkin’s data protection officer with the details provided below.

Ethical and scientific validation

Waiv and its partners ensure their research projects are aligned with the relevant ethical and scientific standards. When required by the applicable laws and regulations, the scientific protocols are evaluated by local ethical committees.

Privacy by design

As part of its research activities, Waiv adheres to the “Privacy by Design” principle from the earliest stages of its technologies development. Aware of the sensitive nature of personal data - particularly health data - Waiv adopts a proactive approach to ensure that privacy protection is embedded throughout the entire lifecycle of its technologies, from design to deployment. Data processing is limited to what is strictly necessary, secured through robust technical and organizational measures (such as encryption, pseudonymization, and access control), and supported by clear and transparent documentation. This approach ensures sustained compliance with the GDPR while reinforcing the trust of healthcare professionals and patients alike.

Patients whose data is processed by Waiv and/or its partners are free to object to the processing of their data in any research projects conducted by Waiv and/or its partners. At any time and upon simple request, patient may (i) have access to their data processed by Waiv and/or its partners; (ii) obtain a copy of their data; (iii) obtain the correction of inaccurate or incomplete data concerning them; (iv) obtain the deletion of their data; (v) object to and/or request the restriction of the processing of their data.

Each patient may, at any time, exercise its rights by contacting Waiv’s data protection officer at the following address (request must be accompanied by valid proof of identity and the name of the healthcare center where the patient has been treated):

• By post: to the attention of the Waiv Data Protection Officer, 14-16 Boulevard Poissonnière, 75009, Paris France;
• By email: dpo@owkin.com.

Some research projects entail the training or validation of artificial intelligence tools or the questioning of patient databases to provide scientific outputs (e.g. agentic AI, foundation models…). Patients should be informed that, once their data has been used for training and validation, their ability to exercise certain data protection rights may be limited due to technical grounds. In addition, certain data collected in advance may not be deleted if such deletion is likely to make it impossible or seriously compromise the achievement of the research projects’ objectives.

Patients can find further information in the general patient information notice that can be downloaded here.