Privacy policy

1.1 Data controller. The Belgian Society of Medical Oncology – BSMO vzw / Belgische Vereniging voor Medische Oncologie / Société Belge d’Oncologie Médicale (“BSMO”, “we”, “us”) is the controller for the processing described in this Policy.

• Registered office: Nijverheidsstraat 24 / Rue de l’Industrie 24, 1040 Brussels, Belgium
• Enterprise / VAT number: BE 0836.381.708
• Email: administration@bsmo.be
• Telephone: +32 (0)486 88 88 88

1.2 Processor. The Platform and its search engine are operated on BSMO’s behalf by Esperity bv (“Esperity”), acting as a processor under a data-processing agreement with BSMO.

• Registered office: Boulevard Brand Whitlock 108, 1200 Woluwe-Saint-Lambert, Brussels, Belgium
• VAT number: BE 0848.466.027 (RPR Brussels)
• Contact: info@esperity.com

The Platform helps healthcare professionals identify potentially relevant oncology clinical trials. A user can search in three ways: (a) by clicking one or more cancer categories or filters, (b) by pasting free text describing a clinical situation, or (c) by uploading a medical report. For (b) and (c), the browser processes the input locally, removes direct identifiers, and extracts the medical criteria needed to run a search (for example: tumour type, stage, biomarkers, prior treatments, age range). Those extracted criteria are then matched against a clinical trial database and the results are displayed to the user.

3.1 Patient medical information you enter or upload. Any text you paste or file you upload is processed exclusively within your browser. The Platform is built so that this raw content, and any patient identifiers it may contain, is not transmitted to our servers or to Esperity. Only the de-identified medical criteria extracted on your device are sent to the search engine in order to return trial results. We do not ask for, and the Platform is not intended to receive, patient names, national registry numbers, dates of birth, contact details or any other direct identifier.

Because only anonymized medical criteria reach the search engine, that transmitted information is not intended to identify any individual. You remain responsible for ensuring that the material you provide does not contain unnecessary identifiers before use (see the Terms of Use). If you are able to identify a specific patient from the data you handle, that processing takes place on your device and under your own professional and legal responsibility as the treating clinician.

3.2 Technical and usage data. Like most websites, the Platform automatically processes limited technical data when you visit, such as your IP address, device and browser type, language settings, the pages you view, search filters selected, and the date and time of access. This data is used to operate the Platform, keep it secure, diagnose problems and understand aggregate usage.

We do not require you to create an account, and we do not ask for your name, professional title or other identity details in order to run a search. Searches are shown based on the query alone.

3.3 Data you send us voluntarily. If you contact us by email or through a contact form, we process the information you choose to provide (such as your email address and the content of your message) in order to respond.

We process personal data for the following purposes and on the following legal bases under Article 6 GDPR:

• Providing the search functionality and displaying trial results — our legitimate interest (Art. 6(1)(f)) in offering a clinical trial matching service to healthcare professionals, and the performance of our service to you.
• Operating, securing and improving the Platform — our legitimate interest (Art. 6(1)(f)) in maintaining a reliable and secure service.
• Analytics and non-essential cookies — your consent (Art. 6(1)(a)), where required.
• Responding to your enquiries — our legitimate interest (Art. 6(1)(f)) in handling your request.

The extracted medical criteria transmitted to the search engine are de-identified and are not intended to relate to an identifiable person; to that extent they fall outside the material scope of the GDPR. Where any special-category (health) data is momentarily processed in your browser, that local processing is carried out by you, in your professional capacity, under Article 9(2)(h)/(c) GDPR and applicable rules on medical confidentiality.

The Platform uses cookies and similar technologies that are strictly necessary to make it work, and — subject to your consent — may use analytics cookies to measure usage. You can manage non-essential cookies through the cookie banner or your browser settings. A separate Cookie Notice, where used, provides the detailed list.

Access to personal data is limited to people who need it to operate the Platform. Recipients may include:

• Esperity bv, as our processor operating the Platform and search engine;
• hosting, infrastructure and analytics providers acting as sub-processors under contract and only on our instructions;
• competent authorities, where we are legally required to disclose data.

We do not sell personal data and we do not use it for advertising.

The Platform is operated within the European Economic Area (EEA). Where any processing involves a transfer of personal data outside the EEA, we ensure an appropriate safeguard is in place, such as an adequacy decision or the European Commission’s Standard Contractual Clauses. You may request a copy of the relevant safeguard using the contact details above.

Raw pasted text and uploaded documents are processed transiently in your browser and are not retained by us. Technical and usage logs are kept only for as long as necessary for security and operational purposes and are then deleted or aggregated. Correspondence is kept for as long as needed to handle your request and to comply with legal obligations.

We and our processor apply appropriate technical and organisational measures to protect personal data, including client-side anonymization so that source documents are not transmitted, encryption of data in transit (HTTPS), access controls, and contractual safeguards with sub-processors. No online service can be guaranteed to be completely secure, but we work to protect the data we handle.

Under the GDPR you have the right to request access to your personal data, and to request rectification, erasure, restriction of processing, or to object to processing, as well as the right to data portability, in each case subject to the conditions in the GDPR. Where processing is based on consent, you may withdraw it at any time without affecting prior processing. To exercise your rights, contact us at administration@bsmo.be.

You also have the right to lodge a complaint with the Belgian Data Protection Authority (Gegevensbeschermingsautoriteit / Autorité de protection des données), Drukpersstraat 35 / Rue de la Presse 35, 1000 Brussels — contact@apd-gba.be, www.dataprotectionauthority.be.

The Platform is intended for use by healthcare professionals and is not directed at children. It should not be used to create accounts or profiles for individuals under 16.

We may update this Policy from time to time. The version and effective date at the top of this document indicate when it was last revised. Material changes will be communicated through the Platform.

For any question about this Policy or about how personal data is handled, contact BSMO at administration@bsmo.be.