Privacy Policy

1. Introduction 

MEDSPACE is the digital community and collaboration platform of the MEDViEW project, funded by the European Union under the Horizon Europe programme under Grant Agreement No. 101217136.

MEDSPACE provides public access to MEDViEW information, project results, learning resources, publications, news, events and community content. Visitors may access publicly available material without creating an account. Registered users may create a profile, join communities and, depending on their assigned role, publish or interact with content.

NETCOMPANY SA, formerly Netcompany-Intrasoft, is responsible for the technical development, hosting, maintenance and administration of MEDSPACE on behalf of the MEDViEW project.

The protection of personal data is important to us. This Privacy Policy explains how personal data are collected and processed through MEDSPACE in accordance with Regulation (EU) 2016/679, the General Data Protection Regulation, hereafter referred to as the “GDPR”, and other applicable data-protection legislation.

This Privacy Policy applies only to the processing of personal data carried out through MEDSPACE.

2. Data Controller

The data controller responsible for determining the purposes and means of processing personal data through MEDSPACE is:

Netcompany S.A. 

Rue Nicolas Bove 2B, 1253, Luxemburg 

Email: information@netcompany.com & ridlux@netcompany.com

Data Protection Officer: privacy@netcompany.com

NETCOMPANY SA acts as data controller for the operation of MEDSPACE.

Where MEDViEW consortium partners jointly determine the purposes and means of specific processing activities, they may act as joint controllers in accordance with Article 26 GDPR. Information concerning the essence of any applicable joint-controller arrangement may be requested using the contact details above.

3. Categories of MEDSPACE users

MEDSPACE may be used by the following categories of users:

• MEDSPACE administrators responsible for the platform’s technical and operational management. 
• Authorized representatives of MEDViEW consortium partners who may publish and manage content related to their activities. 
• Researchers, healthcare professionals, medical practitioners and other registered stakeholders who may create profiles, join communities and contribute comments or other permitted content. 
• Visitors who browse publicly available MEDSPACE content without creating an account. 

The personal data processed depend on the way each user interacts with MEDSPACE and the permissions assigned to their account.

4. Personal Data we process

4.1 Information collected from visitors

When a person visits MEDSPACE without registering, the platform may process:

• IP address
• browser type and version 
• device and operating-system information 
• date and time of access 
• pages visited and actions performed 
• referring website
• cookie identifiers and consent preferences 
• security and technical log information

Additional information may be processed through analytics cookies only where the visitor has provided the required consent.

4.2 Registration and account information

When a user creates a MEDSPACE account, the platform may collect:

• first name and surname
• username
• registration email address
• password in encrypted or hashed form
• user’s website
• organisation, company or institution
• country and post address
• professional role 
• area of expertise
• professional biography
• personal CV
• profile photograph, if voluntarily provided
• research interests/topics and communities of interest 
• account status and assigned user role
• communication and notification preferences
• contact preferences
• personal publications user contributed to (papers, articles etc.)
• comments on MEDSPACE uploaded material 
• registration date and subsequent account activity

The registration form will clearly indicate which information is mandatory and which is optional.

4.3 Profile and community information

Registered users may provide information for their MEDSPACE profile and select the communities or topics they wish to follow. Depending on the platform settings, some profile information may be visible to other users or to the general public.

Optional profile fields should remain private unless the user actively chooses to make them public.

4.4 User-generated content

Depending on their role and permissions, registered users may publish or submit:

• comments and discussion contributions 
• articles and news items
• event information
• publications and learning materials
• documents, images, audiovisual material and external links
• replies and other community interactions 
• information submitted through contact and support forms 

A user’s name, username, profile information and contribution may be displayed publicly together with the date of publication.

Users must not upload personal data relating to another individual unless they have a valid legal basis and the necessary authority to do so.

4.5 Consortium-partner and administrator information

For authorized MEDViEW consortium representatives and MEDSPACE administrators, the platform may additionally process:

• organisation and project role
• content-management permissions
• records of content creation, editing and approval
• administrative actions
• moderation and access logs
• technical-support communications
• account-verification information

4.6 Communications and support requests

When a user contacts the MEDSPACE team, requests technical support or exercises a data-protection right, MEDSPACE may process:

• name and contact information
• account information
• the content of the request
• supporting documents or evidence
• communications exchanged
• measures taken in response to the request

5. Legal basis for processing

MEDSPACE processes personal data only where a valid legal basis exists under Article 6 of the GDPR. The applicable legal bases are as follows:

5.1 Performance of a Contract (Art. 6(1)(b) GDPR)

Processing is based on the necessity to perform a contract to which the user is a party, specifically the MEDSPACE Terms of Use. This applies to:

• The creation and management of user accounts and profiles.
• Providing access to the platform's core functionalities and community services.
• Managing communication and notification preferences.

5.2 Legitimate Interests (Art. 6(1)(f) GDPR)

Processing is based on the legitimate interests of the Data Controller and the MEDViEW project, provided these are not overridden by the user's interests or fundamental rights. This applies to:

• Ensuring the security and technical integrity of the platform.
• Content moderation to prevent abusive, harmful, or unlawful content.
• Preventing fraud, spam, and unauthorized access.
• Basic platform analytics to improve user experience (where such processing does not require separate consent).

5.3 Consent (Art. 6(1)(a) GDPR)

Processing is based on the explicit consent of the user. This applies to:

• The use of non-essential cookies, including analytics, personalisation, and marketing cookies MEDSPACE.
• Subscription to newsletters or optional marketing communications.
• The processing of any special categories of data (e.g., health data) should such a functionality be introduced in the future.

5.4 Legal Obligation (Art. 6(1)(c) GDPR)

Processing is based on the necessity for the Controller to comply with a legal obligation. This applies to:

• The retention of specific data required for audits, financial reporting, or transparency obligations mandated by the European Commission under the Horizon Europe Grant Agreement.
• Responding to lawful requests from competent public authorities or courts.

6. Health and other sensitive Personal Data

MEDSPACE provides information and supports community discussions relating to health, well-being, medical research and healthcare practice. However, MEDSPACE is not intended to collect or publish patient records or identifiable health information.

Users must not disclose through their profile, comments, uploads or community contributions:

• patient names or contact details
• medical records
• identifiable clinical information
• photographs or documents identifying a patient
• genetic or biometric information
• information about another individual’s health without appropriate authority

Users are also advised not to disclose their own detailed health information in publicly accessible areas. Any information published in a public contribution may be viewed, copied or further shared by other internet users.

Where MEDSPACE intends to process health information or another special category of personal data for a specific functionality, users will receive a separate notice before the processing begins. Such processing will take place only where an appropriate legal basis under Articles 6 and 9 GDPR has been identified and the necessary safeguards have been implemented.

7. Public availability of profiles and contributions

MEDSPACE is primarily a publicly accessible platform. Content published by registered users, including comments, articles, uploaded materials and event information, may be accessible to any internet user without registration.

Depending on the profile settings, the user’s name, username, organisation, professional role, photograph and other profile information may appear together with their published contributions.

Public content may:

• appear in search-engine results
• be copied or quoted by third parties
• be shared through social media or other websites 
• remain temporarily available in search-engine caches after deletion from MEDSPACE

Before publishing content, users should ensure that it does not contain confidential information, personal data that should not be made public or material that infringes third-party rights.

MEDSPACE will provide clear information about public visibility before a user publishes a contribution.

8. Content moderation

MEDSPACE may review, restrict, edit, unpublish or remove content where this is necessary to:

• enforce the MEDSPACE Terms of Use or Community Guidelines 
• protect personal data or confidential information
• respond to reports from users or third parties
• prevent unlawful, harmful, misleading or abusive content 
• address copyright or other intellectual-property concerns
• maintain platform security and integrity
• comply with a legal obligation or lawful authority request

Moderation records may include the reported content, the identity of the reporting and reported users where available, the reason for the report, actions taken and related communications.

Where appropriate, users will be informed of moderation decisions affecting their content or account.

9. Cookies and Analytics

MEDSPACE uses cookies and similar technologies to provide essential platform functions, maintain user sessions, remember preferences, protect accounts and understand how the platform is used.

Strictly necessary cookies may be placed without consent where they are required for the platform to function. Analytics, personalisation, marketing and other non-essential cookies will be activated only after the user provides consent, where required by law.

Detailed information concerning the cookies used, their providers, purposes and duration is available in the separate MEDSPACE Cookie Policy. Users may review or change their cookie preferences at any time through the cookie-preference mechanism available on MEDSPACE.

9. Recipients of Personal Data

Personal data may be accessed or received by:

• authorised NETCOMPANY personnel responsible for MEDSPACE development, hosting, security, maintenance and support 
• authorised representatives of the MEDViEW coordinator and consortium partners, where access is necessary for project administration, content management or community activities
• service providers supporting hosting, infrastructure, authentication, email delivery, analytics, backup, security or technical support 
• professional advisers, auditors or evaluators where necessary
• the European Commission or other competent EU bodies where required under the Grant Agreement
• courts, supervisory authorities or public authorities where disclosure is required by law
• other internet users, where profile information or contributions are made publicly available

Service providers acting as processors may process personal data only on documented instructions and under appropriate contractual, confidentiality and security obligations.

MEDViEW consortium partners must not have general access to personal data merely because they are members of the consortium. Access will be limited according to their role and operational responsibilities.

10. International Data transfers

MEDSPACE aims to store and process personal data within the European Economic Area.

Where a service provider processes personal data outside the European Economic Area, the transfer will take place only where an appropriate transfer mechanism is available. This may include an adequacy decision adopted by the European Commission, Standard Contractual Clauses or another safeguard recognised under the GDPR.

Further information about applicable safeguards may be requested using the contact details provided in this Privacy Policy.

11. Retention and deletion

Personal data will be retained only for as long as necessary for the purpose for which they were collected, taking into account the duration of the MEDViEW project, the planned post-project operation of MEDSPACE and any legal, contractual, audit or security obligations.

Unless a different period is required:

• account data will be retained while the account remains active 
• account data will be deleted or anonymised within 6 months after account deletion or prolonged inactivity
• published contributions may remain available after account deletion where necessary to preserve the continuity of a discussion or the integrity of MEDSPACE content, but will be anonymized where appropriate
• support and enquiry records will be retained for 6 months after the request is closed
• moderation and security records will be retained for 6 months, unless they are required for an ongoing investigation or legal claim
• cookie-consent records will be retained for the period necessary to demonstrate compliance
• technical logs will be retained for 6 months
• information required for contractual, financial, audit or legal purposes may be retained for the applicable statutory or contractual period

When personal data are no longer required, they will be securely deleted or anonymized.

12. Security

NETCOMPANY applies appropriate technical and organizational measures to protect personal data against accidental or unlawful destruction, loss, alteration, unauthorized disclosure or access.

These measures include, as appropriate:

• role-based access controls 
• secure authentication 
• encryption during transmission and, where appropriate, at rest 
• password hashing
• logging and monitoring of administrative actions
• regular security updates
• backup and recovery procedures 
• vulnerability and incident management
• confidentiality obligations for authorised personnel 
• periodic review of user permissions

Users are responsible for keeping their login credentials confidential and must notify the MEDSPACE team if they suspect unauthorised access to their account.

No internet-based service can guarantee absolute security. MEDSPACE will nevertheless apply measures proportionate to the nature of the information processed and the risks to users.

13. Automated processing and personalisation

MEDSPACE may recommend communities, learning materials, events or other content based on information such as a user’s selected interests, professional role and previous interactions with the platform.

Unless users are informed otherwise through a separate notice, MEDSPACE does not currently employ Artificial Intelligence (AI) to process personal data, perform profiling or make decisions based solely on automated processing that produce legal effects or similarly significant effects concerning users.

If such processing is introduced in the future, users will be informed about the logic involved, the significance and expected consequences of the processing, and the rights available to them. Moreover, the legal basis and safeguards for such processing will be clearly detailed in an updated version of this policy.

14. User rights

Subject to the conditions and limitations established by the GDPR, users have the right to:

• obtain information about the processing of their personal data
• request access to their personal data
• request correction of inaccurate or incomplete data
• request deletion of their personal data
• request restriction of processing
• object to processing based on legitimate interests
• receive personal data in a structured, commonly used and machine-readable format where the right to data portability applies
• withdraw consent at any time where processing is based on consent
• object to direct-marketing communications
• request human intervention where a decision is based solely on automated processing and produces legal or similarly significant effects
• lodge a complaint with the competent data-protection supervisory authority 

Requests may be submitted to privacy@netcompany.com.

Before responding, MEDSPACE may request reasonable information to verify the identity of the person making the request. Requests will be handled within the time limits established by applicable data-protection law.

Users also have the right to lodge a complaint with the supervisory authority in the country of their habitual residence, place of work or place of the alleged infringement.

For NETCOMPANY SA, the relevant lead supervisory authority should be confirmed as National Commission for Data Protection (https://cnpd.public.lu/en.html).

15. Account deletion

Registered users may request deletion of their MEDSPACE account by:

• using the account-deletion option available in their profile or 
• contacting ridlux@netcompany.com

Account deletion does not necessarily result in the immediate deletion of every contribution. Public comments or materials may be retained where there is a valid reason to preserve the coherence of community discussions, comply with legal obligations or protect legal claims. Where appropriate, retained contributions will be anonymised or disassociated from the deleted account.

The account-deletion interface must clearly explain these consequences before the request is confirmed.

16. Children

MEDSPACE is intended primarily for adult researchers, healthcare and wellbeing professionals, practitioners, representatives of organisations and other adult stakeholders.

Users under the age of 18  are not permitted to create an account. MEDSPACE does not knowingly collect personal data from children below the applicable age threshold.

If we become aware that a child has registered or submitted personal data contrary to this requirement, we will take reasonable steps to delete the account and associated personal data. Concerns may be reported to ridlux@netcompany.com.

17. Third-party websites and embedded services

MEDSPACE may contain links to third-party websites, repositories, social-media platforms, event services or other external resources.

These third parties process personal data according to their own privacy policies. MEDSPACE is not responsible for their privacy practices or content.

Where third-party content is embedded directly in MEDSPACE, such as a video, map or social-media feed, it will not be activated before the required cookie or tracking consent has been obtained, where applicable.

18. Changes to This Privacy Policy

This Privacy Policy may be updated to reflect changes to MEDSPACE functionality, processing activities, legal requirements or project arrangements.

The latest version will always be published on MEDSPACE and will indicate:

• version number
• date of publication
• date of entry into force

Registered users will be informed of material changes through MEDSPACE or by email where appropriate. Where a change requires new consent, users will be asked to provide it before the relevant processing continues.

19. Contact Information

Questions about this Privacy Policy or the processing of personal data through MEDSPACE may be submitted to:

MEDSPACE Privacy Contact

Netcompany S.A.

Rue Nicolas Bove 2B, 1253, Luxemburg 

Email: information@netcompany.com & ridlux@netcompany.com

Data Protection Officer

Email: privacy@netcompany.com

1. Introduction

MEDSPACE is the digital community and collaboration platform of the MEDViEW project, funded by the European Union under the Horizon Europe programme under Grant Agreement No. 101217136.

MEDSPACE uses cookies and similar technologies to operate the platform, maintain secure user sessions, remember user preferences and, where the user has provided consent, collect information about how the platform is used.

This Cookie Policy explains:

• what cookies are
• which cookies and similar technologies MEDSPACE uses
• why they are used
• how long they remain on a user’s device
• when user consent is required and 
• how users can manage or withdraw their cookie preferences

This Cookie Policy should be read together with the MEDSPACE Privacy Policy, which provides further information about the processing of personal data through MEDSPACE.

2. What Are Cookies?

Cookies are small text files stored on a user’s computer, smartphone, tablet or other device when the user visits a website or online platform.

Cookies allow a platform to recognise a user’s device and remember certain information about the user’s visit. For example, cookies may be used to keep a registered user signed in, protect the user’s account, remember language or display preferences, record cookie choices or understand how visitors interact with the platform.

Cookies may contain identifiers or technical information that can constitute personal data when they relate to an identified or identifiable user.

3. Types of Cookies

Cookies may be classified according to their source, duration and purpose.

3.1 First-party and third-party cookies

First-party cookies are placed directly by MEDSPACE and are generally used to provide the platform’s functions.

Third-party cookies are placed by external service providers whose services or content are integrated into MEDSPACE. These may include, where applicable, analytics providers, video-hosting services, social-media platforms or other embedded services.

3.2 Session and persistent cookies

Session cookies remain temporarily on the user’s device and are normally deleted when the browser is closed or the user logs out.

Persistent cookies remain on the device for a defined period or until they are manually deleted. These cookies may be used to remember preferences or record a user’s cookie choices.

3.3 Cookie categories

MEDSPACE may use the following categories of cookies.

Strictly necessary cookies

Strictly necessary cookies are required for the operation, security and basic functionality of MEDSPACE. They may be used to:

• provide access to the platform
• manage registration and login sessions
• authenticate registered users
• maintain account security
• prevent fraudulent or malicious activity
• support load balancing and other technical functions
• remember a user’s cookie-consent choices 

These cookies cannot normally be disabled through the MEDSPACE cookie-preference centre because the platform would not function correctly without them. User consent is not required where a cookie is strictly necessary to provide a service expressly requested by the user.

Preference or functionality cookies

Preference cookies allow MEDSPACE to remember choices made by a user, such as:

• display preferences
• notification preferences
• selected platform features

Where these cookies are not strictly necessary for a service requested by the user, they will be activated only after consent has been provided.

Analytics cookies

Analytics cookies help MEDSPACE understand how visitors and registered users interact with the platform. They may collect information such as:

• pages visited
• time spent on the platform
• links or features used
• general device and browser information
• approximate geographical information 
• technical errors encountered
• navigation paths through MEDSPACE 

The collected information is used to evaluate and improve MEDSPACE’s content, structure, performance and user experience.

Analytics cookies will not be activated unless the user has provided consent. Where possible, MEDSPACE will configure analytics services to minimise data collection, shorten retention periods and limit the identification of individual users.

Personalisation cookies

Personalisation cookies may be used to present content, learning materials, communities or events that are more relevant to a user’s selected interests or previous interactions with MEDSPACE.

These cookies will be used only where this functionality is implemented and the required consent has been obtained.

Marketing and social-media cookies

MEDSPACE does not intend to use cookies for commercial advertising.

However, third-party cookies may be placed where MEDSPACE includes embedded social-media content, sharing tools, videos or similar external services. Such providers may use cookies to recognise users, measure interactions or associate activity with an existing account held with that provider.

These cookies and embedded services will remain disabled until the user provides consent, where required.

4. Cookies used by MEDSPACE

The following table must list every cookie and similar technology used by the production version of MEDSPACE.

MEDSPACE does not currently activate third-party embedded-content cookies. External links may direct users to third-party websites, but those websites operate under their own cookie and privacy policies.

5. Similar technologies

In addition to cookies, MEDSPACE may use similar technologies, including:

• local or session storage
• pixels or tracking tags
• software development kits
• device or session identifiers
• server logs

Where these technologies store information on or access information from a user’s device, they will be treated in the same way as cookies for the purposes of consent and user choice.

Strictly necessary technical logs used to maintain platform security, investigate errors and prevent abuse may be processed without cookie consent where permitted by law. Further information about such processing is available in the MEDSPACE Privacy Policy.

6. Legal basis

Strictly necessary cookies are used on the basis that they are required to provide MEDSPACE functions expressly requested by the user, such as registration, authentication, session management and security.

Preference, analytics, personalisation, social-media and other non-essential cookies are used only after the user provides consent through the MEDSPACE cookie-consent mechanism.

Where cookie information constitutes personal data, its subsequent processing will take place in accordance with the GDPR and the legal bases explained in the MEDSPACE Privacy Policy.

Under the EU ePrivacy framework, storing information on or accessing information from a user’s device normally requires prior consent unless the technology is strictly necessary to provide a service specifically requested by that user. See the ePrivacy Directive, as amended by Directive 2009/136/EC.

7. Cookie consent

When users first visit MEDSPACE, they will be provided with clear information about the cookie categories used and will be able to:

• accept all optional cookies 
• reject all optional cookies or 
• manage their preferences by cookie category 

Rejecting optional cookies must be as easy as accepting them. No optional cookie will be placed before the user gives consent.

Consent will be requested through a clear affirmative action. Continuing to browse MEDSPACE, closing the banner or using pre-selected options will not be treated as valid consent.

The user’s preferences will be recorded for a limited period, after which MEDSPACE may request consent again. Consent may also be requested again if the cookies, providers or purposes materially change.

8. Changing or withdrawing Cookie Preferences

Users may change or withdraw their consent at any time by selecting Cookie Settings in the MEDSPACE footer.

Withdrawing consent does not affect the lawfulness of processing carried out before consent was withdrawn. After withdrawal, MEDSPACE will stop placing the relevant optional cookies. Existing cookies may be deleted automatically where technically possible, or the user may need to delete them through the browser settings.

The cookie-preference center should allow users to review:

• each cookie category 
• the purpose of each category 
• whether the category is active 
• the relevant providers and 
• the option to activate or deactivate each optional category

9. Managing Cookies through browser settings

Most browsers allow users to view, delete or block cookies through their settings. Users may also configure their browser to receive a warning before a cookie is stored.

The method varies depending on the browser and device. Users should consult the help or settings section of their browser for current instructions.

Blocking all cookies may affect the operation of MEDSPACE. In particular, registered users may be unable to sign in, maintain an active session or use functions that depend on strictly necessary cookies.

10. Third-party services

Where a user consents to a third-party service, the relevant provider may process information in accordance with its own privacy and cookie policies.

Before a third-party service is added to MEDSPACE, the following information should be included in this Cookie Policy:

• provider’s legal name
• service provided
• cookies or technologies used
• purposes of processing 
• cookie duration
• privacy-policy link
• whether information is transferred outside the European Economic Area 
• applicable transfer safeguards

Consent to one third-party service should not automatically activate unrelated third-party services.

11. Cookie retention

Cookies will not remain on a user’s device for longer than necessary for their stated purpose.

Session cookies will normally be deleted when the user logs out or closes the browser. Persistent cookies will expire after the period stated in the cookie table unless the user deletes them earlier.

Cookie-consent records may be retained for the period necessary to demonstrate that consent was obtained and to respect the user’s preferences.

12. Changes to this Cookie Policy

This Cookie Policy may be updated where:

• new cookies or technologies are introduced
• the purpose or provider of an existing cookie changes
• a service is removed
• legal or regulatory requirements change
• MEDSPACE functionality is updated 

The latest version will be published on MEDSPACE and will indicate:

• the policy version
• the date of publication and 
• the date of entry into force

Where a change materially affects an existing consent, MEDSPACE will request consent again before the relevant optional cookies are activated.

13. Contact Information

Questions about the use of cookies and similar technologies on MEDSPACE may be submitted to: privacy@netcompany.com

MEDSPACE Privacy Contact

Netcompany S.A.

Rue Nicolas Bove 2B, 1253, Luxemburg 

Email: privacy@netcompany.com

MEDSPACE Technical Support
Email: ridlux@netcompany.com