Privacy Policy

Updated on March 24, 2025

Purpose of this policy

Qalico is operated by Beavr SAS. Privacy is a fundamental right and one of Qalico's core values.

The company is committed to the security and protection of the personal data of its customers, partners, and employees in compliance with applicable legal provisions.

Data collection occurs when users access www.qalico.com, the app.qalico.com application, or Beavr services. The European Directive 95/46/EC requires personal data be processed lawfully, fairly, and transparently.

This policy aims to inform customers, partners, and employees transparently about personal data processing.

Definitions

Terms relating to data protection follow the General Data Protection Regulation 2016/679 of April 27, 2016:

Data: Personal data processed by Qalico as Data Controller or Data Processor
Site: Website at www.qalico.com
Application: Software platform at app.qalico.com requiring account creation
User: Natural person browsing the Website or using the Application
Service: All services provided via the Application, including AI-powered regulatory intelligence, monitoring, and compliance tools for medical device professionals
Login details: Credentials for accessing app.qalico.com
User Data: Data collected, disseminated, or posted on the Application by users

Data controller

Beavr SAS, a simplified joint stock company with a capital of 24,868.60, registered in the Paris Trade and Companies Register under number 909 074 593, whose registered office is located at 16 rue de Lancry, 75010 Paris, operates Qalico.

Qalico acts as:

Data controller for website browsing and user journey processing
Data processor for account creation, configuration, and Application use on behalf of the Client (user's employer)

In the event of any conflict between this policy and the data protection document provided by the Client, the provisions of the Client's information document shall prevail.

Description of services

Qalico provides its Clients with a software platform and expertise to ensure their compliance with regulatory requirements for medical devices, biotech, and pharmaceutical products.

Services include:

Real-time regulatory monitoring across 150+ authorities worldwide
AI-powered regulatory intelligence and impact assessments
Literature review and post-market surveillance tools

Description of processing and nature of data collected

When acting as processor, Qalico collects data to provide contractually agreed services.

When acting as data controller, collected data includes:

Identification data: Last name, first names, professional email address, company
Connection data: Username, password, IP address, logs

Why and for how long do we collect your data?

Personal data collection occurs for specific purposes based on various legal grounds. Retention periods vary depending on:

Qalico's operational needs
Contractual requirements
Legal obligations
Recommendations from supervisory authorities

Recipients of the data

Data may be shared with:

Qalico employees
Service providers and subcontractors: hosting providers (Vercel, AWS), CRM provider (Attio)
Control services (auditors), public bodies, court officers, and debt collection bodies for legal obligations

Only information that is strictly necessary is shared with third parties outside Qalico.

The company ensures service providers refrain from using data beyond original purposes and maintains confidentiality and security.

We do not sell your data.

Transfer of data to third countries

Your data is stored on the servers of Vercel and AWS in Europe.

Data may be transferred outside the European Union through tools and subcontractor relationships.

Transfers are guaranteed to occur either to countries ensuring adequate protection or governed by standard contractual clauses.

Data retention

We only keep your personal data for as long as necessary to fulfill the purpose for which we hold the data, to meet your needs, or to comply with our legal obligations.

Rights over your data

Users have the following rights:

Right to information: This policy provides transparent information about personal data management
Right of access: Access all personal data at any time
Right of rectification: Rectify inaccurate, incomplete, or obsolete data
Right to restriction: Obtain processing restriction in certain cases
Right to be forgotten: Request deletion and prohibit future collection
Right to lodge a complaint: File complaint with competent supervisory authority (CNIL in France)
Right to define guidelines: Establish guidelines for storage, erasure, and post-death communication of personal data
Right to object: Object to personal data processing (company may continue processing for legitimate reasons or legal defense)

You can exercise these rights by writing to us at the contact details below.

Contact point for personal data processing questions

For questions regarding personal data processing:

Email: etienne@qalico.com
Post: Beavr SAS, 24 rue de Clichy, 75009 Paris

Changes

We may modify this policy at any time, in particular to comply with any regulatory, legal, editorial or technical changes.

Modifications apply on the modified version's entry into force date.

Appendix — Cookie management

A cookie is a small file containing a string of characters that is sent to your computer when you visit a website.

Cookies enable website recognition and retrieval of previously provided information.

Cookie categories

Strictly necessary: Technical cookies for site functioning
Analytics and targeting: Track visitor interests and improve user experience

The cookies enable:

Service functioning (“strictly necessary” cookies)
Anonymous statistics compilation and traffic volume measurement
Site presentation adaptation to device display preferences
Form information storage
Access to reserved account areas with security measures

Users can configure and block cookies directly via browser settings. The CNIL website provides detailed instructions at cnil.fr.

Blocking “strictly necessary” cookies may significantly limit or even prevent your browsing on the website and access to the Service.