Last updated: 23 September 2026
This policy explains what personal data GALEON collects when you visit its websites, why, how long it keeps it, who it shares it with and how to exercise your rights. It covers www.galeon.care, its subdomains and galeon.io (campaign pages and calculator).
It does not cover the Galeon Electronic Health Record. Health data processed in the software is processed on behalf of healthcare institutions, on HDS and ISO 27001 certified infrastructure, under their contracts. Our websites never ask you for health data: please do not enter any in our forms.
GALEON, a French SAS with a share capital of €25,000, registered with the Créteil Trade and Companies Register under number 821 546 835, head office at 5 avenue du Pré Félin, 74940 Annecy, France.
Data Protection Officer: Erwan Lefebvre — dpo@galeon.care.
We only collect what you send us yourself, and what your browser technically sends when you visit the site.
| Situation | Data | Purpose | Legal basis | Retention |
|---|---|---|---|---|
| Demo or contact request, guide or white paper download | First and last name, business e-mail, phone, institution, job title, country, message | Answer your request, get back to you, follow up the business relationship | Pre-contractual steps at your request; legitimate interest in reaching professionals | 3 years from our last exchange |
| Return-on-investment calculator | The same, plus the figures you enter and the simulation result | Send you your report and discuss it with you | Pre-contractual steps at your request | 3 years from our last exchange |
| Newsletter sign-up | Send you our news | Your consent | Until you unsubscribe; the address is then kept on a suppression list so we never write to you again | |
| Protecting forms against bots | IP address, technical browser characteristics | Block spam and automated submissions | Legitimate interest in securing the site | For the duration of the check; nothing is stored by us |
| Visiting the site | IP address, date and time, pages requested, browser (server logs) | Run the site, secure it, diagnose failures | Legitimate interest in securing the site | 12 months at most |
| Audience measurement and advertising | See section 3 | See section 3 | Your consent | 13 months at most |
| Exercising your rights | Your request and the related correspondence | Answer it and be able to prove it | Legal obligation | As long as needed to handle it, then the applicable limitation period |
You can object at any time to receiving our marketing messages: each one contains an unsubscribe link, and an e-mail to dpo@galeon.care is enough.
On your first visit, a banner lets you accept all, reject all or choose by purpose. No audience measurement or advertising cookie is set until you consent, and rejecting is as easy as accepting. You can change your mind at any time using the “Cookies” link at the bottom of every page; withdrawing consent deletes these tools’ cookies on our domain.
Your choice is kept for 6 months, after which the banner is shown again. Cookies from the tools below last 13 months at most.
| Category | Tool (provider) | Role | When it is set |
|---|---|---|---|
| Strictly necessary | galeon_consent cookie (GALEON) | Remember your choice | Always, without consent: it is required to respect your choice |
| Strictly necessary | Cloudflare Turnstile (Cloudflare) | Protect forms against bots | Only when a form is used |
| Audience measurement | Google Analytics (Google) | Traffic statistics | After consent |
| Audience measurement | Microsoft Clarity (Microsoft) | Understand navigation (clicks, scrolling) to improve pages | After consent |
| Audience measurement | Galeon A/B tests (Galeon in-house tool) | Test page variants | After consent |
| Advertising | Google Tag Manager, Google Ads (Google) | Measure our campaigns, targeted advertising | After consent |
| Advertising | Meta Pixel (Meta) | Measure our campaigns, targeted advertising | After consent |
| Advertising | LinkedIn Insight Tag (LinkedIn) | Measure our campaigns, targeted advertising | After consent |
| Advertising | TikTok Pixel (TikTok) | Measure our campaigns, targeted advertising | After consent |
| Advertising | X Pixel (X Corp.) | Measure our campaigns, targeted advertising | After consent |
| Advertising | Reddit Pixel (Reddit) | Measure our campaigns, targeted advertising | After consent |
| Advertising | ChatGPT Ads Pixel (OpenAI) | Measure our campaigns | After consent |
| Advertising | Pharow (Pharow) | Identify the company a visit comes from, based on the IP address | After consent |
For their own advertising processing, these providers act as controllers: their privacy policies also apply.
Within GALEON, only the sales and marketing teams access the requests relevant to them. We do not sell your data.
We use service providers who are contractually bound to process your data only on our instructions and to protect it:
We may also be required to disclose data to a judicial or administrative authority where the law requires it.
Some providers (including Google, Microsoft, Meta, LinkedIn, Cloudflare, OpenAI, X, Reddit, TikTok) may process data outside the European Union, notably in the United States. These transfers rely on the EU–US Data Privacy Framework where the provider is certified, or otherwise on the Standard Contractual Clauses adopted by the European Commission. You can obtain a copy of these safeguards by writing to dpo@galeon.care.
You have the right to access, rectify and erase your data, to restrict processing, to data portability, and to object to processing, without giving a reason where marketing is concerned. Where processing is based on your consent, you can withdraw it at any time. Under French law, you can also give instructions on what happens to your data after your death.
To exercise these rights: dpo@galeon.care, or by post to GALEON — Data Protection Officer, 5 avenue du Pré Félin, 74940 Annecy, France. We reply within one month. If we have reasonable doubts about your identity, we may ask you for proof.
If you believe your rights are not respected, you can lodge a complaint with the French data protection authority, the CNIL, 3 place de Fontenoy, TSA 80715, 75334 Paris Cedex 07, France, www.cnil.fr, or with the authority of your country of residence.
The site is served over HTTPS, on infrastructure audited and certified HDS and ISO 27001. Access to the requests we receive is limited to the people who need it.
No mobile information will be shared with third parties or affiliates for marketing or promotional purposes, and your consent to receive text messages is not shared with any third party.
We may update this policy, for example if we change tools. The date of the last update is shown at the top of the page; for any significant change, we will let you know on the site.