CadSmile Privacy Policy
Last updated: May 26, 2026
CadSmile attaches the greatest importance to the protection of its customers' and prospects' personal data and to compliance with current regulations.
This privacy policy informs you of our commitments and the measures we have put in place to guarantee the integrity, security, confidentiality, and protection of your personal data, processed within the framework of our activity, in compliance with the rules provided by the European General Data Protection Regulation (GDPR), the French Data Protection Act (Loi Informatique et Libertés - LIL), and the French Digital Economy Act (Loi pour la Confiance dans l'Économie Numérique - LCEN).
The entity that collects and processes your personal data is CadSmile, a French simplified joint-stock company (Société par actions simplifiée) with a share capital of 60,000 euros, whose registered office is located at 58 rue de Monceau, 75008 Paris – France, represented by AVR S.A.S., President, represented by its legal representative Alexandre VON RAKOWSKI.
You can contact us at the following address or phone number: admin@cadsmile.ai / +33 7 60 72 91 11.
Personal Data We Process
As part of the processing activities we carry out, CadSmile collects and processes the following categories of data:
- Personal identification data (last name, first name, addresses, phone number(s), etc.).
- Professional identification data (last name, first name, job title, email address).
- Professional data (profession, SIRET number, income, etc.).
- Data relating to payment methods (bank details, IBAN, credit card details).
- Sensitive data: health data.
Legal Basis, Purposes, and Retention Periods of Processing
In accordance with the GDPR, the personal data collected by CadSmile will be used to fulfill the purposes for which they were collected and for a retention period detailed in the table below. Once the indicated retention periods have been reached, your data is deleted from all CadSmile servers.
| Purpose | Legal Basis | Retention Period | Data Subjects | Data Categories |
|---|---|---|---|---|
| Practitioner account management (creation, activation, support) | Performance of the contract (Art. 6(1)(b) GDPR) | 5 years after the end of the relationship | Practitioners | Last name, first name, email, telephone, RPPS (national provider identifier), professional address, diplomas, financial data for payment |
| Verification of professional status (RPPS) | Legal obligation | Time necessary for verification | Practitioners | RPPS, last name, first name, email |
| Subscription and payment management | Performance of the contract | 5 years after the end of the contract | Practitioners, freelancers | Financial data, IBAN, bank details |
| Customer support | Performance of the contract / Legitimate interest | 2 years after last contact | Practitioners | Last name, first name, email, telephone, support notes |
| Patient management (integrated databases) | Performance of the contract / Article 9(2) GDPR – health data | Duration necessary for the clinical purpose or study | Patients | Internal ID, last name, first name, images, X-rays, scans, medical notes, prescriptions, anonymized data for studies and AI |
| Free trials and software testing phase | Performance of the contract / Legitimate interest | 2 years after the end of the trial | Practitioners | Email, last name, first name |
| Professional prospecting (marketing) | Legitimate interest (Art. 6(1)(f) GDPR) | 3 years after last contact | Prospects / marketing | Last name, first name, email, telephone, profession, specialty, office address |
| Freelance / collaborator management | Performance of the contract / Legal obligation | 5 years after the end of the relationship | Freelancers / collaborators | Last name, first name, photo, postal address, email, telephone, financial data for remuneration |
| Customer satisfaction management | Legitimate interest | 2 years after last contact | Practitioners | Feedback, questionnaires, notes |
| Accounting archiving and invoices | Legal obligation (Commercial Code) | 10 years from the end of the fiscal year | Practitioners, freelancers | Invoices, financial transactions |
| HR management (contracts, payslips, recruitment) | Legal obligation | 5 years for HR documents / 2 years for unsuccessful applications | Freelancers / collaborators | Contracts, payslips, personal data, financial data |
For more information on the cookies used by CadSmile, please refer to our Cookie Policy.
Mandatory or Optional Nature of Data Collection and Consequences of Failure to Provide Data
When collecting your personal data, we inform you whether certain data is mandatory or optional.
Mandatory data is necessary for the operation of our services and the proper performance of the contract, and it will be indicated to you. If a mandatory data field is not provided, CadSmile will not be able to perform its services.
Optional data is that which you may choose to provide to improve your user experience (e.g., communication preferences). Failure to provide this data will not have any consequence on the performance of the contract or the provision of the service, but it could limit the personalization of our offer.
Recipients of Personal Data
The personal data we process is used only for previously determined purposes, necessary for the realization of our services related to our activity.
The following have access to your personal data:
- CadSmile employees according to defined internal authorization policies.
- Our processors, i.e., all digital or non-digital service providers who process your data for specific purposes: invoicing tools, remote payment software, etc.
- Authorized sub-processors.
- Public bodies and control and authorization bodies at their request or to satisfy our legal obligations, as well as judicial authorities, legal officers in the context of judicial proceedings, ministerial officers, and debt collection agencies.
Your data is also shared with control services (notably statutory auditors).
International Transfers
Some of your data may be transferred to companies outside the European Union or to a country with an adequacy decision.
In this case: when data is transferred to a country whose level of data protection has not been recognized as adequate under the GDPR, these transfers are based on appropriate safeguards indicated in Article 46 of the GDPR, adapted to each service provider, notably through the conclusion of standard contractual clauses approved by the European Commission.
Your Data Rights
Under data protection regulations, you have rights, including:
Right of Access
You have the right to request information about the nature of the processing carried out, the origin or type of data collected, as well as copies of all the information we hold about you.
Right to Rectification
You have the right to request the rectification of information that you believe to be inaccurate. Similarly, you have the right to ask us to complete information that you consider incomplete.
Right to Erasure, Right to be Forgotten
You have the right to ask us to delete your personal data in certain specific situations.
In cases where your data is processed based on your consent or CadSmile's legitimate interest, you have the possibility of obtaining the early deletion of your data. To exercise this right, simply inform us of your wish to withdraw your consent or assert your right to object to the processing of your data.
Apart from the exercise of this right, your data is automatically deleted upon the expiration of the aforementioned retention period.
Right to Restriction
This right offers you the possibility to suspend the processing of your data after having submitted a request for rectification, for example. In the event that you have concerns about the legality of one of our processing activities, this right allows you to ask our teams to stop processing your data, without deleting it. In addition, if you wish to initiate legal action to assert, exercise, or defend your rights, this right also allows you to "freeze" your personal data.
Right to Object
You have the right to object to the processing of your personal data in certain circumstances.
The right to object allows you to refuse to be included in data processing.
The user may object to any processing of their personal data and request its deletion, unless the company can demonstrate a compelling legitimate motive for this processing or this processing is necessary for the establishment, exercise, or defense of legal claims.
Regarding direct marketing solicitations that the user receives from CadSmile, it is possible for the user to withdraw the consent they have given in order to no longer receive solicitations.
This right is exercisable at any time and will be reminded to them in the messages they receive from CadSmile.
Right to Data Portability
This right gives you the possibility to request access to your personal data, provided that this data is subject to processing based on your consent or within the framework of a contractual relationship. This data will be provided to you in a technically usable format, whether by yourself or by an entity other than CadSmile.
How to Exercise Your Rights
To exercise your rights, please visit the following page: https://monexpertrgpd.com/exercice-des-droits/?client=Cadsmile
For any questions relating to the protection of personal data, you can contact our Data Protection Officer (DPO):
- Name: Mon Expert RGPD
- Email: conformite@monexpertrgpd.com
Filing a Complaint with the CNIL
If you believe, after having contacted us, that your data rights are not being respected, you can file a complaint with the CNIL.
Effective Date
We reserve the right to modify this policy at any time, in whole or in part.
This version of the CadSmile privacy policy came into effect on May 26, 2026.