Patient Information

PulsHeart is a company developing non-invasive medical systems with the objective of assessing the risk of sudden cardiac death. PulsHeart has partnerships with clinical research teams specializing in the study of cardiac rhythm disorders.

During your participation in clinical studies carried out within your healthcare facility, personal data was collected in a confidential and secure manner. This data may be reused for the purposes of other subsequent research, unless you object.

Their analysis is carried out confidentially through coding, without any mention of your first and last name, together with the data of other patients, enabling research to be conducted on the data. This research complies with a CNIL reference methodology. In the event of non-compliance, a request for authorization would be submitted by PulsHeart. This research helps improve patient care and develop new medical devices that could assist physicians in better stratifying the risk of sudden cardiac death.

Confidentiality and Data Protection

How will your personal data be processed in the context of the research?

If you do not object to participating in these studies, your personal data, including your health data, will be subject to processing (operations on the data) by the sponsor (PulsHeart), acting as the data controller for this data.

The data collected includes, for example, demographic data, electrophysiological recordings, mapping recordings obtained during invasive electrophysiological explorations of the heart, the physiological data derived from these recordings, as well as the diagnosis established by the physician.

PulsHeart undertakes to collect only data that is relevant, adequate, and limited to what is necessary in relation to the purposes for which it will be processed.

Your contact details (email / postal address / mobile phone number) may be used by the clinical department of your healthcare facility in order to inform you individually about the objective of the ongoing study and to enable you to exercise your rights.

What is the legal basis and purpose of processing your personal data?

The processing of your personal data is based on the legitimate interests pursued by the sponsor (PulsHeart), with the legal basis being Article 6 of the General Data Protection Regulation (GDPR): processing is necessary for the purposes of the legitimate interests (Article 6.1.f of the GDPR).

This processing is authorized because it is necessary for scientific research purposes, under Article 9 of the GDPR, thereby allowing the data controller to process, on an exceptional basis, special categories of data, including health data.

The data controller implements appropriate measures to safeguard your rights and freedoms, in particular by collecting only the data strictly necessary for the research.

How will the confidentiality of your data be ensured?

Your personal data will be processed confidentially, in accordance with the amended French Act of 6 January 1978 known as the “Data Protection Act” (Loi Informatique et Libertés), and in accordance with the General Data Protection Regulation (GDPR). Your data such as email, postal address, or phone number will be stored separately from your health data in order to allow the sending and tracking of the information notice by dedicated personnel (clinical staff of your healthcare facility). The sponsor, PulsHeart, will not have access to this information.

Your health data will be coded, meaning that you will be identified by a code number for the purposes of the research, without any mention of your first and last name. Only your healthcare facility will keep the list matching the code to your name.

How long is your data kept?

Your coded data will be stored in the information systems by the sponsor, at the latest until two years after the final publication of the research results or, in the absence of publication, until the signing of the final research report.

It will then be archived on paper or electronic media with restricted access for a period in accordance with the regulations in force. This may last up to 20 years.

Who will have access to your data in the context of the research?

Access to your data takes place under the responsibility of the data controller, namely the sponsor (PulsHeart).

Information concerning your identity (first name, last name) will be known only to the clinical team of your healthcare facility that provided your care, as well as to the persons carrying out the quality control of the research mandated by the sponsor, the health or supervisory authorities, and the sponsor’s data protection officer if you contact them (dpo@pulsheart-medical.com).

These persons are bound by professional secrecy.

Your coded data (stripped of all identifying information) will be accessible to:

• The PulsHeart team in charge of developing the algorithms;
• The electrophysiologists (EPs), whether employed by PulsHeart or external, who will be responsible for analyzing the data from your electrophysiological recordings in order to validate the algorithms.

Furthermore, the EPs cannot make a copy of your Personal Data; they can only view it in order to carry out their reviews. You may exercise your rights and request a copy of the measures taken by contacting the Data Protection Officer, who can be reached at dpo@pulsheart-medical.com.

All persons who may access your Personal Data are bound by a confidentiality clause and by professional secrecy. They will have access to your coded data (with no possibility of tracing back to your identity) within the scope of their duties and in compliance with the regulations.

What are your rights regarding your personal data?

In accordance with the GDPR and the French Data Protection Act (Act No. 78-17 of 6 January, and the laws amending it), you have a right of access, rectification, and erasure of your data, a right to restrict the processing of your data, and the right to object to such processing.

You may object to participating in the study at any time using the contact details below. If you object, any study data collected before that date may still be communicated to the study Sponsor and used by it under the conditions provided for by the research, in accordance with Article L. 1121-1-1 of the French Public Health Code. However, from that date onward, no additional data will be collected as part of the study. If you make a specific request for the erasure of your data, the data controller may decline to act on this request, as doing so is likely to render impossible or seriously impair the achievement of the objectives of the scientific research (Article 17.3.d of the GDPR).

You may also access your medical data in full, either directly or through your healthcare facility, in accordance with the regulations in force, by contacting it using the details below.

How to exercise your rights?

You may exercise your rights at any time and without having to provide justification.

Since the sponsor does not have access to your identity, it is recommended that you first contact the investigating center, that is, your healthcare facility in charge of implementing the clinical study.

In addition, if you wish, you may exercise your rights with the sponsor’s data protection officer (dpo@pulsheart-medical.com), who will handle this request in coordination with your healthcare facility, the coordinating physician, and the professionals involved in the study. In this case, your identity (first name, last name) will be made accessible to the sponsor’s data protection officer.

You also have the right to lodge a complaint regarding the processing of your personal data with the French Data Protection Authority (CNIL), which is the competent supervisory authority in France for data protection, by writing to 3 Place de Fontenoy – TSA 80715 – 75334 PARIS CEDEX 07, or online at: https://www.cnil.fr/fr/webform/nous-contacter.

May your coded data be reused?

You may accept or refuse the principle of using your coded data in subsequent research, conducted exclusively for scientific purposes in the field of developing algorithms for the stratification of sudden cardiac death risk.

If you accept this principle, without objecting to it, you will be contacted again to be informed of the characteristics of the new processing operation(s) in accordance with Article 14 of the GDPR, and your coded data may be reused as part of new research studies relating to sudden cardiac death.

List of Ongoing Data Studies Conducted by PulsHeart