Privacy Policy

Last updated: 7 November 2026

AI4Hospitals.org ("AI4Hospitals", "we", "us") is an independent, non-commercial knowledge platform about artificial intelligence in hospitals, based in Brussels, Belgium. This policy explains which personal data we collect when you use this website, why, and what rights you have. It is written to comply with the EU General Data Protection Regulation (GDPR, Regulation (EU) 2016/679) and the Belgian Act of 30 July 2018 on the protection of natural persons with regard to the processing of personal data.

We do not collect or publish any patient data. Please never send us patient information, medical images or any data that could identify a patient.

1. Who is responsible for your data

The data controller is AI4Hospitals.org, Brussels, Belgium.
Contact for all privacy questions: hello@ai4hospitals.org

2. What data we collect and why

2.1 Newsletter

Data: your email address, the date and time of your subscription, and the consent box you ticked (proof of consent).
Purpose: to send you the AI4Hospitals newsletter and news about the project.
Legal basis: your consent (GDPR art. 6(1)(a)). You can withdraw it at any time by writing to us or by using the unsubscribe link in our emails.
Storage: your subscription is stored in our website database. A notification with your email address is also sent to our mailbox so that we can manage subscriptions. When we start sending newsletters by email, your address will be transferred to an email sending service bound by a data processing agreement, and this policy will be updated before that happens.
Retention: until you unsubscribe. After that, we keep only your email address in a suppression list, so that you are not contacted again, and the proof of your consent for 3 years.

2.2 Community membership and contributions

Data: the information you enter in the membership or contribution form (name, email, organisation, role, message, any declared links with vendors).
Purpose: to manage your membership, review contributions to the directory, and contact you about them.
Legal basis: your consent (GDPR art. 6(1)(a)) and our legitimate interest in maintaining an independent, well-sourced directory (art. 6(1)(f)).
Retention: for as long as you are a member, then 12 months. Published contributions stay online with your name only if you agreed to be credited.

2.3 Contact by email

Data: your email address and the content of your message.
Purpose: to answer you, including corrections requested by vendors or authors (right of reply).
Legal basis: our legitimate interest in answering requests (art. 6(1)(f)).
Retention: 24 months after the last exchange.

2.4 Website operation and security

Data: technical data automatically recorded by the web server (IP address, date and time, page requested, browser type).
Purpose: to run the website, keep it secure and detect abuse.
Legal basis: our legitimate interest in the security of the website (art. 6(1)(f)).
Retention: 12 months maximum.

We do not use audience measurement or advertising tools. We do not sell your data and we do not make automated decisions about you.

3. Who receives your data

Your data is only accessible to the AI4Hospitals team and to the service providers below, who act on our instructions under a data processing agreement:

Website hosting: our web hosting provider, which stores the website, the newsletter subscriptions and the server logs.
Email hosting: OVHcloud (France), which hosts our mailbox hello@ai4hospitals.org, including subscription notifications and messages you send us.
Membership form: Google Forms (Google Ireland Ltd, with possible processing by Google LLC in the United States).
Website translation: Weglot (France), which processes the content of our pages to translate them, not your personal data.

When a provider processes data outside the European Economic Area (for example in the United States), the transfer is covered by an adequacy decision (such as the EU-US Data Privacy Framework, for certified companies) or by the European Commission's standard contractual clauses.

4. Cookies

This website does not use audience measurement or advertising cookies. It only uses the technical cookies strictly necessary for it to work, which do not require your consent. If we ever add other cookies, we will ask for your consent first and update this policy.

5. Links to other websites

Our pages link to external sources (studies, regulatory databases, vendor websites) and to our community on Reddit (r/AI4Hospitals). Those websites have their own privacy policies, and we are not responsible for them. When you post on Reddit, LinkedIn or X, your data is processed by those platforms under their own terms.

6. Security

We protect your data with appropriate technical and organisational measures, including encrypted connections (HTTPS), multi-factor authentication on administrator accounts, regular software updates, restricted access and tested backups.

7. Your rights

Under the GDPR, you have the right to:

access your data and obtain a copy;
have inaccurate data corrected;
have your data erased;
restrict the processing of your data;
receive your data in a portable format;
object to processing based on our legitimate interest;
withdraw your consent at any time, without affecting processing carried out before the withdrawal.

To exercise these rights, write to hello@ai4hospitals.org. We answer within one month. We may ask you to prove your identity if there is reasonable doubt.

8. Complaints

If you think your data is not handled correctly, please contact us first. You also have the right to lodge a complaint with the Belgian Data Protection Authority (Autorité de protection des données / Gegevensbeschermingsautoriteit, APD/GBA): www.dataprotectionauthority.be.

9. Changes to this policy

We may update this policy, for example when we add a new tool. The date at the top of this page shows the latest version. If a change affects how we use your email address, we will tell newsletter subscribers in advance.