Privacy policy

MEPA is the Proactive Alliance for Sustainable Healthcare. It is an informal collaborative platform of stakeholders that focuses its activities on criteria for sustainable procurement of medical devices.

This privacy policy (“Privacy Policy”) explains how personal data are collected, processed, shared and protected,  in compliance with the General Data Protection Regulation (GDPR) (EU) 2016/679. This Privacy Policy was  created  on 26 February 2025.

Joint Data controllers

• European Coordination Committee of the Radiological Electromedical and Healthcare Information Technology (IT) Industry, AISBL (hereinafter “COCIR”) is an international non-profit making association with registered office at Boulevard Auguste Reyers 80, Schaerbeek (1030 Brussels).

• HealthTrust Performance Group: 1100 Dr. Martin L. King Jr. Boulevard, Suite 1100, Nashville, TN 37203

• Vizient: 290 E. John Carpenter Freeway,  Irving, TX 75062, USA

COCIR, HealthTrust Performance Group and Vizient are joint data controllers, under the General Data Protection Regulation EU 2016/679 (GDPR). COCIR operates the website www.mepaalliance.org (the “MEPA website”) on behalf of MEPA partners mentioned above.

Personal data collected

We may collect personal data from you, including:

• name

• professional email address 

• organization name and function

• information about your attendance in MEPA meetings and events

• Statistics (not individual information) on IP location, device information and operating system, language support, information about general (not individual information) interactions and behavior on the MEPA website

How your personal data is collected and processed - purpose

• If you visit the MEPA website, we only use essential cookies which are strictly necessary for the website to function correctly.  

• If you register for an event.

• If you register to receive our communications (invitations, information, consultation etc.), by filling the form “staying informed” provided on the MEPA website.  

• If you apply for being  a “supporting organization” of MEPA by filling the form

You have the right to opt out at all times by sending the “opt out” form provided on the MEPA website. We will not use your personal data for other purposes than the ones described in this privacy policy without a prior notification and, where required, the possibility to accept or reject the use of your personal data for a different purpose.                                                                                  

Sharing data

We may share your personal data with:

• third parties who may process personal data on behalf of MEPA partners in accordance with  their instructions. These third parties include service providers that provide support on aforementioned activities, particularly in terms of event management, communication and web hosting, as well as consultants, for the purpose of performance of their service contracts with  the MEPA partners

• administrations, regulators or judicial bodies, as required by law or a binding order.

Transfers of data to third countries

We do not transfer personal data to third countries, outside the European Economic Area (European Union, Iceland, Liechtenstein, Norway). However, the website provider, Squarespace Inc., which is based in the United-States has certified its compliance to the Data Privacy Frameworks developed by the U.S. Department of Commerce and the European Commission, the UK Government, the Swiss Federal Administration for safe and reliable transfers of data to the United-States.

Data security

We take appropriate technical, physical, and organisational measures to protect your personal data against unauthorized processing, accidental loss or damage. These measures include encryption, access controls, secure storage (including protected servers and physical security of hardware), regular software updates, appropriate backup strategy, staff guidelines and training, and periodic security assessments.

Retention of personal data

We will not retain your personal data longer than necessary for the purposes for which the data were collected, after which it will be removed and erased, unless applicable law requires a specific retention period.

• For the duration of visiting our website and in line with the expiry set by accepted cookies (refer to cookies below).

• For the duration of the communication on an event you have registered for.

• For the duration of your subscription to our news updates.

• For the duration of our communication with you on our activities.

Cookies

Cookies are small text files that are installed on your browser, on your computer or on your mobile device. They allow a website to recognize your device. We may use essential cookies that are necessary for MEPA website to work properly. They do not require your consent and may not be disabled.

Your rights

You have the right to obtain (i) access to your data, (ii) correction of inaccurate or incomplete data, (iii) the erasure of your data, (iv) the restriction of processing your data, (v) the portability of your data and (vi) the right to object to the processing of your data in general as well as to the processing of your data for direct marketing and profiling purposes. Some of these rights may be subject to conditions or exceptions.

If the processing of your data is based on consent, you also have the right to withdraw your consent at any time, without this affecting the legitimacy of the processing done prior to the withdrawal of your consent.

You can send your request by  filling the form “contact” provided on the website. To protect your privacy and security, we may take reasonable steps to verify your identity before processing your request. 

Updates to the COCIR privacy policy

We may update or change MEPA privacy policy at any time in order to reflect our data processing activities. The published MEPA privacy policy will always be updated or changed accordingly.

Contact us

For any question or comment related to this Privacy Policy or the exercising of your data subject rights, please fill the form “contact” provided in the MEPA website.

Complaints

You have the right to lodge a complaint with the supervisory authority of your habitual residence, your place of work or the place of an alleged infringement of the GDPR. The Belgian Data Protection Authority is the supervisory authority for Belgium and can be contacted at contact@apd-gba.be.