Privacy Policy
Updated on August 19, 2026
This policy is written in French and English. Only the French version is authoritative; the English version is provided for convenience.
SPU Academy streams filmed and commented surgical procedures for a professional audience. This page describes exactly what data the platform keeps, why it keeps it, where that data sits, and how to have it deleted.
1. Who processes your data
The service is published as part of the SPU Academy project, together with the association behind the programme. The publisher's full identity will appear in the legal notice, to be published before paid subscriptions open: the platform currently runs in demonstration mode and takes no payment.
For any question about your data, or to exercise the rights described in section 7, use the contact address shown at the bottom of this page.
2. The data we keep
Nothing is collected “just in case”. Each item below serves a specific function of the service, and disappears with the account.
| Data | What it is for | Legal basis |
|---|---|---|
| Email address, name, password | Creating your account and recognising you. The password is never stored in clear text: only a cryptographic hash is kept. | Performance of the contract |
| Profile type (doctor, resident, student, general public) | Adjusting access to content reserved for professionals. | Performance of the contract |
| Professional registration number (RPPS or equivalent), optional | Verifying the declared professional status. | Performance of the contract |
| Declaration of professional status: the accepted wording, its version, its language, the date and the IP address | Establishing that access to surgical footage was requested knowingly. This record is the evidence, which is why the full wording is kept rather than a mere ticked box. | Legitimate interest — legal certainty of the service |
| Subscriptions and purchases: plan, dates, amount, cancellation, membership rank | Opening the corresponding access and accounting for it. | Performance of the contract |
| Playback position, one per video | Resuming a three-hour procedure where you left it, from one device to another. | Performance of the contract |
| Connected devices: device label, connection and last-activity dates | Limiting access to two devices, and letting you sign one out remotely. | Performance of the contract and legitimate interest — preventing account sharing |
| Language | Writing to you in the language you use on the site. | Performance of the contract |
3. What we do not do
This list is a commitment: it describes choices written into the code, not intentions.
- No advertising trackers, no third-party analytics. The site sets no tracking cookie — which is why you see no consent banner on it.
- No sale, rental or disclosure of your data for commercial purposes.
- No viewing history. For each video a single position is kept and it replaces the previous one: the platform knows where you are, never what you watched and when.
- No patient data. Procedures are filmed on the surgical field, without identifying features, and are covered by signed consent.
4. For how long
- Account and related data: for as long as the account exists. Deleting it erases, in cascade, the entitlements, the professional declaration, the devices and the playback positions.
- Email verification and password reset links: a few hours at most, then automatic deletion.
- Database backups: a weekly copy, kept by the service administrator and protected like the database itself.
5. Where the data sits, and who touches it
The platform relies on four providers, each for a single function. None of them uses your data for its own purposes.
| Provider | Function | Location |
|---|---|---|
| Neon | Database (accounts, subscriptions, playback positions) | Frankfurt, European Union |
| Vercel | Site hosting and page execution | Functions executed in Frankfurt, European Union |
| Mux | Video hosting and delivery | Worldwide delivery network |
| Resend | Sending the service's emails | United States |
- Sending emails involves a transfer outside the European Union, limited to the data needed to deliver the message: address, name and email content.
6. Cookies and local storage
The site uses only what it strictly needs in order to work, which does not require your prior consent:
- A session cookie, set when you sign in, which keeps you identified. It contains no personal data: only a signed reference, whose validity is checked on every page.
- Your browser's memory, to remember the language you chose and to avoid replaying the introduction video on every page during a single visit.
7. Your rights
You have the right to access, rectify, erase, restrict, object to and port your data. Deleting your account erases all data attached to it.
If you believe your rights are not being respected, you may lodge a complaint with the data protection authority of your country of residence — in France, the Commission nationale de l'informatique et des libertés (CNIL).
8. Sensitive content and professional access
The videos show real procedures. They are flagged as such and preceded by a warning to be accepted before playback. Full access requires a declaration of professional status, whose accepted wording is kept as described in section 2.
Playback goes through temporary links, valid for a few hours and tied to your account: a copied video address does not work elsewhere.
9. Minors
The service is intended for healthcare professionals and students of legal age. It is not aimed at minors and no registration is offered to them.
10. Changes
This policy evolves with the service. The date it was last updated appears at the top of the page, and any substantial change will be announced by email to the members concerned.
