Mandatory

Privacy policy

The controller for data processed by this portal is Expavy Assurances, an insurance broker registered with ORIAS under number 24000431.

The data processed in this portal

An account gives access to a personal space where the following are stored: your identity and contact details (name, phone number); the content of your quote file(s) (destination, situation, dates, budget); the documents that you or your advisor upload to it; the messaging exchanges related to these files; and, where applicable, the complaints you file and their follow-up. No health data is collected or processed by this portal: the medical questionnaire, where required, remains entirely handled by the insurer selected at the time of underwriting.

Purpose: managing your international health insurance file and your relationship with your advisor. Legal basis: performance of the brokerage contract and pre-contractual measures taken at your request (article 6.1.b of the GDPR). Recipients: Expavy Assurances (authorised advisors and administrators) and, once a quote has been validated with you, the chosen partner insurer.

Precise retention period and the contact details of a data protection officer, if any: to be completed as soon as communicated by Expavy Assurances.

Your rights

You have a right of access, rectification, erasure, restriction and objection over your data, as well as the right to lodge a complaint with the CNIL (the French data protection authority, cnil.fr). To exercise these rights, use the messaging of your file if you have one, or the « Complaints » page of your space — a dedicated address for data-protection requests will be published here as soon as it is communicated by Expavy Assurances.

Security

Access to your space is protected by a password (12 characters minimum) and a login-attempt limiting mechanism. Documents you upload are stored in a private space, accessible only to yourself and to the Expavy Assurances staff authorised to handle your file.

What's still to be confirmed

  • Technical subprocessors (final host, any analytics tool).
  • Exact retention period for files after closure.
  • Transfers outside the European Union, if any, and the safeguards attached to them.