Privacy policy

1. Who is responsible for your data?

MILMED COE is responsible for your data. MILMED COE is accredited as a NATO centre of excellence and activated as an international military organisation by the North Atlantic Council. We are the data controller of the data which we collect from you, and as such we control the ways your personal data are collected and the purposes for which your personal data are used.

Camillus is MILMED COE’s internal collaboration platform. The conference companion is the mobile and web application used by registered participants of MILMED COE courses, conferences, and workshops. Both are operated by MILMED COE.

The Centre’s general privacy policy is published at https://coemed.org/privacypolicy. This Camillus page applies that policy to the Camillus website and the conference companion app.

2. Data we collect about you

When we talk about personal data, we mean information which identifies you or which could be used to identify you, such as your name and contact details.

2.1 Automatically collected technical data

Whenever you access Camillus or the conference companion, our servers and the site-usage counter may record:

• date and time of the request, requested path, and whether the request succeeded
• browser type and operating system (from the user-agent string)
• referring page, if the browser sends one
• a session identifier used to keep you signed in
• for signed-in staff: username and a daily page-view count, so administrators can see platform usage
• for guests: a hashed session key, not your name

We do not use Google Analytics, advertising SDKs, or other third-party marketing trackers on Camillus or in the conference companion app.

2.2 Camillus staff accounts

Staff sign in with Active Directory (Windows) credentials or a local Camillus account. Depending on your role, the platform may hold:

• username, display name, email address, and group membership
• profile photo and NATO rank, when those are stored in the directory or in Camillus
• records you create in Camillus modules (for example tickets, leave, booking, documents, e-learning progress)
• audit and mail logs needed to operate and secure the service

2.3 Event registration and the conference companion

When you create an account, register for a course or conference, or use the conference companion, we collect the data you provide, which may include:

• name, email address, telephone number, and postal address
• NATO rank, service, command or organisation, nationality, and professional details
• password (stored only as a one-way hash; we cannot read it back)
• travel and accommodation details, when you submit them for an event
• spouse name and passport number, only if you enter them on a registration form
• poll votes, survey answers, forum questions, syndicate messages, and similar in-event activity
• photos or videos taken at MILMED COE events (courses, conferences, workshops, office calls)

Card payments for events are not processed by Camillus. If a fee is collected, you are redirected to the contracted partner bank. Card numbers are not stored by MILMED COE.

2.4 Conference companion app (Android / iOS / web)

If you install the conference companion, we may also process:

• your sign-in session (cookies) so the app can open agenda, polls, and your registration
• a push-notification token for your device (Expo or Firebase), stored against your attendee record so we can send event announcements you have opted into
• last-seen time for your attendee session
• an optional “embed” cookie so the in-app browser can hide duplicate site chrome

The app does not sell data, does not show advertising, and does not collect your contacts, precise location, photos from the camera roll, or microphone audio. Push delivery uses the Expo Push Service (and, on some devices, the platform push service operated by Google or Apple).

2.5 Special categories of personal data

We try to limit collection of special-category data (for example health, religion, or racial or ethnic origin). We may process such data only when you provide it, for example if you request special assistance or a meal type that implies a health or religious requirement. By providing that information you agree that we may use it to provide the requested service.

3. How we use your personal data and legal grounds

We can only use your personal data if we have a proper reason for doing so. According to the applicable rules, we can use your data when you consent, to fulfil a contract with you, if we have a legal duty, or when it is in our legitimate interests.

4. Cookies and similar technologies

Camillus uses only cookies that are needed to run the service:

• CAMILLUSSESSID — session cookie so you stay signed in while the browser is open (HttpOnly, SameSite=Lax, Secure on HTTPS)
• camillus_remember — optional “remember me” token if you choose to stay signed in
• confapp_embed — remembers that the conference companion is showing pages inside the native app shell
• other strictly necessary cookies for device-locked displays (for example SignHub / TV unlock), where that module is used

These cookies are not used for advertising. You can block cookies in your browser; sign-in and the conference companion will then not work until cookies are allowed again.

5. How long we keep your data

We keep your data only for as long as we need it. How long we need data depends on what we are using it for: to provide services to you, for our legitimate interests described above, or so that we can comply with the law.

We will actively review the information we hold and when there is no longer a customer, legal, or business need for us to hold it, we will either delete it securely or in some cases anonymise it. Conference companion push tokens are removed when you sign out of that device’s attendee session or when the token is replaced.

6. How we protect your data

We protect your personal data against unauthorised access, unlawful use, accidental loss, corruption, or destruction. We use technical measures such as encryption in transit (HTTPS), password hashing, and access control, and operational measures such as limiting who can access databases. We keep these security measures under review.

7. Sharing your data

We share some of your personal data with, or obtain personal data from, the following categories of third parties:

7.1 Suppliers who provide services to us

• catering or venue suppliers during events, for example if you requested a certain type of meal
• IT development and hosting operators acting on our instructions
• the Expo Push Service (and Google or Apple push infrastructure) solely to deliver notifications you enabled
• the contracted partner bank, only for the fact of a completed event payment — not for card details
• the Centre’s service-management tools (for example ticket synchronisation) used by MILMED COE support staff

We will make sure that our suppliers respect your personal data and comply with applicable data-protection rules.

7.2 Official communications

During our events, photos and/or videos may be taken and you may appear in them. We may use these to illustrate official MILMED COE social media posts or publications, as described in the Centre’s general privacy policy.

We do not sell personal data.

8. Your rights

You are entitled to see copies of all personal data held by us and to amend, correct, or delete such data. You can also limit, restrict, or object to the processing of your data.

If you gave us your consent to use your data, you can withdraw your consent. Please note that even if you withdraw your consent, we can still rely on the consent you gave as the lawful basis for processing your data before you withdrew your consent. You can object to our use of your data where we rely on our legitimate interests to do so.

To raise any objections or to exercise any of your rights, send an email to info@coemed.org. When you get in touch, we will come back to you as soon as possible and where possible within one month. There is no charge for such requests. We may ask you to verify your identity before we provide any information.

• Right of access — to know whether we process your data and to obtain a copy
• Right to rectification — to have inaccurate data corrected
• Right to erasure — to request deletion where there is no legitimate ground to retain the data
• Right to restriction of processing
• Right to be informed about the controller, purposes, legal grounds, recipients, retention, and your rights
• Right to data portability
• Right to object
• Right not to be subject to a decision based solely on automated processing, including profiling, that produces legal or similarly significant effects. Camillus and the conference companion do not take such automated decisions.

9. Children

Camillus and the conference companion are intended for MILMED COE staff and registered adult participants of official events. They are not directed at children.

10. Changes

If we decide to change this privacy policy, the changes will be posted on this page. The date at the top shows when it was last updated.

11. Complaints

If you have any complaints concerning our data processing, please contact us using the details in section 1, or write to info@coemed.org.