Important information

Biocorp has identified a security incident that affected its corporate website (biocorpsys.com) between August 22 and 24, 2026.

Some data transmitted via the contact form may have been accessed by an unauthorised third party. To learn more about the incident, its potential consequences and the measures taken, please click here.

Biocorp’s corporate website was hacked on August 22, 2026. The incident – which exploited a recent Wordpress vulnerability – was detected on August 24 at 10:22 a.m., and resolved the same day, at 2:55 p.m.

During this time, a hacker set up a fake ReCaptcha inviting Internet Biocorpsys website users to type a PowerShell command, on Windows. This command could have allowed the hacker to take control of the computer of any user who followed these instructions in full.

In addition, during these two days, the hacker was able to access the data transmitted by users through the contact form. In addition to the identity and contact details of the authors of the messages, they were able to read their content.

The risk of identity theft exists, but remains low given the data collected through the form and the inability to attach files to the contact form.


The impact therefore seems to be mainly a loss of confidentiality. It is limited to the data that you have voluntarily transmitted to Biocorp through the website.

In order to prevent this type of incident in the future, we have taken the following measures:

  • Urgent deployment of necessary updates and security patches;
  • Implementation of two-factor authentication for administrator accounts;
  • Setting up an application firewall;
  • Migration to a hosting and maintenance solution directly administered by our IT department.

We remind you that neither Biocorp nor any other companies within the group will ever ask you to provide them by email, SMS or telephone, sensitive data, such as your bank details.

If you visited the Biocorp corporate website between August 22 and 24, we invite you to contact your IT department or a trusted individual with technical IT knowledge, to make sure that the hacker has not taken control of your computer. If necessary, we invite you to renew all your passwords.

The French Data Protection Authority, the Commission Nationale de l’Informatique et des Libertés (CNIL) was informed of the situation on August 27, 2026. Biocorp will file a complaint, so that an investigation and criminal prosecution can be initiated by the Public Prosecutor, if necessary.

We kindly ask you to accept our apologies for the inconvenience of this incident. Our teamsremain at your disposal to provide you with any further information. You can contact Biocorp at the following coordinates: privacy@biocorp.fr or Biocorp Production, ZI de Lavaur, La Béchade, 63500 Issoire, France.

BIOCORP ALiBiDM SDK – Privacy Policy


Biocorp Production (the « Company ») has developed the Biocorp ALiBiDM SDK (the “SDK”), a software development kit designed to be embedded by an integrator (the “Integrator”) into a third-party mobile application (the “Application”), used by end users (the “Users”). The SDK communicates with the Application and Biocorp smart cap device (the “Device”). The Company takes privacy and the protection of personal data very seriously. The Company ensures the confidentiality and security of your personal data and complies with the applicable regulations, namely:

  • The French Data Protection Act n° 7817 of 6th January 1978;
  • EU Regulation 2016/679 on the protection of natural persons with regard to the processing of personal data, and on the free movement of such data, of 27th April 2016, referred to as the GDPR.

Through the SDK, the Company processes certain personal information. This Privacy Policy informs Users and Integrators about how the Company protects the personal data it collects through the use of the SDK and the Company’s commitments to ensuring that such data is respected.

 

What constitutes personal data?

Personal data is any information that identifies, relates to, describes, directly or indirectly, to an individual.

 

Which data will be collected?

Categories of information collected about Users by our SDK

  • A unique and non-incremental number, which uniquely identify an SDK instance (each installation of the Application);
  • Data about the paired Device (serial number, firmware and hardware versions, battery level, error code in case of malfunction) and the Application (version of the Application);
  • Data concerning the smartphone on which the Application is installed (OS version, model, fabricant, time zone);
  • Technical data regarding the use and operation of the Device (priming detection, button actuation duration (start and end date and time), signal duration, number of increments);
  • Usage logs about the use of the Application (generation of reports, pen management) and the pairing with the Device.

 

Why do we collect your personal data and what is the legal basis for this processing?

The data processing is based on Biocorp’s legitimate interest, as defined in Article 6 of the GDPR. This legitimate interest lies in providing patients with medical devices, associated with the SDK, that meet their medical needs. To do so, it is in the interest of Biocorp to collect your usage and technical data for the purpose of analysis, malfunction anticipation and continuous improvement of its products (including connectable medical devices, mobile applications and the SDK itself).


Where are your personal data kept and how long for?

The collected data will be stored on a server under strict conditions of security and confidentiality to ensure the storage of the personal data. Access to this server is restricted to Biocorp.
The data are collected for a maximum period of twelve (12) months, based on the legal basis of the Company’s legitimate interest, in order to fulfill the purposes for which consent was obtained, and the legitimate interest was established.


Who has access to your personal data?

The Company undertakes to comply with current regulations on the protection of collected personal data and ensures that your personal data, whether directly or indirectly identifiable, is only accessible to authorised persons, including the following persons:

  • The Data Protection Officer (DPO) designated by the Company in the event that you contact him (see “How can you exercise your rights” for details of how to contact the DPO), and the Company itself if necessary for the management of right by the DPO;
  • The Company in exercising certain of your rights;
  • The Company and its staff whose participation is necessary to process the data.
    Please note that the Company does not control the information directly collected by the Integrator through the User’s use of the Application that incorporates the SDK. The Company advises Users to consult the Application’s Privacy Policy to learn about how the Integrator handles personal data.

 

Your rights over your personal data.

  • You have several rights regarding the processing of your personal data. These rights include the following:
  • Access: you have the right to request access to your personal data;
  • Correction: you have the right to request the correction of incomplete or inaccurate personal data that we hold about you;
  • Deletion: in certain circumstances, you have the right to ask us to delete or erase your personal data. There are, however, exceptions where we may refuse a request for deletion, such as where said personal data is necessary regarding compliance with French law or if it is relevant to claims;
  • Restriction: you have the right to ask us to suspend the processing of certain personal data about you, in particular if you wish us to establish their accuracy;
  • Objection: you have the right to challenge the fact that we process personal data on the grounds of legitimate interest (or the interest of third parties). However, we may be authorised to continue to process your personal data on the basis of our compelling legitimate interests or where it is justified by legal claims;
  • Use of your personal data after your death: you have the right to determine how your personal data will be used after your death.
    You also have the right to file a complaint with a personal data protection supervisory authority: in France, the Commission Nationale de l’Informatique et des Libertés (CNIL).
 

 

How can you exercise your rights?

 If you have any questions regarding the processing of your personal data or if you wish to exercise any of the rights mentioned above, please contact the Company: the Data Protection Officer (DPO) whose contact details are privacy@biocorp.fr or Biocorp Production, DPO, Service Juridique, La Béchade ZI de Lavaur, 63500 Issoire, France.

In order to verify your identity, Biocorp requires that you provide the SDK instance number available within your Application, as well as the serial number of your device. In case of reasonable doubt, Biocorp may request additional information to confirm your identity beyond a reasonable doubt.

Any future changes to the Privacy Policy will be posted on the Company’s website at https://biocorpsys.com/en/privacy-policy-sdk/. The Company advises each User or Integrator to refer frequently to review any changes or updates to this Privacy Policy.