Privacy Policy

The data controller is [PLACEHOLDER], identified under number [PLACEHOLDER], located at [PLACEHOLDER].

Contact person for personal data: [PLACEHOLDER]. DPO, if appointed: [PLACEHOLDER].

The distribution of responsibilities with professionals and partners, including any joint controllers, must be specified: [PLACEHOLDER]. A health professional or laboratory may act under its own responsibility; its role and notice must be specified before transmission.

Depending on the functions used, data may include your identity and contact details, account information, country and language, orders and subscriptions, delivery addresses, payment references, questionnaires, dietary preferences, body measurements, biology documents, connected device data, appointments and exchanges with professionals.

Messages addressed to the assistant, transmitted files, summaries, recommendations, scores and representations used for research may also be associated with your account. Some data are health data; test results may fall under genetic data.

This information comes from you, from your use of the service and, for the functions concerned, from connected devices, professionals or partners. Technical traces and usage events may include account/session identifiers, dates, actions and pages viewed.

[PLACEHOLDER]

Account creation and management, orders, deliveries and subscriptions involve processing necessary for the performance of the contract or for steps requested before its conclusion. Accounting documents are processed for applicable legal obligations.

Security and abuse prevention may be based on the legitimate interest of protecting individuals and the service, after examining their necessity and proportionality. Usage measurement purposes must be distinguished from security and receive their own justification.

For health or genetic data, a basis under Article 6 of the GDPR is not sufficient: a condition under Article 9 must also apply. Explicit consent, when retained, must be specific, informed, demonstrable and revocable. Another basis related to health care can only be used if its conditions are met.

[PLACEHOLDER]

AI functions may use information from your file and your exchanges to respond, produce summaries and personalize recommendations. Digital representations of texts may allow finding relevant information; they should not be considered anonymous when they remain linked to your account.

The services used may include Vertex AI and a separate Gemini API for certain summaries and conversation titles. The conditions of the actually activated service must be specified; no general commitment to exclusively European processing or absence of reuse by a provider is deduced from its name alone.

The authorization given to a coach to consult your file is distinct from the collection and processing of an appointment transcription. Information on recording, recipients and the basis of the transcription must be provided before processing.

Responses and scores may be inaccurate. You can report erroneous information or request an explanation and human intervention via the indicated contact.

[PLACEHOLDER]

Access to data must be limited to authorized persons based on their missions. Professionals participating in your support have the necessary information within the framework of the service and applicable authorizations.

The webapp functions may involve Google Cloud for infrastructure and certain AI processing, a separate Gemini API, Google Workspace for appointments, Supabase for certain associated services, Terra for device connections, Lyra for payment, Resend for emails and SEUR for shipments. A Zoho CRM integration exists; its effective use and scope must be confirmed. This list describes identified integrations, not proof that all are activated for every user.

Payment and delivery require their own data, without justifying the transmission of a complete health record. Laboratories or professionals may be responsible for separate processing.

[PLACEHOLDER]

The location of an application server alone does not determine the location of all processing, backups or support access. Flows must be examined service by service.

When a transfer outside the European Economic Area occurs, it must be based on a valid mechanism, for example, an adequacy decision applicable to the recipient or standard contractual clauses accompanied by the necessary assessments and measures. You can request information on the guarantees and an accessible copy thereof, subject to protected information.

[PLACEHOLDER]

Data must be retained for a period adapted to its purpose, then effectively deleted or anonymized. The account duration alone does not justify unlimited retention of all information.

[PLACEHOLDER]

Account deletion, withdrawal of access authorization and subscription termination have different effects. Certain documents may be retained under restricted access to comply with a legal obligation or defend a right. Backup copies must follow a documented cycle and not reintroduce deleted data into service.

No general purge period for files or transcriptions is guaranteed by this working version. Actual durations and operations must be aligned before publication.

Under the conditions provided by the GDPR, you have the rights of access, rectification, erasure, restriction and portability. You can object to certain processing, notably for reasons relating to your particular situation when processing is based on legitimate interest, and at any time to direct marketing. When processing is based on your consent, you can withdraw it without affecting the lawfulness of processing prior to withdrawal.

Write to [PLACEHOLDER] specifying the right concerned and the information allowing your account to be found. Do not spontaneously send identity documents or health documents. Proportionate additional information may be requested in case of reasonable doubt about your identity.

A response must be provided in principle within one month. An extension of two months may be necessary due to the complexity or number of requests; you must then be informed within the first month of the reasons for this extension.

The settings offer account management and deletion functions; you can also request the erasure of associated data from the indicated contact. No automatic global export or instant erasure of all copies is promised here.

You can lodge a complaint with the competent supervisory authority, notably the AEPD in Spain (www.aepd.es) or the CNIL in France (www.cnil.fr), as well as that of your habitual residence, your place of work or the place of the alleged infringement.

The webapp uses mechanisms necessary for the session and preferences, notably language and country. It also includes collection of browsing and usage events. Their purpose, duration and regime must be distinguished.

Non-strictly necessary trackers subject to consent should only be activated after your choice. Refusing must be as simple as accepting, and the choice must be modifiable. Mechanisms necessary for the service do not automatically fall under this obligation.

[PLACEHOLDER]

Genio implements authentication, authorization and input protection controls for the webapp. Their effectiveness and that of hosting measures must be regularly verified. No system guarantees absolute security. Report an anomaly via the indicated contact, without sending secrets or files of other people.

[PLACEHOLDER]

The policy must be updated if processing evolves. Significant changes must be brought to your attention and new consent collected when necessary. The version date allows identifying the consulted document.