Privacy policy

Data controller

The data controller is Jules Orthion, publisher of the “Peak” service. For any question about your data or to exercise your rights: orthionjules@gmail.com. No data protection officer is appointed at this stage; the data controller handles this directly.

Data processed

• Health data (special category): your questionnaire answers — sleep, activity and lifestyle habits, height, weight, optional waist, resting heart rate — along with the calculated results and their history.
• Account data: your email address if you provide it, and a technical identifier.
• Payment data: handled directly by our provider Stripe. We store no card number.
• Technical log: timestamped events (for example “questionnaire completed”), with no content of your answers.

We collect no clinical data: no blood pressure, no lab work, no uploaded document, no photo, no genetic data.

Purposes and legal bases

• To compute your estimate and program, and provide tracking: on the basis of your explicit consent (Article 9(2)(a) GDPR), collected before the questionnaire via a dedicated checkbox, separate from the terms.
• To manage your account and subscription, and bill you: on the basis of performance of the contract.
• To ensure security and meet our accounting and legal obligations: on the basis of our legal obligations and our legitimate interest in preventing fraud.

Consent to the processing of health data can be withdrawn at any time from your account, without affecting the lawfulness of processing carried out before withdrawal.

Retention periods

• Health data and results: kept as long as your account is active, then deleted when the account is deleted.
• Inactive account: deleted after a prolonged period of inactivity, following prior notice.
• Billing data: kept for the time required by accounting and tax obligations.
• Anonymized technical log: twelve months.

Recipients and processors

Your data is never sold or transferred for advertising. It is processed on our behalf by processors, each covered by a data processing agreement (DPA):

• Supabase — database hosting, within the European Union.
• Vercel Inc. — application hosting.
• Stripe — payment processing.
• Mistral AI — assisted writing of tracking notes, a provider established in the European Union. Only strictly necessary data is sent to it; it does not train its models on this data under our contract.
• Microsoft Clarity — usage analytics (heatmaps and session recordings), a provider established in the United States. Masking is set to “strict”: text and form fields are masked, so no answer or result is recorded in a readable form. No data is used for advertising.
• Vercel Web Analytics — aggregated analytics, with no cookies or persistent identifiers.

Hosting, location and security

Data is hosted within the European Union. Your answers are encrypted at rest by the application (AES-256-GCM), in addition to the encryption provided by the host. They are never saved in your browser, and no identifier or health data passes through a web address. Access to the data is restricted and logged.

Impact assessment (DPIA)

Processing health data together with profiling falls under Article 35 GDPR. A data protection impact assessment has been started following the CNIL method; its conclusions are kept available to the supervisory authority.

Your rights

You have the right of access, rectification, erasure, restriction, objection and portability. From your account, you can at any time export all your data in JSON format and delete your account — this deletion truly erases your answers and your results, with only an anonymized event log kept for twelve months. For any request: orthionjules@gmail.com. You may also lodge a complaint with the CNIL (www.cnil.fr).

U.S. residents (California, Washington and other states)

If you are a U.S. resident, the following rights apply in addition to those described above, depending on your state of residence:

• California (CCPA/CPRA): you have the right to know what personal information we collect, to access, correct and delete it, and to opt out of its “sale” or “sharing.” We do not sell or share your personal information, and we do not process it for cross-context behavioral advertising. Exercising these rights results in no discriminatory treatment.
• Health data (Washington My Health My Data Act, Nevada SB 370 and similar laws): the health data you provide is “consumer health data” under these laws. We collect it only with your consent, use it solely to deliver the service, never sell it, and let you withdraw consent and delete it at any time from your account.

To exercise any of these rights, contact orthionjules@gmail.com. You may designate an authorized agent to act on your behalf. We will not discriminate against you for exercising them.

Analytics and cookies

We use no advertising cookies or trackers for targeting, and no data is sent to an ad network. Audience measurement (Vercel Web Analytics) is aggregated, with no cookies or persistent identifiers. To improve usability, we also use Microsoft Clarity (heatmaps and session recordings): masking is set to “strict,” so no questionnaire answer or result appears in a readable form. Clarity sets measurement cookies; you can opt out through your browser settings (the “Do Not Track” signal is honored).