Privacy policy

Data controller

The data controller is Jules Orthion, publisher of the “Peak” service. For any question about your data or to exercise your rights: orthionjules@gmail.com. No data protection officer is appointed at this stage; the data controller handles this directly.

Data processed

• Health data (special category): your questionnaire answers — sleep, activity and lifestyle habits, height, weight, optional waist, resting heart rate — along with the calculated results and their history.
• Account data: your email address if you provide it, and a technical identifier.
• Payment data: handled directly by our provider Stripe. We store no card number.
• Technical log: timestamped events (for example “questionnaire completed”), with no content of your answers.

We collect no clinical data: no blood pressure, no lab work, no uploaded document, no photo, no genetic data.

Purposes and legal bases

• To compute your estimate and program, and provide tracking: on the basis of your explicit consent (Article 9(2)(a) GDPR), collected before the questionnaire via a dedicated checkbox, separate from the terms.
• To manage your account and subscription, and bill you: on the basis of performance of the contract.
• To ensure security and meet our accounting and legal obligations: on the basis of our legal obligations and our legitimate interest in preventing fraud.

Consent to the processing of health data can be withdrawn at any time from your account, without affecting the lawfulness of processing carried out before withdrawal.

Retention periods

• Health data and results: kept as long as your account is active, then deleted when the account is deleted.
• Inactive account: deleted after a prolonged period of inactivity, following prior notice.
• Billing data: kept for the time required by accounting and tax obligations.
• Anonymized technical log: twelve months.

Recipients and processors

Your data is never sold or transferred for advertising. It is processed on our behalf by processors, each covered by a data processing agreement (DPA):

• Supabase — database hosting, within the European Union.
• Vercel Inc. — application hosting.
• Stripe — payment processing.
• Mistral AI — assisted writing of tracking notes, a provider established in the European Union. Only strictly necessary data is sent to it; it does not train its models on this data under our contract.

Hosting, location and security

Data is hosted within the European Union. Your answers are encrypted at rest by the application (AES-256-GCM), in addition to the encryption provided by the host. They are never saved in your browser, and no identifier or health data passes through a web address. Access to the data is restricted and logged.

Impact assessment (DPIA)

Processing health data together with profiling falls under Article 35 GDPR. A data protection impact assessment has been started following the CNIL method; its conclusions are kept available to the supervisory authority.

Your rights

You have the right of access, rectification, erasure, restriction, objection and portability. From your account, you can at any time export all your data in JSON format and delete your account — this deletion truly erases your answers and your results, with only an anonymized event log kept for twelve months. For any request: orthionjules@gmail.com. You may also lodge a complaint with the CNIL (www.cnil.fr).

Analytics and cookies

We use no advertising cookies or third-party trackers for targeting. Analytics, if enabled, is performed without cookies or persistent identifiers, and no data is sent to an ad network.