Privacy
Privacy policy
This page is a draft structure, to be reviewed by a legal professional before the service opens to the public. Orekio processes health data (Article 9 of the GDPR), a special category requiring enhanced safeguards.
Data controller
[Legal company name], as data controller, carries out the data processing described below. For any question, contact: [DPO or GDPR contact] — contact@orekio.app.
Data collected
Identification data for the practitioner and the patient (name, email), follow-up data entered by the patient (sleep diary, clinical scale answers, safety plan, other modules), and technical connection data.
Purposes and legal basis
Follow-up data is processed on the basis of the patient's explicit consent (Article 9.2.a of the GDPR), for the sole purpose of facilitating the therapeutic follow-up between the patient and their practitioner. Orekio does not interpret or clinically analyze this data: it is shown back to the practitioner raw.
Retention period
[To be defined: data retention period during active follow-up and after account closure, in line with CNIL recommendations and, where applicable, health-data retention obligations.]
Hosting
Health data is intended to be hosted with a provider certified as a Health Data Host (HDS in France), under Article L.1111-8 of the French Public Health Code.
Your rights
Under the GDPR, you have the right to access, rectify, erase, restrict, object to, and port your data, as well as the right to withdraw your consent at any time. To exercise these rights, contact contact@orekio.app. You may also lodge a complaint with the CNIL (www.cnil.fr).