Privacy
Privacy policy
Data controller
Orekio, as data controller, carries out the data processing described below. For any question, contact: contact@orekio.app.
Data collected
Identification data for the practitioner and the patient (name, email), follow-up data entered by the patient (sleep diary, clinical scale answers, safety plan, other modules), and technical connection data.
Purposes and legal basis
Follow-up data is processed for the sole purpose of facilitating the therapeutic follow-up between the patient and their practitioner. Sharing entries with the practitioner is on by default, and the patient can stop it at any time from their profile. This data is shown back to the practitioner raw, with calculated scores and no interpretation: the clinical analysis is theirs to make.
Retention period
Each type of data has its own retention period, enforced every night by automatic deletion. Any change to these periods will be published here.
Patient entries, practitioner notes and the consultation notebook: as long as the patient signs in, their full history is kept. Data older than 5 years is deleted when the patient has not signed in for a year. No entry or note is deleted for inactivity while a follow-up is paused.
Data access audit log: 10 years.
AI assistant data (usage counters, feedback on answers), support requests and the payment provider's log: 13 months. The email copy of a handled support request is erased every month.
Notification logs: 1 year. Expired invitations: 30 days.
End of subscription: the practitioner's account becomes read-only for 90 days if it never paid, 3 years otherwise. At that point, their follow-ups are erased. The practitioner is notified beforehand, and so is the patient when all of their practitioners are affected. A module followed by another practitioner remains. At launch, an account still waiting for its card, with no entitlement or patient, is erased after 30 days.
On request, an account and its data are erased without waiting for these periods (see “Your rights”).
Hosting
The database is hosted by Supabase in a data centre in Paris (Amazon Web Services, eu-west-3 region), and the application server by Render, in Frankfurt.
This hosting is not certified as a Health Data Host (HDS) within the meaning of article L.1111-8 of the French Public Health Code. The move to a certified host is being prepared; this page will give its name and date.
Processors
Orekio relies on the following providers, each for a specific task:
Supabase: database, authentication and profile pictures (Paris).
Render: application server (Frankfurt).
Resend: sending emails (invitations, password reset, account status, support requests and reported questions), from the European Union.
Expo and Google Firebase, and Apple for iPhones: delivering notifications (reminders, notebook summaries) to the patient's phone. These providers are based in the United States; for Expo and Firebase, the transfer is governed by the European Commission's standard contractual clauses, set out in their terms.
Stripe: payment of the practitioner's subscription. Stripe receives no health data. In Europe, the contract is with its Irish company; transfers to the United States are governed by the Data Privacy Framework and, failing that, by the standard contractual clauses.
Anthropic: the practitioner's AI assistant (see the next section).
Practitioner AI assistant
In the web app, practitioners can ask an AI assistant questions about using Orekio. The assistant relies on a model from Anthropic, acting as a processor. It is for practitioners only: the patient app has none.
Orekio does not itself send the AI any data about patients: no name, entries, scores or notes. When the practitioner asks for information about a patient, Orekio reads and displays it; it never goes to the model. The model receives the user guide, the catalogue of modules and fields, the name of the open screen, the module on display, whether a record is open (without saying which), today's date, and the questions in the conversation. A second Anthropic model checks the question and any free-text answer before display. The names of patients and invitees that Orekio recognises, and any email address, are removed from questions before sending. The rest goes out as written: a clinical situation described in plain words, or a single name typed in lower case, misspelled or not on the list, is not recognised. The practitioner is asked not to write patient data in their questions, apart from the full name or alias to prepare an action.
Anthropic is located in the United States. The transfer is governed by the European Commission's standard contractual clauses, included in its data processing agreement. Anthropic has confirmed that it applies zero data retention to Orekio: requests and responses are not kept once the response is returned, and are not used to train its models. Anthropic provides two exceptions: a legal obligation, and abuse prevention, for which flagged content may be kept for up to two years and the results of its safety checks are retained.
Orekio keeps neither questions nor answers: the conversation exists only in the practitioner's browser and is cleared when they close the assistant window. For 13 months, with no text, Orekio keeps the number of questions per practitioner, their cost, a conversation identifier, the type and subject of each answer (closed lists) and the practitioner's feedback. If the practitioner chooses to report a question left unanswered, its text is passed to the team as a support request.
Your rights
Under the GDPR, you have the right to access, rectify, erase, restrict, object to, and port your data, as well as the right to withdraw your consent at any time. To exercise these rights, contact contact@orekio.app. You may also lodge a complaint with the CNIL (www.cnil.fr).