Privacy policy

The controller of your data is Sandrine Friscia, hygienist naturopath (see the legal notice). For any question about your data: contact@sandrinefriscia-naturopathe.com.

• •Your account: name, email address, password (stored in encrypted form, never readable) and your phone number when you provide it. Purpose: to create and manage your personal area. Legal basis: performance of a contract or pre-contractual steps.
• •Your bookings: type of session or pack, date and time, status, amount, payment references and invoices. Purpose: to manage appointments, payments, cancellations and refunds, and to issue your invoices. Legal bases: performance of a contract and legal accounting obligation.
• •Your assessment questionnaire (anamnesis): personal information, reason for consultation, symptoms, emotional state, medical history, any treatments, eating and lifestyle habits and, where relevant, information specific to women or children. This information concerns your health: it is so-called “sensitive” data. Purpose: to prepare and personalise your support. Legal basis: your explicit consent, which you give by filling in and sending the questionnaire and may withdraw at any time.
• •Your payment: it is made on Stripe's secure page. Sandrine Friscia never sees or stores your card number; she only receives confirmation of the payment, its amount and your email address. Legal basis: performance of a contract.
• •Your testimonials, if you submit one: the text, the name you choose to display and the date. They are only published after validation by Sandrine Friscia. Legal basis: your consent.
• •Your exchanges with Sandrine Friscia by email: legal basis: performance of a contract and legitimate interest in answering your requests.
• •The site's messaging: your messages to Sandrine Friscia and hers, with the date and time they were sent and read. You may mention your support there; avoid detailing unnecessary health information, and do not use it to seek help in an emergency (call 15). You may attach files (images, PDFs, documents): they are stored in a private storage space hosted in the European Union, accessible only to you and Sandrine Friscia through temporary links, and added to your file with Sandrine Friscia. Avoid sending documents unrelated to your support. Only you and Sandrine Friscia can access it. You only receive a notification by email, never the text of the message. Legal basis: performance of a contract.
• •Offers: the sessions Sandrine Friscia offers you, and the promo codes you use (with the discount granted). Legal basis: performance of a contract.
• •Gifts: if you give a session or a pack, we record the name, email address and personal note of the person you are giving it to, solely to send them their gift (with a personal link) and let them activate it. We do not write to them for any other purpose. You undertake to have told them. If you receive a gift, you have nothing to pay and we only keep the link between the gift and your account. Legal basis: performance of a contract.
• •Video calls: sessions take place in a video room built into the site. Sound and image are neither recorded nor stored: they travel, encrypted, directly between your device and Sandrine Friscia's, or, if your network requires it, through a relay server that does not keep them. To set up this connection, technical data (your device's network address, temporary session identifiers, presence in the room) is exchanged and automatically deleted after 2 hours at most. Legal basis: performance of a contract.
• •Strictly necessary technical data: login and language cookies (see “Cookies”). Legal basis: legitimate interest in operating and securing the site.

Your data is never sold, rented or used for advertising or profiling.

Only Sandrine Friscia can access your questionnaire and file, from an area protected by credentials. Each client can only view their own information.

To run the site she uses technical providers who act only on her instructions (processors):

• •Vercel: website hosting;
• •Supabase: database and account authentication;
• •Stripe: online payment and invoicing;
• •Resend: sending the site's emails (for example when an appointment is moved);
• •video-connection help services: “STUN” servers (operated notably by Cloudflare and Google), which receive your device's network address while the connection is being set up, and, where necessary, a “TURN” relay server, which only passes encrypted streams through without keeping them.

Your data may be disclosed to the competent authorities where the law requires it.

Some providers (notably Vercel, Stripe and Resend) may process data outside the European Union, in particular in the United States. These transfers are covered by appropriate safeguards: the European Commission's standard contractual clauses and, where applicable, the EU–US Data Privacy Framework. The database is hosted in the following region: [hosting region to be completed].

• •Account and contact details: as long as your account is active, then up to 3 years after your last session, unless you ask for deletion.
• •Assessment questionnaire: for the duration of the support, then up to 3 years after the last session; you can ask for it to be deleted earlier. It is deleted automatically if you cancel your appointment and have no other appointment, no session already held and no pack in progress.
• •Appointments, invoices and proof of payment: 10 years, in accordance with accounting obligations (article L.123-22 of the French Commercial Code). You can remove an invoice from your personal area, but it remains kept in the accounts for this legal period.
• •Testimonials: as long as they are published; removal on simple request.
• •Gifts not yet activated: the recipient's name and email address are kept until the gift is activated, then with the giver's invoice (10 years); they are used for nothing else.
• •Messages and attached files exchanged with Sandrine Friscia: same periods as the client's file, i.e. up to 3 years after the last session; you can ask for them to be deleted earlier. They are deleted along with your account if Sandrine Friscia deletes it permanently.
• •Technical data for connecting to the video room: 2 hours at most, then automatic deletion.
• •Cookies: see “Cookies” below.

Once these periods have elapsed, data is deleted or anonymised.

Communication with the site is encrypted (HTTPS). Passwords are stored in an unreadable form. Access to data is compartmentalised by strict rules, and the management area is reserved for Sandrine Friscia. In the event of a data breach likely to result in a high risk to you, you would be informed as soon as possible and the CNIL would be notified as required by law.

You have the following rights over your data at any time: access, rectification, erasure, restriction of processing, objection, portability, and the right to withdraw your consent (without affecting what was done before withdrawal). You may also give instructions on what happens to your data after your death.

You can also delete your account yourself from “My account” (when no upcoming appointment or pack in progress remains): your access is then closed permanently and your email address released. This does not delete the data that Sandrine Friscia must or may keep: invoices, appointments and payments (10 years, accounting obligation) and the assessment questionnaire (up to 3 years after the last session). You can ask for it to be erased, within the limits of these obligations, by writing to contact@sandrinefriscia-naturopathe.com.

To exercise your rights, write to contact@sandrinefriscia-naturopathe.com. Proof of identity may be requested in case of doubt. You will receive a reply within one month. You can also edit your questionnaire directly from your personal area.

If, after contacting us, you believe your rights are not being respected, you may lodge a complaint with the CNIL: www.cnil.fr, 3 place de Fontenoy, TSA 80715, 75334 Paris Cedex 07, France.

This site only uses cookies that are strictly necessary for it to work, which do not require your consent:

• •a login cookie, which keeps your session open while you are signed in;
• •a language cookie, which remembers your choice of French or English (up to 1 year).

The site uses no advertising cookies and no audience-measurement tools. During payment, Stripe's secure page may set its own cookies, notably to prevent fraud; they are governed by Stripe's policy. The link to Instagram takes you off this site: that network applies its own rules.

The site is intended for adults. A minor may not create an account or book without the consent of their legal guardian.

This policy may change, for example if a new service is added to the site. The date of the last update is shown at the top of the page.