Legal information
Privacy policy
Last updated:
01In short
- L’Ostéopathe neither sells nor rents any data, shows no advertising and trains no AI model on your patients’ records.
- For the data of visitors, account holders and the osteopaths we contact, the controller is the publisher of L’Ostéopathe.
- For patient data, the controller is the practitioner; the L’Ostéopathe software processes it on their behalf, as a processor.
- Audience measurement (Google Analytics 4) only runs with your consent.
- To exercise your rights: contact@losteopathe.com.
02Controller
Jean-Vincent Quilichini, sole trader (entrepreneur individuel), SIREN 798 480 406, publisher of L’Ostéopathe (see the legal notice). For any question about your data: contact@losteopathe.com.
03Website visitors
When you visit losteopathe.com, the server receives technical data: IP address, browser, page requested, date and time. It is used to serve the pages, to protect the service against abuse (request limits) and to fix errors. Legal basis: our legitimate interest in running and securing the website. It is erased as the server logs rotate automatically.
The public fee-note generator runs in your browser: the document and the calculations do not leave your device. To suggest an address, a town or a postcode, L’Ostéopathe only sends the few characters typed to the French public services of the IGN Géoplateforme and the API Découpage administratif, without your identity or IP address.
04Messages you send us
When you write to contact@losteopathe.com, we use your address and your message to answer you and follow up. Legal basis: our legitimate interest in answering requests, or steps prior to a contract when your question is about a subscription. Exchanges are kept for up to three years after the last contact.
05Regulatory updates and pioneers programme
Without an account, you can ask to receive regulatory updates from L’Ostéopathe (an e-mail when a rule changes for osteopaths) or to be contacted for the pioneers programme. Data: your e-mail address, the subjects chosen, where on the site you filled in the form, the dates of the request and of the confirmation, and the version of the consent wording shown.
Your sign-up only counts once confirmed through the link sent by e-mail. Legal basis: your consent, which you withdraw at any time through the unsubscribe link in every message, or by writing to contact@losteopathe.com. Unsubscribing erases your address from the list; an unconfirmed request is erased after 30 days.
06Practitioner and team accounts
Data: first name, last name, email address, password (stored as a hash, never in clear), the professional details you enter (RPPS number, SIRET, APE code, address, phone and website of the practice location, logo), settings, role in the practice and two-factor secret (encrypted). Security changes to the account (sign-in method, two-factor authentication) are logged, and the practice’s access log records who views or changes a patient record, when and from which IP address.
Purposes: creating and securing your account, providing the service, sending you the necessary emails (address verification, password reset, invitations, notifications) and answering your support requests. Legal basis: performance of the contract (terms of use); account security is also our legitimate interest.
When the account is created, we also record where the sign-up came from: the category of the losteopathe.com page you opened it from (home, pricing, guide, tool, directory…), an invitation or a directory claim, and, if you came through a campaign link, its codes (`utm_…`), which describe a message, never a recipient. Purpose: knowing which content leads to L’Ostéopathe. Legal basis: our legitimate interest. No cookie and no storage in your browser are used for this.
Retention: as long as the account exists. To delete it, follow the data deletion page (in French, linked from this page); backup copies are then erased as they rotate, within 14 days at most.
07Signing in with Apple, Google or Facebook
You can create your account or sign in with Apple, Google or Facebook. We then receive your first name, last name, email address and a technical identifier specific to that service. Apple only shares your name the first time you sign in, and lets you hide your address: we then receive an Apple relay address (…@privaterelay.appleid.com) that forwards our emails to you. Your profile photo may be sent to us: we do not store it. We receive neither your contacts nor your posts, and we send Apple, Google or Meta no information about your activity in L’Ostéopathe, nor any patient data. Apple, Google or Meta know that you use L’Ostéopathe to sign in; their own processing falls under their privacy policy. Legal basis: performance of the contract (access to your account). You can unlink the service at any time in Settings › Account security, and remove access from your Google account (Security › Your connections to third-party apps & services) or in Facebook › Settings & privacy › Settings › Apps and websites, or in your Apple Account settings (Sign-In & Security › Sign in with Apple › L’Ostéopathe › Stop Using): Apple then tells us and L’Ostéopathe removes the link to your Apple identifier automatically. Email and password sign-in always remains available (“Forgot your password?” link on the sign-in page). To delete your L’Ostéopathe account and your data, write to contact@losteopathe.com from your account address: the full steps are on the data deletion page (in French, linked from this page).
08Subscription and payment
If you subscribe to a paid plan, payment is handled by Stripe. L’Ostéopathe sends Stripe the owner’s email address and the practice name; you enter your card, billing address and, where relevant, your VAT number directly with Stripe. L’Ostéopathe neither receives nor stores your card data, and no health data is sent to Stripe. L’Ostéopathe records the state of your subscription: plan, billing interval, number of practitioners, renewal date.
Legal basis: performance of the contract (terms of sale, in French). Invoices are kept for ten years, the period set for accounting records (French Commercial Code, art. L123-22). Stripe also processes some data on its own behalf (fraud prevention, financial obligations), under its own privacy policy.
09Emails sent by L’Ostéopathe
Emails from L’Ostéopathe are sent through the Resend email service: emails about your account, and those L’Ostéopathe sends on behalf of a practitioner. To patients: the confirmation of an online booking, reminders and the confirmation of a change or cancellation they make from the link received by email, which attach the appointment’s calendar invitation (.ics file), except for an appointment in a recurring series or over a whole day; slots offered to the waiting list. The documents the practitioner sends by email (fee notes, written prior information, letters) also go through Resend, as attachments. No text message (SMS) is sent.
We also write to osteopaths to present the service. These messages go to professionals, at their professional address, and relate to their practice: they rely on our legitimate interest. Every message has an unsubscribe link; you can also write to contact@losteopathe.com. Your address is kept for up to three years after our last exchange; if you unsubscribe, we only keep what is needed not to write to you again.
10Cookies and audience measurement
By default the website and the application only use trackers needed for them to work (language, display theme, sign-in session, remembering your cookie choice). Only with your consent, we use Google Analytics 4 to measure the audience and improve the product: the tag is loaded only after you agree, with advertising signals disabled. No patient data is ever sent: inside the app, page addresses are reduced to route templates (identifiers replaced) and titles to generic labels; events only carry short codes (button location, chosen plan), never free text. Google Ireland Limited acts as our processor. Measurement data is kept for 14 months. You can withdraw consent at any time with the “Manage cookies” link at the bottom of every page; you are asked again after six months. Details are in the cookie policy (in French).
11You are a patient of a practice using the L’Ostéopathe software
Your osteopath is the controller of your record, your appointments and your fee notes. The L’Ostéopathe software processes them on their behalf, under their instructions, as a processor (GDPR, art. 28), and uses them for no other purpose. When you book online, the details entered on the booking page are recorded on behalf of the practice.
To exercise your rights over this data, contact your practitioner: they answer with the software’s tools. If you write to us, we forward your request to your practitioner.
12You are a practitioner: your patients’ data
For your patients’ data, you are the controller and L’Ostéopathe acts as your processor. Each party’s role, the security measures, the subprocessors and what happens to the data at the end of the contract are set out in the data processing agreement (in French, linked from this page).
The current hosting of L’Ostéopathe is not certified for health-data hosting (HDS): as long as that is the case, do not enter any real patient data.
13Recipients and service providers
Your data is only accessible to the publisher, for the needs of the service, and to the providers who help provide it:
- Hetzner Online GmbH (Germany): hosting of the website, the application and the data, on a server located in the European Union;
- Resend (Plus Five Five, Inc., United States): sending emails;
- Stripe: subscription payments;
- Google Ireland Limited: audience measurement, only with your consent;
- Apple, Google or Meta, if you choose to sign in with their account.
The detailed list, with each provider’s role, the data concerned and its location, is on the subprocessors page (in French).
14Transfers outside the European Union
Resend processes data in the United States: transfers rely on the European Commission’s standard contractual clauses, and Resend takes part in the EU–US Data Privacy Framework. For Google Analytics, data may be transferred to Google LLC in the United States under the Data Privacy Framework. Stripe may transfer data to Stripe, Inc. in the United States, under the terms of its privacy policy.
15Retention periods
- Account: as long as it exists; after deletion, backup copies are erased within 14 days at most.
- Subscription invoices: ten years.
- Messages sent to contact@losteopathe.com: three years after the last exchange.
- Regulatory updates and pioneers programme: until you unsubscribe, which erases the address; an unconfirmed request, 30 days.
- Osteopaths contacted by email: three years after the last exchange.
- Audience measurement: 14 months in Google Analytics.
- Cookie choice: six months.
- Server technical logs: erased as they rotate automatically.
- Osteopath directory: its own periods, set out on its information page (link below).
16Security
Encrypted connections (HTTPS), passwords stored as hashes, two-factor authentication (secret encrypted in the database), documents encrypted before storage, role-based access, a log of record access, daily database backups, each copy erased within 14 days at most. Details are on the Security page.
17Your rights
You can access your data, have it corrected or erased, restrict its processing, object to processing based on our legitimate interest, receive the data you gave us (portability) and withdraw any consent at any time. You can also set instructions on what happens to your data after your death.
An email address and a sign-in method are needed to create an account: without them, we cannot provide the service. Other information is used for the features you choose to use.
Write to contact@losteopathe.com; we answer within one month. If our answer does not satisfy you, you can lodge a complaint with the CNIL, the French data protection authority (cnil.fr/fr/plaintes).
18Changes to this policy
The date of the last update is shown at the top of this page. Before any significant change, account holders are informed by email.
For the osteopath directory published by L’Ostéopathe, see Osteopath directory: personal data and rights (in French).