Security

Security, at the foundation of every system.

One constant principle guides each of our systems: data protection comes before any feature. This page sets out our technical measures, our data governance, our conduct in the event of an incident and our commitments.

Technical measures

Protection at every level.

Encryption in transit: All communications between users' devices and our servers are encrypted (TLS). No data travels in clear text.
Encryption at rest: Stored data is encrypted at rest, at the hosting infrastructure level.
Authentication: Verification by a one-time code sent by email, enabled by default. The code is valid for ten minutes and limited to five attempts.
Passwords: Never stored in clear text: salted then hashed (PBKDF2-SHA256, 200,000 iterations).
Protection against intrusions: Repeated attempts are limited and automatically blocked.
Sessions: Random tokens that expire automatically after thirty days.
Compartmentalization: Each account is isolated: it only ever accesses its own data.
Internal access: Limited to what is strictly necessary technically, under the principle of least privilege.
On-device processing: Skin analysis takes place on the user's phone: the photo of the face is not sent to our servers.
Payments: Handled by specialized payment providers and by the app stores. No card number passes through our servers; we only know the card brand and its last four digits.
Device permissions: Camera, microphone, activity data and notifications are only used after explicit permission, which can be revoked at any time in the phone's settings.

Data governance

Rules that come before technology.

Minimization: Only the data useful to the service is collected.
Purpose: Data serves exclusively the features requested by the user.
Privacy by default: No information is accessible to a third party without an explicit action by the user.
Sending to a doctor: Summaries intended for a doctor are sent by the user themselves; each sending is logged.
Processors: A small number of providers (hosting, email delivery, payment processing, artificial intelligence provider), bound by contractual confidentiality obligations and described in our privacy policy.
Hosting and transfers: Data is hosted with recognized infrastructure providers, which may be located outside the user's country of residence, notably in the United States. Each transfer is governed by the safeguards provided for by applicable law.
Artificial intelligence: Artificial intelligence processing serves only the requested features. Identifiable data is not used to train general artificial intelligence models without consent.
Technical logs: Security logs are kept for a limited period, solely for security and abuse detection.
Trackers: No third-party advertising trackers, in the app or on the site; the site only uses the cookies necessary for it to work.
Retention and deletion: Deleting an account permanently erases its data, subject to a short technical delay for purging backups.

Compliance

A single foundation, aligned with the most demanding frameworks.

The same level of protection applies to all users, whatever their country of residence.

Canada: Law 25 (Quebec) and PIPEDA. Explicit consent for sensitive information, transparency, a person in charge of personal information protection, incident notification.
Europe and the United Kingdom: GDPR and UK GDPR. Defined legal bases; rights of access, rectification, erasure and portability; governed international transfers; enhanced protection of special categories of data.
United States: CCPA/CPRA and state laws. Transparency about the categories collected; rights to know, correct and delete; no sale or sharing for advertising; non-discrimination.
International: LGPD (Brazil), Australia, Japan and other jurisdictions. Our practices adapt to the mandatory rights of the country of residence; the details are in the privacy policy.
Certifications: We apply the principles of the major security frameworks and formalize our certifications as we grow. No label is displayed before it has been obtained.

Incidents

A response defined in advance.

What to do in the event of a security incident is set before it happens.

Containment: Any confirmed or suspected compromise triggers immediate containment and analysis measures.
Authorities: The competent authorities are informed within the time limits set by applicable law, for example seventy-two hours under the GDPR.
People concerned: When an incident poses a risk to them, the people concerned are informed directly: what happened, and the steps they can take.
Privacy officer: The person in charge of personal information protection can be reached at [email protected].

Commitments

What we will never do.

Our business model is based on subscriptions, not advertising.

Selling or renting data.
Using it for advertising purposes.
Sharing it without explicit agreement.
Pass it to an insurer or an employer.
Preventing a user from retrieving their data.

User rights

Rights exercised directly from the app.

Accès: View all the data entrusted at any time.
Correction: Correct or update your information.
Portability: Export your record in the open FHIR format, or as a PDF.
Deletion: Delete your account and all of its data.

Upcoming hardware

The same principles, by design.

The device, the modules and the patch, currently under study, will follow the rules that govern the app today.

Protection by design: Security requirements are set before development, not after.
Minimization: Only the signals useful to the service will be measured (heart, breathing, sleep, movement), and nothing will start without the user's agreement.
Encryption from capture: Signals will be encrypted in transit and at rest, and covered by the same privacy policy.
Purpose: Observe a rhythm and flag a change. No diagnosis, no automated medical decision.

Reporting

Responsible disclosure.

Security researchers who identify a vulnerability in one of our products are invited to report it to us, with the details needed to reproduce it. Every report is examined and receives a reply.

[email protected]