1. Who we are (data controller)
Helix (the "Application") is published by Théo Sans, a non-professional publisher (private individual, no legal entity), reachable at hello@helix-health.app. Data Protection Officer (DPO) / privacy contact: dpo@helix-health.app. Any request relating to your data is answered within 30 days.
2. Our principle: data sovereignty and minimisation
Helix is designed to hold as little data as possible, especially your health data. The rule: your sensitive health data stays on your device (encryptable local storage) and, if you choose, in your own personal cloud (iCloud / Google Drive). It is not centralised on our servers, so you keep full read access, portability and control.
3. Data we process
3.1 Health data (special category, art. 9 GDPR), stored LOCALLY
Supplements/stack, physical characteristics, comorbidities/conditions, blood tests and biomarkers, biological age, sleep/movement data (watch), menstrual cycle phase, challenges. This data is stored locally on your device (IndexedDB database) and, optionally, backed up encrypted (AES-256) in your personal cloud. It does not transit through our servers.
- Legal basis: explicit consent (art. 9.2.a), collected in the app before any health data is stored.
3.2 Account and service data, server (Supabase, Ireland)
- Identification: e-mail address and authentication (password managed and hashed by the authentication service).
- Public profile: username, display name, avatar, bio, profile type.
- Social content: posts, comments, reactions, stories, private messages, events, community challenges, notifications.
- Daily journal: simple daily indicators (sleep yes/no, exercise yes/no, supplements taken yes/no).
- Nutrition: logged foods (products, quantities): no calories displayed.
- Legal basis: performance of the contract (providing the service) and consent (social features, nutrition).
3.3 Location
- Weather: your approximate coordinates are sent to the weather API (Open-Meteo) to contextualise your score (heat, pollution, UV). No account data is attached.
- Events: optional location to find events near you (opt-in, can be disabled).
- Legal basis: consent (browser/OS prompt).
3.4 Free access
Helix is entirely free. There are no purchases, subscriptions or payments in the application.
3.5 Technical data
Authentication session, device type, timestamps, IP address (transient, for connection security). No advertising cookies, no third-party trackers.
- Legal basis: legitimate interest (security) / contract.
3.6 Marketing site analytics (Plausible)
We use Plausible Analytics to understand, in aggregate, how the marketing site is used (pages visited, traffic sources, devices and countries at an aggregated level). Plausible is configured in cookieless mode: it does not place any cookie on your device, does not track you individually, and does not collect any identifiable personal data. Statistics are aggregated and anonymised.
- Purpose: audience measurement and marketing site improvement.
- Legal basis: consent. The Plausible script is only loaded if you accept non-essential cookies via the banner. You can withdraw this consent at any time via "Manage cookies".
- Hosting: European Union (Plausible Insights OÜ, EU infrastructure).
3.7 Contact form and e-mail exchanges
When you use the contact form, we collect your name, your e-mail address, the contact topic, your message, and the site's language at the time of submission.
- Purpose: responding to your request and following up on our exchanges.
- Legal basis: our legitimate interest in responding to requests received.
- Retention period: 3 years after the last exchange, then deletion.
- Recipient: Théo Sans only. No resale or advertising use.
- Storage: the message content is not recorded in our database. It is transmitted and retained in the e-mail services described below. A technical database log retains only metadata required to track delivery, including the sender's e-mail address, topic, category and delivery status, without the message content.
4. Processors and recipients
| Processor | Role | Location | Transfer safeguards |
|---|---|---|---|
| Supabase | Database hosting, authentication, social content storage | Ireland region | n/a (Ireland) |
| Open-Meteo | Weather/pollution from coordinates | EU (Germany) | n/a (EU) |
| Plausible Analytics | Cookieless audience measurement for the marketing site (after consent) | EU | n/a (EU) |
| Transactional e-mail provider | Authentication e-mails | Lovable (Sweden), sent from notify.helix-health.app | Standard contractual clauses if a sub-processor is outside the EU |
| Brevo (Sendinblue SAS) | Sending e-mail replies from @helix-health.app addresses | France, EU | n/a (EU) |
| ImprovMX | Forwarding e-mails received at @helix-health.app addresses to the inbox | United States, transient reception in France (AWS Paris) | Standard Contractual Clauses |
| Google (Gmail, Google Ireland Ltd) | Inbox where messages are read and processed | EU / United States | Standard Contractual Clauses and Data Privacy Framework |
We use no large language model (LLM) or external AI service: the scoring engine is a local algorithm. No data is sent to any AI third party.
5. Possible future development: voluntary contribution to research
This processing is not active today. In the future, to improve the algorithm and potentially develop Helix's own artificial intelligence model, you may be offered the option to voluntarily send anonymised health data.
- This contribution will rely on explicit, separate consent (art. 9.2.a GDPR). It will never be enabled by default and will be clearly presented before any data is sent.
- The data will never be sold, used for advertising, or shared with third parties for commercial purposes. It will be used solely to improve Helix.
- Processing and training will take place exclusively in Europe, with no servers in the United States, and with the aim of prioritising local processing.
- You will be able to withdraw your consent at any time, which will stop all future data transfers. Data already anonymised or already integrated into a model will no longer allow you to be identified and therefore cannot be removed individually.
- This policy will be updated and you will be notified in the application before any launch.
6. Retention periods
- Local health data: for as long as you keep it on your device; you can erase everything at any time (uninstall, local wipe, or deletion within the app).
- Account and server content: for the life of the account. Deletion = 30-day grace period (cancellable), then permanent cascading purge (accounts, content, logs).
- Automatic retention: purge after prolonged total inactivity.
7. Your rights (GDPR)
- Access & portability: readable JSON export of your local data + ZIP export of server data, from Settings → Data.
- Rectification: edit your profile and data in the app.
- Erasure: account deletion (30-day soft-delete then purge); immediate local erasure.
- Objection / restriction: contact the DPO.
- Withdrawal of consent: at any time (disable health tracking, geolocation, etc.).
- Complaint: to the CNIL: cnil.fr/fr/plaintes.
8. Security
Encryption in transit (HTTPS), Row Level Security on all tables (each user can only access their own data), AES-256 encrypted local backups, signed URLs for private message media. Sensitive health data never leaves the device.
9. Minors
Helix is intended for people aged 18 and over (health optimisation content). We do not knowingly collect data from minors.
10. Changes
This policy may evolve. Any substantial change will be notified in the app.
11. Contact
Questions or to exercise your rights: dpo@helix-health.app.