Article 30 GDPR.
Overview
| # | Processing | Data categories | Data subjects | Legal basis | Storage / Recipients | Location | Retention |
|---|---|---|---|---|---|---|---|
| T1 | Authentication & account | E-mail, identifier, session | Users | Contract (6.1.b) | Supabase (auth) | Ireland | Life of the account + purge 30 days after deletion |
| T2 | Public profile & social | Username, avatar, bio, posts, comments, stories, events, challenges, notifications | Users | Contract / Consent | Supabase | Ireland | Life of the account / manual deletion |
| T3 | Private messaging | Messages, media (signed URLs) | Users | Contract | Supabase (private bucket) | Ireland | Life of the account |
| T4 | Daily journal | Sleep/exercise/supplement indicators (yes/no) | Users | Consent | Supabase (daily_logs) | Ireland | Life of the account |
| T5 | Nutrition | Logged foods/quantities (no calories displayed) | Users | Consent | Supabase (food_entries) | Ireland | Life of the account |
| T6 | ⚕️ Health data (art. 9) | Stack, conditions, blood tests/biomarkers, watch sleep/movement, cycle, biological age | Users | Explicit consent (9.2.a) | LOCAL (device) + user's personal cloud (iCloud/Drive), encrypted | On the device | User-controlled (no retention by the publisher) |
| T7 | Location (weather) | Approximate coordinates | Users | Consent | One-off call to Open-Meteo | EU (DE) | Not retained (transient call) |
| T8 | Location (events) | Coordinates (opt-in) | Users | Consent | Supabase | Ireland | Can be disabled at any time |
| T9 | Security / anti-fraud | IP address (transient), timestamps | Users | Legitimate interest | Server logs | EU | Short term |
| T10 | Contact form and e-mail exchanges | Name, e-mail address, contact topic, message, language | Visitors and correspondents | Legitimate interest in responding to requests received | Brevo, ImprovMX and Google Gmail. The message is not recorded in the database; a technical log stores only the sender's e-mail address, topic, category and delivery status | EU / United States | 3 years after the last exchange, then deletion |
| T11 | Voluntary contribution to research | Anonymised health data | Voluntary users | Explicit, separate consent (art. 9.2.a) | Envisaged processing, not active. Improvement of the algorithm and potential development of Helix's own AI model, without commercial third parties | Europe exclusively, with priority given to local processing | Future transfers stop when consent is withdrawn. Data already anonymised or integrated into a model cannot be removed individually |
Compliance notes
- No processing by external AI/LLM: scoring is a local algorithm (nothing sent to any AI third party).
- No third-party cookies / advertising trackers / advertising.
- T6 is the core design principle: sensitive data stays on the user's device, which keeps the processing chain simple. Goal: evolve T4 and T5 to the same local model over time.
- Transfers outside the EU: limited to the messaging services described for T10 and covered by Standard Contractual Clauses and, for Google, the Data Privacy Framework.
Security measures (art. 32)
- RLS (Row Level Security) on all tables: per-user isolation.
- Encryption in transit (HTTPS); AES-256 encrypted local backups; signed URLs for private media.
- Cascading deletion (
purge_user_data) + 30-day grace period + automatic retention.
Data subject rights (procedures)
- Access/portability: local JSON export + server ZIP export (in-app).
- Right to erasure: account deletion (30-day soft-delete → purge); immediate local erasure.
- Rectification / objection / withdrawal of consent: in-app + DPO.
- Complaint: CNIL.
Identity and governance
- Controller: Théo Sans, a private individual publishing Helix on a free, non-professional basis. No company, hence no company number. This register will be updated if a legal entity is created.
- Privacy contact: dpo@helix-health.app.
- Transactional e-mails: Lovable (Sweden), from notify.helix-health.app.
- Data protection impact assessment (DPIA) recommended given the art. 9 category, even with local storage.