Article 30 GDPR.
Overview
| # | Processing | Data categories | Data subjects | Legal basis | Storage / Recipients | Location | Retention |
|---|---|---|---|---|---|---|---|
| T1 | Authentication & account | E-mail, identifier, session | Users | Contract (6.1.b) | Supabase (auth) | EU | Life of the account + purge 30 days after deletion |
| T2 | Public profile & social | Username, avatar, bio, posts, comments, stories, events, challenges, notifications | Users | Contract / Consent | Supabase | EU | Life of the account / manual deletion |
| T3 | Private messaging | Messages, media (signed URLs) | Users | Contract | Supabase (private bucket) | EU | Life of the account |
| T4 | Daily journal | Sleep/exercise/supplement indicators (yes/no) | Users | Consent | Supabase (daily_logs) | EU | Life of the account |
| T5 | Nutrition | Logged foods/quantities (no calories displayed) | Users | Consent | Supabase (food_entries) | EU | Life of the account |
| T6 | ⚕️ Health data (art. 9) | Stack, conditions, blood tests/biomarkers, watch sleep/movement, cycle, biological age | Users | Explicit consent (9.2.a) | LOCAL (device) + user's personal cloud (iCloud/Drive), encrypted | On the device | User-controlled (no retention by the publisher) |
| T7 | Location (weather) | Approximate coordinates | Users | Consent | One-off call to Open-Meteo | EU (DE) | Not retained (transient call) |
| T8 | Location (events) | Coordinates (opt-in) | Users | Consent | Supabase | EU | Can be disabled at any time |
| T9 | Founder payment | Purchase status (is_founder), identifier, purchase tokens | Buyers | Contract | RevenueCat + App Store/Google Play | US (SCC) | Life of the account |
| T10 | Security / anti-fraud | IP address (transient), timestamps | Users | Legitimate interest | Server logs | EU | Short term |
Compliance notes
- No processing by external AI/LLM: scoring is a local algorithm (nothing sent to any AI third party).
- No third-party cookies / advertising trackers / advertising.
- T6 is the core design principle: sensitive data stays on the user's device, which keeps the processing chain simple. Goal: evolve T4 and T5 to the same local model over time.
- Transfers outside the EU: only T9 (RevenueCat, Apple/Google, US), covered by Standard Contractual Clauses.
Security measures (art. 32)
- RLS (Row Level Security) on all tables: per-user isolation.
- Sensitive columns write-protected (e.g.
is_founderis written only by the server webhook). - Encryption in transit (HTTPS); AES-256 encrypted local backups; signed URLs for private media.
- Cascading deletion (
purge_user_data) + 30-day grace period + automatic retention.
Data subject rights (procedures)
- Access/portability: local JSON export + server ZIP export (in-app).
- Right to erasure: account deletion (30-day soft-delete → purge); immediate local erasure.
- Rectification / objection / withdrawal of consent: in-app + DPO.
- Complaint: CNIL.
To be completed (identity & governance)
- Company name, legal form, company number, address, legal representative.
- Appointed DPO (internal/external), currently: dpo@helix-health.app.
- Transactional e-mail provider details + location.
- Data protection impact assessment (DPIA) recommended given the art. 9 category, even with local storage.