Privacy Policy

PURE SERENITY, a simplified joint-stock company (société par actions simplifiée) with a share capital of 1,500 euros, whose registered office is located at 58 avenue de la Grande Armée, 75017 Paris, France, registered with the Paris Trade and Companies Register (RCS Paris) under number 943 179 705, SIRET 943 179 705 00026.

PURE SERENITY is the controller of the processing operations for which it determines the purposes and means, in particular in its relations with visitors and with persons requesting information about its services. It is referred to as “we” in this policy.

For any question or request relating to personal data, you may write to us at info@pureserenity.health or to PURE SERENITY, Protection des données, 58 avenue de la Grande Armée, 75017 Paris, France.

This policy concerns visitors to pureserenity.health (the “Site”) and persons who send a request, book an appointment, use a payment link or sign up to the newsletter or to a waiting list. It covers the data collected through these features. Any medical record compiled in the course of a subsequent service is the subject of separate information.

A healthcare professional or healthcare establishment may be the controller of its own care-related processing. It then provides its own specific information. Where PURE SERENITY acts solely on behalf of another controller, or determines certain purposes jointly with it, the roles and the relevant point of contact are specified in the notice for the service concerned.

The forms collect directly from you: full name, email address, city of residence, language, programme under consideration and general service preferences (prevention, emergency assistance or access to a specialist; request for an individual, a couple, a family or an executive team). Signing up to the newsletter or to the waiting list collects your email address. Mandatory fields are identified in the forms; if they are not completed, it may not be possible to process your request.

When a payment is made, bank details are entered on the Stripe pages. PURE SERENITY does not retain full card details; it receives the information needed to track the payment and for invoicing. The technical data actually recorded for security purposes are specified below.

Each request is recorded in our database together with the version of the general terms accepted, the date and time of their acceptance as recorded by our server, and the choice made regarding the newsletter. Acceptance of the general terms and consent to marketing communications are separate.

After a successful payment, Stripe sends our server a signed confirmation containing the name, email address, amount, currency, language and payment session reference. This information is passed on to Klaviyo so that a welcome email can be sent to each member who has paid. This service message is not a marketing communication.

Where a representative or a professional passes on information about you, we inform you of its source, the categories received and the purposes of the processing. This information is provided at the latest within one month of receipt, at the time of the first communication with you or before the data are first disclosed to another recipient, whichever occurs first, save where a legal exception applies. A loved one or an employer is not granted access to your medical data merely because they fund your membership.

Each use of data is based on a legal basis provided for by the General Data Protection Regulation (“GDPR”). Performance of a contract justifies only the processing necessary for that contract; it is not sufficient, on its own, to authorise the processing of health data.

The data necessary for handling a complaint, a mediation or litigation are used on the basis of our legitimate interest in resolving disputes and defending our rights. They are retained until the file is closed, and thereafter, for only the relevant documents, for the applicable limitation periods.

Archiving for legal or evidential purposes is kept separate from day-to-day use and is accessible only to authorised persons. It does not justify retaining a medical record in its entirety on the same basis as invoices.

The Site’s forms are not intended to collect diagnoses or medical records. Certain details concerning a speciality, a medical condition or a care need may nevertheless reveal a state of health, even without an attachment. Please limit your request to general information and do not enter medical details in the free-text fields.

If a service subsequently requires health data, specific information will be provided to you before they are collected. It will specify, in particular, the purposes, the controllers, the recipients, the retention periods and the basis authorising that processing. Mere acceptance of the general terms or subscription of a membership does not constitute consent to the processing of health data.

Care-related processing carried out under the responsibility of a professional bound by professional secrecy is governed by its own legal basis and by the information provided by that professional. Consulting this policy does not amount to a general authorisation to access medical information.

The data are accessible to authorised members of the PURE SERENITY team to the extent required by their duties, and to the service providers needed for the functions described below. They may be disclosed to advisers, authorities and authorised bodies where necessary or legally required. In the context of a consumer dispute, the relevant information may be passed on to CM2C for mediation. We do not sell your data.

Administrative and medical access rights are separate. Insurers, employers, funders or loved ones do not automatically receive medical documents. Disclosure to a third party for another purpose requires a specific legal basis and specific information.

The Site’s main database uses Supabase/PostgreSQL in the Paris region, within the European Union. Supabase Inc. is a US company. Vercel Inc., established in the United States, provides the hosting and delivery of the Site. Klaviyo Inc. and Calendly LLC are also established in the United States. Stripe Payments Europe Ltd and Google Ireland Ltd are established in Ireland; their services may involve transfers to Stripe, Inc. and Google LLC in the United States. Hosting the main database in France therefore does not rule out processing or access from other countries.

Transfers to the certified US entities of Vercel, Klaviyo, Stripe, Google and Calendly rely on the EU–US Data Privacy Framework, for the processing covered by their certification and by the applicable adequacy decision. Standard Contractual Clauses adopted by the European Commission govern the relevant Supabase transfers and are also provided for by Vercel. Depending on the transfer, the appropriate safeguards are supplemented by the necessary measures. You may request further details and a copy of the applicable safeguards from the contact indicated in section 1.

PURE SERENITY takes technical and organisational measures appropriate to the nature of the data and to the risks in order to prevent their loss, alteration and unauthorised access. Access is restricted to authorised persons. Where a personal data breach meets the conditions laid down by the regulations, it is notified to the competent authority and, where necessary, to the data subjects.

Trackers that are strictly necessary for a feature expressly requested may be used without consent where the legal conditions are met. Other trackers are placed or read only after a valid choice has been made. Refusing must be as easy as accepting; the absence of a choice does not constitute consent.

Google Analytics 4 is used to measure the Site’s audience. It loads only after you click “Accept” in the cookie banner. The “Refuse” button is given equal prominence. Before such consent, no Google Analytics component is loaded and none of its cookies is placed or read. The cookies used are _ga and _ga_<ID>, set to expire after thirteen months. The user and event data retention setting in Google Analytics 4 is set to fourteen months.

The “Cookie settings” link in the footer allows you to change your choice at any time. A refusal deletes any Google cookies already placed by the Site. Your choice is stored for thirteen months, after which you are asked to make a choice again.

Your browser also stores your language preference, so that the Site opens in the language you have chosen, as well as your choice in the cookie banner. Technical session data record that the introductory animation has been played and the scroll positions for the browser’s back button; they are deleted when the tab is closed. This storage does not consist of cookies and is not transmitted to third parties. You can clear the language preference in your browser settings.

Any trackers specific to the appointment and payment services are presented in their interfaces and are subject to the required choices. The Google Signals and ad personalisation advertising features are disabled on the Site.

You may request access to your data, their rectification, their erasure or restriction of processing where the legal conditions are met. You may object to processing based on legitimate interest on grounds relating to your particular situation, and to direct marketing at any time, without giving reasons.

Portability concerns the data you have provided, processed by automated means on the basis of consent or of the contract. You may withdraw your consent at any time, without affecting the lawfulness of processing carried out before its withdrawal. You may also set out instructions (directives) concerning what happens to your data after your death, in accordance with French law.

Send your request to info@pureserenity.health or to the postal address indicated in section 1, specifying the right concerned and the information enabling us to locate your data. Proof of identity is not systematically required: additional information may be requested where there is reasonable doubt as to your identity.

We respond without undue delay and, as a rule, within one month of receipt of the request. This period may be extended by two months where justified by the complexity or number of requests; you are informed of this within the first month, together with the reasons for the extension. In the event of a refusal, you are informed of the reasons and of the available remedies.

Exercising your rights is free of charge, subject to the legal exceptions relating to manifestly unfounded or excessive requests. The right to erasure does not override a legal retention obligation or the possibility of retaining the data strictly necessary for the establishment, exercise or defence of legal claims.

You may lodge a complaint with the Commission nationale de l’informatique et des libertés (CNIL), 3 place de Fontenoy, TSA 80715, 75334 Paris Cedex 07, France, or with the supervisory authority competent for your situation. Contacting PURE SERENITY first may help to resolve the matter, but it is not a precondition for your right to refer the matter to the authority.

The Site and the subscription process are intended for adults. If a request concerns a third party, provide only the necessary information that you are authorised to transmit. Informing the beneficiary and, where applicable, the involvement of their representative are arranged before the data necessary for their care are processed.

The policy is updated when the services, the processing operations or the applicable requirements change. A new purpose or a significant change is brought to your attention before it is implemented where required by law.

A change to the policy does not replace the collection of fresh consent where such consent is required. The relevant versions are retained to ensure the traceability of the information provided.