Privacy policy
Last updated: October 14, 2026
This translation is provided for convenience only. In case of discrepancy, the French version prevails: Politique de confidentialité.
Preamble
The company HERVE (hereinafter “we”, “our” or “HERVE”), publisher of the HerVé software available at app.herve-med.com (hereinafter the “Application”) and of the website herve-med.com (hereinafter the “Website”), attaches the utmost importance to the protection of its users’ personal data.
The purpose of this privacy policy (hereinafter the “Policy”) is to inform users of the Website and the Application (hereinafter the “Users”) about how their personal data is collected, processed and protected, in accordance with:
- Regulation (EU) 2016/679 of April 27, 2016, known as the “General Data Protection Regulation” (GDPR);
- French Act No. 78-17 of January 6, 1978, as amended, known as the “Informatique et Libertés” Act;
- Articles L. 1111-8 et seq. of the French Public Health Code on the hosting of health data;
- the recommendations and guidelines of the French data protection authority (Commission Nationale de l’Informatique et des Libertés, CNIL).
HerVé is practice software intended for orthoptists in private practice. As such, the Application processes health data within the meaning of Article 4(15) of the GDPR, which benefits from enhanced protection.
Article 1 - Data controller
The controller of personal data is:
- Company name: HERVE
- Legal form: Simplified joint-stock company (société par actions simplifiée, SAS)
- Registered office: Hub Eurasanté, 350 avenue Eugène Avinée, 59120 Loos, France
- SIREN: 937 942 456
- Legal representative: Mr. Maxime Jakubowicz, President
- Email: support@herve-med.com
When the Application is used by orthoptists (hereinafter the “Healthcare Professionals”), HERVE acts as a processor within the meaning of Article 28 of the GDPR for the processing of patients’ health data. The Healthcare Professional remains the controller of their patients’ data.
For data relating to the Users themselves (account creation, billing, support), HERVE acts as controller.
Article 2 - Data Protection Officer (DPO)
In accordance with Articles 37 to 39 of the GDPR, and given the sensitive nature of the data processed (health data), HERVE has appointed a Data Protection Officer (DPO).
The DPO can be contacted:
- By email: support@herve-med.com
- By post: Data Protection Officer - HERVE, Hub Eurasanté, 350 avenue Eugène Avinée, 59120 Loos, France
Article 3 - Data collected
3.1 - User data (Healthcare Professionals)
When an account is created and used on the Application, we collect the following data:
- Identification data: last name, first name, email address, phone number, ADELI or RPPS number
- Professional data: practice address, specialty, FINESS number of the facility
- Billing data: billing address, information relating to the payment method (banking data is processed exclusively by our secure payment provider and is not stored by HERVE)
- Connection data: IP address, connection logs, browser type, operating system, date and time of access
- Usage data: actions performed in the Application, preferences, settings
3.2 - Patient data (health data)
When the Application is used by Healthcare Professionals, the following patient data may be processed:
- Patient identification data: last name, first name, date of birth, sex, contact details (address, phone, email), social security number
- Health data: medical history, orthoptic examination reports, visual assessments, prescriptions, medical correspondence, results of additional examinations, telemedicine data
- Patient administrative data: information relating to health insurance, supplementary health insurance (mutuelle), referring physician (médecin traitant), referring ophthalmologist
Important: Patients’ health data is entered and managed exclusively by the Healthcare Professional, who remains its controller. HERVE accesses this data only to the extent strictly necessary to perform its contractual obligations (hosting, maintenance, technical support) and under the conditions defined in the data processing agreement.
3.3 - Data collected through the Website (visitors)
When you visit the herve-med.com Website, we may collect:
- Browsing data: IP address, browser type, pages visited, duration of the visit
- Contact data: last name, first name, email address, message (when using the contact form or the Crisp chat)
- Cookies: see Article 10 below
Article 4 - Purposes and legal bases of processing
In accordance with Article 13 of the GDPR, we inform you of the purposes and legal bases of each processing operation we carry out:
| Purpose | Legal basis | Data concerned |
|---|---|---|
| Creation and management of the User account | Performance of the contract (Art. 6(1)(b) GDPR) | Identification data, professional data |
| Provision and operation of the Application (practice management, patient records, reports, scheduling) | Performance of the contract (Art. 6(1)(b) GDPR); for health data: necessity for the purposes of preventive or occupational medicine, medical diagnosis, the provision of health care (Art. 9(2)(h) GDPR) | Identification data, patients’ health data |
| AI-assisted report writing | Performance of the contract (Art. 6(1)(b) GDPR); explicit consent of the Healthcare Professional to activate the AI feature | Anonymized/pseudonymized health data transmitted to the AI engine |
| Telemedicine (teleconsultation, tele-expertise) | Performance of the contract (Art. 6(1)(b) GDPR); provision of health care (Art. 9(2)(h) GDPR) | Patient identification data, health data |
| Billing and payment of the subscription | Performance of the contract (Art. 6(1)(b) GDPR) | Billing data |
| Customer support and technical assistance | Legitimate interest (Art. 6(1)(f) GDPR): ensuring User satisfaction | Identification data, usage data, support exchanges |
| Service improvement and audience measurement | Legitimate interest (Art. 6(1)(f) GDPR): improving the Application and the Website | Connection data, anonymized usage data |
| Measurement of visits coming from AI assistants (Skoup Analytics, see Article 10.4) | Legitimate interest (Art. 6(1)(f) GDPR): audience measurement exempt from consent; consent (Art. 6(1)(a) GDPR) for the skp_vid cookie | Pages viewed, referring website, random identifier, country derived from the IP address |
| Marketing communications and newsletter | Consent (Art. 6(1)(a) GDPR) | Email address, last name, first name |
| Compliance with legal and regulatory obligations | Legal obligation (Art. 6(1)(c) GDPR) | Billing data, connection logs |
| Handling of requests to exercise rights | Legal obligation (Art. 6(1)(c) GDPR) | Identification data, proof of identity |
Article 5 - Recipients of the data
The personal data collected may be disclosed to the following categories of recipients:
5.1 - Internal recipients
- Authorized HERVE staff, strictly within the limits of their duties (technical team, support, management)
5.2 - Processors
HERVE uses processors to carry out certain services. These processors act exclusively on HERVE’s instructions and in compliance with the GDPR. Data processing agreements compliant with Article 28 of the GDPR have been entered into with each of them.
| Processor | Purpose | Location | Safeguards |
|---|---|---|---|
| Cloud Advice (SASU) | Hosting of the API, databases and health data | France | HDS certification, ISO 27001 |
| Amazon Web Services (AWS S3) | File hosting (object storage) | France / European Union | HDS certification, ISO 27001, SOC 2 |
| Vercel Inc. | Front-end hosting (Website and Application) | United States | SOC 2 Type II |
| Crisp IM SARL | Messaging and customer support | France (European Union) | GDPR - data hosted in the EU |
| Stripe, Inc. | Payment processing | United States / European Union | PCI-DSS certification, EU-US Data Privacy Framework |
| PostHog, Inc. | Audience measurement and behavioral analytics | European Union (EU servers) | SOC 2 Type II, Standard Contractual Clauses (SCCs) |
| Lunify SAS (Skoup), 155 avenue de Choisy, 75013 Paris, France | Measurement of visits coming from AI assistants (Skoup Analytics) | European Union | GDPR - data hosted in the EU, IP address not stored |
| Sentry (Functional Software, Inc.) | Application monitoring and error tracking | United States | SOC 2 Type II, Standard Contractual Clauses (SCCs) |
| Amazon Simple Email Service (SES) | Sending of transactional emails and newsletters | European Union | ISO 27001, SOC 2 |
| Anthropic, PBC (Claude) | AI-assisted report generation | United States | SOC 2 Type II, data not used for model training, signed DPA |
5.3 - Authorized third parties
Personal data may be disclosed to third parties authorized by law (tax authorities, judicial authorities, CNIL, etc.) upon request and within the limits of what is legally required.
5.4 - Interoperability
The Application enables interoperability with third-party services (e.g. Doctolib for appointment management). These connections are activated by the Healthcare Professional and are subject to the terms of use and privacy policies of each third-party service concerned.
Article 6 - Data transfers outside the European Union
Patients’ health data is hosted exclusively in France / within the European Union, by an HDS and ISO 27001 certified host. No health data is transferred outside the European Union.
Certain non-sensitive data (analytics data, application monitoring) may be transferred to the United States. These transfers are governed by:
- the Standard Contractual Clauses (SCCs) adopted by the European Commission (Implementing Decision (EU) 2021/914 of June 4, 2021);
- where applicable, the EU-US Data Privacy Framework for certified recipients.
Supplementary security measures are implemented in accordance with the recommendations of the European Data Protection Board (EDPB).
Article 7 - Data retention period
Personal data is retained for the following periods:
| Data category | Retention period in active database | Archiving period |
|---|---|---|
| User account data | Duration of the contractual relationship | 3 years after the end of the contractual relationship (prospecting), then deletion |
| Patients’ health data | Duration of use of the Application by the Healthcare Professional | Returned to the Healthcare Professional when the account is closed (reversibility). Note: the Healthcare Professional must comply with the statutory retention periods applicable to medical records (20 years from the last consultation - Art. R. 1112-7 of the French Public Health Code) |
| Billing data | Duration of the contractual relationship | 10 years from the end of the financial year (legal obligation - Art. L. 123-22 of the French Commercial Code) |
| Connection logs | 1 year (legal obligation - Art. 6 II LCEN, Decree No. 2011-219) | Deletion at the end of the legal period |
| Support data (Crisp exchanges) | Duration of the contractual relationship | 3 years after the end of the contractual relationship, then deletion |
| Marketing prospecting data | 3 years from the last contact | Deletion at the end of the period |
| Measurement of visits coming from AI assistants (Skoup Analytics) | 25 months | Deletion at the end of the period |
| Cookies and trackers | 13 months maximum (CNIL recommendation) | Not applicable |
At the end of the retention periods indicated, data is securely deleted or irreversibly anonymized.
Article 8 - Data security
HERVE implements appropriate technical and organizational measures to ensure the security, confidentiality and integrity of personal data, in accordance with Article 32 of the GDPR. These measures include in particular:
- Certified hosting: Health data is hosted by an HDS-certified host (Health Data Host) in accordance with Article L. 1111-8 of the French Public Health Code, and ISO 27001 certified (information security management system).
- Encryption: Data is encrypted in transit (TLS 1.2 minimum) and at rest (AES-256).
- Access control: Access strictly limited to authorized staff, strong authentication, rights management based on the principle of least privilege.
- Logging: Access to health data is logged and audited.
- Backups: Regular encrypted backups are performed, with periodic restoration tests.
- Incident management: A data breach management procedure is in place, in accordance with Articles 33 and 34 of the GDPR, including notification to the CNIL within 72 hours and, where applicable, notification of the data subjects.
- Awareness: All staff with access to personal data receive regular training on data protection and information security.
- Security testing: Security audits and penetration tests are carried out periodically.
Article 9 - Data protection impact assessment (DPIA)
Given the nature of the data processed (health data), the potential number of data subjects and the use of innovative technologies (artificial intelligence), a data protection impact assessment (DPIA) has been carried out in accordance with Article 35 of the GDPR and the CNIL guidelines.
This assessment is kept available to the CNIL and is reviewed periodically or whenever the processing operations change substantially.
Article 10 - Cookies and trackers
10.1 - Definition
A cookie is a small text file stored on the User’s device (computer, tablet, smartphone) by the server of the website visited. It allows the website to recognize the User on subsequent visits.
10.2 - Cookies used
| Cookie name | Purpose | Duration | Type |
|---|---|---|---|
| Session / Auth cookies | User authentication and session | Session / 30 days | Strictly necessary |
| crisp-* | Customer support chat (Crisp) | Up to 12 months | Functional |
| ph_* | Audience measurement and behavioral analytics (PostHog) | Up to 12 months | Analytics |
| skp_vid | Measurement of visits coming from AI assistants (Skoup Analytics), set only after “Accept” | 13 months | Analytics |
| sentry-* | Application monitoring and error tracking (Sentry) | Session | Functional |
| __stripe_* | Fraud prevention and secure payment (Stripe) | Up to 12 months | Strictly necessary |
10.3 - Managing cookies
On your first visit to the Website, an information banner allows you to accept or refuse non-essential cookies. You can change your preferences at any time by clicking the “Manage cookies” link in the Website footer.
You can also configure your browser to accept or refuse cookies. The procedure varies depending on the browser used:
Refusing non-essential cookies does not prevent use of the Website or the Application, but some features may be limited.
10.4 - Measurement of visits coming from AI assistants (Skoup Analytics)
To know which visits to the Website come from artificial intelligence assistants (ChatGPT, Claude, Gemini, Perplexity…), we use Skoup Analytics, provided by Lunify SAS (155 avenue de Choisy, 75013 Paris, France), publisher of Skoup, acting as a processor on behalf of HERVE.
- Before your consent: no cookie and no storage is placed on or read from your device. Each page viewed is counted with a random identifier that only lives for that page. This is audience measurement exempt from consent.
- After “Accept”: a
skp_vidcookie (random identifier, 13 months) links your successive visits. - IP address: it is only used to determine the country of the visit, then forgotten.
- Retention and hosting: measurement data is kept for 25 months and hosted in the European Union.
You can object to this measurement at any time: your choice is remembered by your browser and nothing more is sent to Skoup Analytics from the Website.
Article 11 - Data subject rights
In accordance with Articles 15 to 22 of the GDPR and Articles 48 to 56 of the Informatique et Libertés Act, you have the following rights over your personal data:
- Right of access (Art. 15 GDPR): You have the right to obtain confirmation as to whether or not data concerning you is being processed and, where that is the case, access to that data and to certain information (purposes, categories of data, recipients, retention period, etc.).
- Right to rectification (Art. 16 GDPR): You have the right to have inaccurate personal data rectified or incomplete data completed.
- Right to erasure (Art. 17 GDPR): You have the right to have your personal data erased in certain cases (data no longer necessary, withdrawal of consent, unlawful processing, etc.), subject to legal retention obligations.
- Right to restriction of processing (Art. 18 GDPR): You have the right to obtain restriction of the processing of your data in certain cases (contested accuracy, unlawful processing, etc.).
- Right to data portability (Art. 20 GDPR): You have the right to receive your personal data in a structured, commonly used and machine-readable format, and to transmit it to another controller.
- Right to object (Art. 21 GDPR): You have the right to object at any time to the processing of your data based on legitimate interest, including profiling. You may also object to the processing of your data for direct marketing purposes.
- Right to withdraw consent: Where processing is based on your consent, you may withdraw it at any time, without affecting the lawfulness of processing carried out before its withdrawal.
- Right to set post-mortem instructions (Art. 85 of the Informatique et Libertés Act): You have the right to set instructions regarding the retention, erasure and disclosure of your personal data after your death.
Exercising your rights
To exercise your rights, you can contact us:
- By email: support@herve-med.com
- By post: HERVE - Data Protection Department, Hub Eurasanté, 350 avenue Eugène Avinée, 59120 Loos, France
Your request will be handled within one (1) month of its receipt. This period may be extended by two (2) further months in the case of complex requests or a high number of requests, in accordance with Article 12(3) of the GDPR. You will be informed of this within the initial one-month period.
Proof of identity may be requested if there is reasonable doubt as to your identity.
Specific rights regarding patients’ health data
Patients whose health data is processed through the Application must exercise their rights with the Healthcare Professional who is the controller of their data. HERVE, as processor, will assist the Healthcare Professional in fulfilling their obligations in accordance with Article 28(3)(e) of the GDPR.
Article 12 - Right to lodge a complaint with the CNIL
If you consider that the processing of your personal data infringes the GDPR or the Informatique et Libertés Act, you have the right to lodge a complaint with the French data protection authority (Commission Nationale de l’Informatique et des Libertés, CNIL):
- Online: www.cnil.fr/fr/plaintes
- By post: CNIL, 3 Place de Fontenoy, TSA 80715, 75334 PARIS CEDEX 07, France
Article 13 - HERVE’s commitments as processor
As processor of health data, HERVE undertakes, in accordance with Article 28 of the GDPR, to:
- process the data only on documented instructions from the Healthcare Professional;
- ensure that persons authorized to process the data have committed themselves to confidentiality or are under a statutory obligation of confidentiality;
- take all security measures required by Article 32 of the GDPR;
- not engage another processor without the prior specific or general written authorization of the Healthcare Professional;
- assist the Healthcare Professional in responding to requests from data subjects to exercise their rights;
- assist the Healthcare Professional in ensuring compliance with the obligations relating to security, breach notification, impact assessment and prior consultation;
- at the choice of the Healthcare Professional, delete or return the data at the end of the service;
- make available to the Healthcare Professional all information necessary to demonstrate compliance with these obligations and allow for audits.
Article 14 - Changes to this policy
HERVE reserves the right to modify this Policy at any time in order to comply with any legislative, regulatory, case-law or technical developments. The version in force is the one available on the Website on the date of consultation.
In the event of a substantial change, Users will be informed by any appropriate means (notification in the Application, email) at least thirty (30) days before the new version takes effect.
Continued use of the Website or the Application after the new version takes effect constitutes acceptance of the amended Policy.
Article 15 - Governing law
This Policy is governed by French law. In the event of a dispute relating to the interpretation or performance of this Policy, and failing an amicable settlement, the competent French courts shall be those within the jurisdiction of the registered office of HERVE.
Article 16 - Contact
For any question regarding this Policy or the processing of your personal data, you can contact us:
- DPO: support@herve-med.com
- By post: HERVE - Hub Eurasanté, 350 avenue Eugène Avinée, 59120 Loos, France
- General email: support@herve-med.com