Privacy Policy

Who we are

Bloomsline SAS, société par actions simplifiée au capital de 1 000 €, registered office 32 rue de Paris, 92100 Boulogne-Billancourt, France (RCS Nanterre 109 138 065, SIRET 10913806500015).

For any privacy question, or to exercise your rights, contact hi@bloomsline.com.

Data we collect

We collect only what the service needs:

• Account data: name, email, and authentication details of practitioners.
• Practice data: a practitioner’s public profile (bio, specialties, availability).
• Patient data entered by practitioners: identity and clinical records (health data — special-category).
• Technical data: device/log information needed for security and reliability.

Why we process it (legal bases)

• To provide the service (performance of a contract).
• To keep it secure and prevent abuse (legitimate interest).
• Health data is processed for the provision of care, under Article 9(2)(h) GDPR and the applicable French health-data rules.
• For any optional processing (e.g. marketing), only with your consent.

Where your data is hosted

Personal and health data are hosted on HDS-certified (Hébergeur de Données de Santé) infrastructure located in the European Union. See our Security and Data Protection pages.

Sharing and subprocessors

We do not sell personal data. We use vetted subprocessors (hosting, email, analytics) under data-processing agreements. A current list is available on request and maintained on the Data Protection page.

Cookies and analytics

We use one optional analytics tool, PostHog, hosted in the European Union, to understand how the site and the app are used so we can improve them. It is never used for advertising and we do not sell or share what it collects.

Nothing is measured until you agree. If you refuse, or simply ignore the banner, no analytics cookie is set and no measurement is sent. You can change your mind at any time, and refusing is exactly as easy as accepting.

Analytics requests are served through our own domain, so your browser never connects to a third-party analytics host. Within the practitioner app we record only a fixed list of named events, never the content of notes, patient names, or anything typed.

In the Bloomsline mobile app, statistics are off until you say yes. The app asks once, after you have set up your account, and you can change your answer at any time in Settings. Say no and nothing is sent at all.

If you say yes, we count actions: a screen opened, a moment written, a session booked. We never send what you write. No names, no moments, no journal, no messages, nothing you type. The app identifies nobody: it sends a number generated for your installation, never your account, and we do not look up where you are. Signing out replaces that number.

Whichever way you answer, we add one to a daily count on our own servers, so we can see how many people accept and how many decline. That count holds a date, the site or the app, the language and a number. It holds nothing about you: no account, no device, no address, not even the time of day.

• Strictly necessary cookies (sign-in session, language, your cookie choice) are always set: the service cannot work without them and they need no consent.
• Analytics cookies are set only after you accept.

Retention

We keep personal data only as long as needed for the purposes above or as required by law (health records are subject to statutory retention periods). Accounts and their data can be deleted on request, subject to those legal obligations.

Your rights

Under the GDPR you may request:

• access to your data
• correction of inaccurate data
• erasure (where no legal obligation to retain applies)
• restriction or objection to certain processing
• portability of data you provided

Contact

To exercise your rights or raise a concern, contact hi@bloomsline.com. You also have the right to lodge a complaint with the CNIL (the French data-protection authority).