Privacy

Rhealiz SASU (6 bis rue Galvani, 75017 Paris) is the controller of personal data collected via rhealiz.com and during your subscription. Contact: hello@rhealiz.com.

Waitlist: your email address and, if you provide it, your first name.

Free guide: your email address and where your visit came from (UTM parameters). No health data.

Orientation questionnaire: your answers, including your age range, sex, height and weight (the last two optional, to draw your starting point; the body-mass index is computed but never displayed). Some answers may reveal health-related information (GDPR Article 9).

Order and subscription: name, email address, delivery address, phone number (for the carrier’s delivery notice), order and billing data (range chosen, amounts, payment dates, subscription status). Your card details are entered at Stripe: Rhealiz never sees or stores them.

Proof of acceptance of the terms of sale: date and time, version accepted, truncated IP address and display language.

Member area: your login email and, for Cercle, the messages you send us from your area and the appointments you book.

Standard technical data (IP address, browser type) and your choice in the consent banner.

To manage our official TikTok account, our authorised provider (Composio) connects the account via OAuth: the integration reads basic profile information (user.info.basic) and publishes or uploads videos (video.publish, video.upload). Rhealiz stores no TikTok credentials and no data of third-party TikTok users.

Performance of the contract (GDPR Article 6.1.b): processing your order, preparing and shipping your box, managing your quarterly subscription (payments, notice before each charge, cancellation), running your member area, answering your requests.

Legal obligation (Article 6.1.c): bookkeeping and keeping invoices; keeping proof of your acceptance of the terms of sale.

Performance of your request (Article 6.1.b): sending you the guide you asked for.

Consent (Article 6.1.a): founding list launch updates; the emails that follow the guide, if you ticked the box; ad measurement by Meta, only if you accept it in the banner. For your questionnaire answers, which may relate to health: explicit consent under GDPR Article 9.2.a (unticked checkbox), to generate your orientation and prepare your programme.

Legitimate interest (Article 6.1.f): site security, fraud and abuse prevention (rate limiting, technical logs).

You may withdraw your consent at any time, without affecting processing already carried out.

Your data is never sold or rented. Only Rhealiz and the following providers access it, each for its own task and on our documented instructions:

Stripe: payment and subscription management. La Poste / Colissimo: delivery (name, address, phone, email). Resend: transactional emails and login links. Vercel: website hosting and cookieless audience measurement. Supabase: database, hosted in the European Union (Ireland). Calendly: Cercle appointment booking. Microsoft 365: the hello@rhealiz.com inbox, which receives your messages and our order notices. Composio: our TikTok account integration.

Meta (Facebook, Instagram): only with your advertising consent. The pixel then loads on offer and order pages, and our server sends your email in hashed form when you sign up or buy, to measure our ads. Without consent, nothing is sent to Meta. Meta never receives your questionnaire answers or any health data.

Several of these providers are US companies (Stripe, Resend, Vercel, Calendly, Microsoft, Meta, Composio), so some data may be processed in the United States. These transfers rely, depending on the provider, on the EU-US Data Privacy Framework and/or the standard contractual clauses adopted by the European Commission.

The website is hosted by Vercel Inc. (United States). The database, which holds your answers, your account and your orders, is hosted in the European Union (Supabase, Ireland region).

Waitlist and prospects: three years from your last contact with us, the period the French data protection authority applies to marketing, then erased.

Questionnaire answers (Article 9): erased as soon as you withdraw your consent, and at the latest three years after your last contact; if you subscribe, they follow the period set for subscription data.

Subscription data (account, orders, delivery, exchanges): for the whole subscription, then three years after it ends.

Invoices and accounting records: ten years (French Commercial Code, Article L123-22).

Proof of acceptance of the terms of sale: five years after the contract ends (French Civil Code, Article 2224).

You can erase your waitlist data at any time from the link in each of our emails. Invoices and proof of acceptance of the terms of sale are kept for the legal periods above.

TLS encryption in transit, access control, database hosted in the European Union. Processors are bound by data-processing agreements.

rz_consent: keeps your banner choice for six months, after which you are asked again.

Login session (authjs.session-token): set only when you log in to your member area, it keeps your session open for up to 30 days. Logging in also sets two short-lived technical cookies (authjs.csrf-token, authjs.callback-url) that protect the login link. These cookies are strictly necessary and require no consent.

Only with your consent, the Meta pixel (Facebook, Instagram) sets its _fbp and _fbc cookies to measure our ads and make them more relevant to you; it only loads on offer and order pages, never on your questionnaire or in your account, does not read page content and never receives your answers or any health data.

You withdraw your consent at any time with the “Manage cookies” link at the bottom of the page. Our audience measurement (Vercel Web Analytics) sets no cookie and does not identify you. Your language choice is kept in your browser (local storage), without a cookie.

The site is not intended for minors; we do not knowingly collect their data.

Access, rectification, erasure, restriction, objection, portability, withdrawal of consent at any time, and instructions on what happens to your data after your death. Contact: hello@rhealiz.com. We reply within one month.

If you believe your rights are not respected, you may lodge a complaint with the CNIL (www.cnil.fr).