Privacy
Privacy policy
OVEA is a preventive-health service, so some of what you tell us says something about your health. This page explains exactly what we collect, why, who sees it, how long we keep it, and what you can ask us to do with it.
Last updated 20 August 2026
The short version
- Today OVEA collects one thing: what you fill in on the waiting-list form. There is no account, no product and no medical record yet.
- Every question is a closed list of answers. There is no free-text box anywhere, so you cannot accidentally hand us a diagnosis or a lab result.
- The health question is optional. Leaving it blank costs you nothing and the form still works.
- Everything is hosted in France, by a provider certified for health data. Nothing is sold, and nothing goes to an advertising network.
- Three years after we last hear from you, your email address and your first name are erased for good.
Who is responsible
OVEA decides what is collected and why, which makes it the data controller. The company is being registered in France, in Paris; the registration details will appear in the legal notice as soon as they exist. For anything on this page, write to bonjour@joinovea.com. A data protection officer will be designated before the product opens, and named here.
What we collect, and why
All of it comes from the waiting-list form. Nothing is bought, imported or inferred from anywhere else.
| What | Why | Legal basis |
|---|---|---|
| Your email address | To tell you when OVEA opens, and to send you its news until then. | Your consent |
| Your first name (optional) | So the emails we send you are addressed to a person rather than to an inbox. | Your consent |
| Your age range (optional) | To understand who OVEA is for, and to open in the right order. | Your consent |
| What brings you to OVEA (optional) | To build the right service. Three of the five possible answers say something about your own health. | Your explicit consent (art. 9) |
| The page you registered from, and the campaign that brought you | To know which of our pages actually help. | Our legitimate interest |
| The date of your registration and the wording you agreed to | To be able to prove, if asked, what you consented to and when. | Our legal obligation |
We do not store your IP address, your browser or any device fingerprint. Rate limiting reads your IP in memory to stop abuse and never writes it down.
Your health answers
Three of the answers to “What brings you to OVEA?” — symptoms that stayed unanswered, suspecting a specific condition, feeling minimised — are statements about your own health. GDPR calls this special-category data (article 9) and holds it to a stricter standard than the rest.
That is why the question is optional, why the consent sentence on the form names health information in so many words, and why we record which exact wording you agreed to. Consent to that question can be withdrawn on its own, without leaving the waiting list.
It is also why the database runs on hosting certified HDS (Hébergeur de Données de Santé), the French certification required for health data, in a French region.
OVEA does not make a diagnosis and nothing you answer here is a medical opinion.
Who else sees it
Only the providers that make the service run, each under a contract that binds them to these purposes and nothing else. Your data is never sold, rented or shared for advertising.
| Who | What they see | Where |
|---|---|---|
| Scalingo | Hosts the application and the database — everything above. | France · certified HDS |
| PostHog | Anonymous audience measurement on the site. Never your form answers. | European Union |
| Brevo | Sends our e-mails, starting with the confirmation of your registration, and keeps your address and first name as a contact. It tells us whether an e-mail reached you and whether you opened it. Never your health answer. | France · European Union |
| GitHub Pages | Serves the pages you are reading. Sees the technical request, not your answers. | United States |
| Slack | Receives a short notification each time someone registers — a first name, an age bracket and the running count. Never your email address, and never your health answer. | United States |
The two providers outside the European Union operate under the European Commission’s standard contractual clauses. The Slack notification is deliberately thin, and for a specific reason: a message already posted to a channel cannot be reached by an erasure request, so it carries nothing we would ever need to recall. Everything that identifies you, and everything you say about your health, stays in the certified database in France.
How long we keep it
Three years after we last hear from you — your registration, or the last time you came back to it. That is the duration France’s data protection authority considers reasonable for someone who has shown interest in a service without becoming a customer.
At that point the row is not deleted but anonymised: your email address and your first name are removed permanently, and what remains — an age bracket, a reason, a date, a campaign — can no longer be connected to you or to anyone else. We keep that to understand who OVEA is for. Because it identifies nobody, it is no longer personal data and it is kept without a time limit.
You do not have to wait three years. Ask, and the whole row goes.
Your rights
On the data above, you can ask us at any time to:
- tell you what we hold about you, and give you a copy of it;
- correct anything that is wrong;
- erase all of it — including, and especially, your health answer;
- hand it to you in a portable format, or send it to another service;
- stop using it for a while, without erasing it;
- stop a processing that rests on our legitimate interest;
- withdraw a consent you gave, which stops that processing from then on without calling into question what came before;
- set instructions for what should happen to your data after your death.
One address for all of it: bonjour@joinovea.com. We answer within one month. We may ask you to confirm it is really you, but never for a copy of an identity document unless there is a real doubt.
If our answer does not satisfy you, you can complain to the French supervisory authority, the CNIL.
How it is protected
Everything travels encrypted and is stored encrypted, on infrastructure certified for health data. Access is limited to the people at OVEA who need it, each with their own named account and no shared password, and every action taken on a registration is recorded in an audit trail. If a breach ever put your data at risk, we would notify the CNIL within 72 hours and tell you directly whenever the risk to you is high.
Age
The waiting list is for adults. Please do not register if you are under 18 — if we learn that a registration is a minor’s, we erase it.
Cookies & measurement
The site measures its audience without writing anything to your device unless you agree to it, and none of that measurement is ever connected to your form answers. It has its own page: Cookies & measurement.
Changes to this policy
This page changes when what we do changes, and the date at the top says when it last did. If a change affects what you consented to, we ask you again rather than assume the old answer still holds.