Privacy Policy

Last updated: 5 May 2026 · GDPR compliant (EU 2016/679)

1. Data controller

Alexandre Guenot — Orkelia
SIRET: 103 861 498 00014
DPO email: alexandre@orkelia.com
Phone: +33 7 81 20 45 70

2. Data collected

Identification data: last name, first name, business email, phone
Clinic data: name, specialty, address
Billing data: processed directly by Stripe — not stored by Orkelia
Agent usage data: conversations between the AI agents and the clinic's patients (metadata only — no medical data stored)
Technical data: IP address, browser type, access logs

⚕️ Important — Health data: Orkelia does not store any patient medical data. The agents process only operational metadata (booking appointments, confirmations, follow-ups). No clinical information is retained.

3. Purposes and legal basis

Purpose	Legal basis
Provision of Orkelia services	Performance of the contract
Management of customer accounts	Performance of the contract
Billing	Legal obligation
Technical support	Legitimate interest
Service improvement	Legitimate interest
Marketing communications	Consent (opt-in)

4. Retention period

Account data: duration of the subscription + 3 years
Billing data: 10 years (accounting obligation)
AI agent conversations: rolling 12 months
Technical logs: 6 months
Marketing data: until unsubscription

5. Processors and transfers

Processor	Use	Location	Safeguard
Supabase	Database	EU (eu-west-3 Paris)	Native GDPR
Vercel	Hosting	USA + EU	Standard contractual clauses
Anthropic	AI (Claude)	USA	Standard contractual clauses · Zero data retention
Stripe	Payment	USA	PCI-DSS Level 1
Resend	Transactional emails	USA	Standard contractual clauses

6. Your rights

In accordance with the GDPR, you have the following rights over your data:

Access: obtain a copy of your data
Rectification: correct inaccurate data
Erasure: delete your data (the "right to be forgotten")
Portability: receive your data in a structured format
Objection: object to processing based on legitimate interest
Restriction: restrict the processing of your data

To exercise these rights: alexandre@orkelia.com — Response time: 30 days maximum.

If a complaint remains unresolved, you may refer the matter to the CNIL: cnil.fr

7. Security

TLS 1.3 encryption in transit
AES-256 encryption at rest (Supabase)
Per-clinic data isolation (Row Level Security)
API keys stored server-side only (Vercel environment variables)
Restricted access to production data
No passwords stored in clear text (bcrypt hashing)

8. Cookies

Orkelia uses cookies strictly necessary for the operation of the service (session, language preferences). No third-party tracking cookie is placed without your explicit consent.

9. Contact

alexandre@orkelia.com