Privacy Policy

This notice is written to satisfy Articles 13 and 14 GDPR. French law governs; it is drafted in English so counsel can work from it. [COUNSEL: a French translation will be required before publication — confirm whether the French or the English version is the one that binds.]

Status of this document

This is a draft. It has not been reviewed by counsel and it is not published anywhere in the product. It describes the Helios application as the code stands on the legal-core branch on 2026-07-27, and every factual claim in it was checked against a specific file at that date. Where the product does not yet do something this notice describes, the gap is stated in "What is true today", not hidden.

Some of this notice necessarily describes mechanisms that are being built rather than mechanisms that exist. Every one of those carries an unmissable marker in this form, next to the claim it qualifies:

NOT YET IMPLEMENTED as of 72c20d6. <what is missing, and the milestone that closes it.>

A sentence about a mechanism that does not exist yet and does not carry that marker is a defect in this document, and should be treated as one.

The rule this document was written under, and the rule any future editor must keep: never claim a protection the architecture does not actually provide. An overstated privacy policy is worse than none, because it is evidence.

1. Who is responsible for your data

Ateliersavant Europe SAS, a company registered in France, is the data controller for the processing described here.

• Contact for anything in this notice, and for exercising your rights: privacy@ateliersavant.com
• Legal form: société par actions simplifiée (SAS), registered in France.
• Registered office: 17 rue du Pre-Breda, B.P. 60, 51200 Épernay Cedex, France.
• SIRET: 91229128300014 (SIREN: 912291283).
• [COUNSEL: RCS registry city and number, and share capital, still to be inserted — see legal/terms-of-service.md §1, which needs the same set.]
• No Data Protection Officer is appointed. The assessment is that Art. 37(1)(c) is not engaged today: it turns on processing special-category data "on a large scale" as a core activity, and while health data is unambiguously the core activity here, a closed beta of single-digit users is not large scale. That reasoning is recorded in full at legal/dpia.md §8(c). [COUNSEL: confirm, and confirm the threshold at which it changes — this is a judgement that expires with growth, not a permanent finding. If a DPO is appointed, their contact details belong here and the designation must be notified to the CNIL.]
• No Art. 27 representative is needed: the controller is established in the EU.

⚠️ Operational note, not for publication: the alias privacy@ateliersavant.com was created 2026-08-03 and now routes to a human. That blocker on publication is closed; counsel sign-off (front-matter status, above) is a separate, still-open blocker and this notice remains unpublished until that clears.

2. Read this first: there are two very different versions of Helios

The single most important fact about your privacy in Helios is which version you are using, because they hold your data in completely different places.

The desktop app (the version being used for the beta)

Your health data is stored on your own Mac, in an encrypted vault at ~/Library/Application Support/Helios/. The database file is encrypted whole with ChaCha20-Poly1305; the key is a random 32-byte master key wrapped under your passphrase and, separately, under your recovery code, both through Argon2id (apps/api/app/vault.py). The files the app does store — rendered imaging/ECG page images, and imaging or ECG study files you upload — are encrypted individually with AES-GCM before they touch the disk (apps/api/app/scans.py, apps/api/app/vault.py).

The lab PDF you upload is never written to disk at all, in either version of Helios. It is read into memory, parsed, and dropped; what is kept of it is its filename, content type, size and SHA-256 checksum, and — for a page that is an imaging or ECG page — the rendered image of that page (apps/api/app/main.py). There is no stored copy of the source PDF to encrypt, which is why you will not find one in the list in §3.

The vault is what holds your record, but it is not the only file the app writes to your machine. legal/retention-policy.md §1 lists every file the desktop app creates, including any that are not encrypted, and says which ones are cleaned up and which ones are not. Read it if you want the complete picture of what is on your own disk.

Ateliersavant never receives that data. There is no sync, no backup to us, and no account on our servers holding it. We cannot read it, we cannot recover it if you lose both your passphrase and your recovery code, and we cannot produce it if someone compels us to, because we do not have it.

But do not read that as "your data never leaves your device." It can leave, in one specific circumstance, and only then:

If you choose to have Helios read a lab PDF for you, or you use the chat feature, the app sends the relevant text — or, for a scanned PDF, the page images themselves — to Anthropic in the United States. On desktop this happens with your own Anthropic API key, taken from your own macOS Keychain (apps/desktop/shell/src-tauri/src/keychain.rs), so it is your account and your contractual relationship with Anthropic, not ours. It should only ever happen after you have given a separate consent for these transfers — one that names Anthropic, names the United States as the destination, and states plainly that we have not confirmed zero-data-retention or no-training terms for that account, because that confirmation has not been obtained (legal/subprocessors.md §1).

That consent is a standing one: you give it once, and we do not ask again before each individual call. We would rather tell you that than call it something it is not. What keeps it narrow is this — it covers only the three transfers listed in §6 and nothing else, a fourth kind of transfer cannot borrow it; each individual transfer is written into your audit log before it happens, and one that cannot be recorded is refused rather than sent; and you can withdraw it at any time, with immediate effect. See §6.

That nuance is the whole truth of the desktop product: local by default, never automatic, but not absolute.

The hosted web app (being wound down)

The hosted version at helios.ateliersavant.com stores health data on our infrastructure — a Supabase Postgres database and a private Supabase Storage bucket. Access is restricted per user by row-level security scoped to your account.

Two things must be said plainly about it:

1. That infrastructure is not HDS-certified. French law (Art. L.1111-8 and L.1115-1 of the Code de la santé publique) requires health data hosted on behalf of others in France to sit with a certified hébergeur de données de santé. Supabase, Vercel and Google Cloud Run, as configured here, are not that. [COUNSEL: confirm the precise scope of the HDS obligation as it applies to this configuration and to data already stored.]
2. None of it is in the EEA today. See §5.

For those reasons the hosted app is being closed to health data, not grown. No new tester uploads real health data to it. The owner's own existing records are being moved off it. If you have data there, §9 explains how to get it out and how to have it deleted — and states plainly which of those two things the code can do today and which it cannot.

3. What data we process

Health data (special category — Art. 9 GDPR)

Everything in this list is health data about you, and all of it is processed only with your explicit consent (§4):

• Laboratory results — each biomarker, its value, its unit, the units and reference ranges as printed, the date drawn, and whether you have confirmed it (lab_results, lab_panels, qualitative_results)
• Symptoms you record, in your own words (symptoms)
• Medications and therapies — name, dose, indication, when you started and stopped (medications, intervention_log)
• Diagnosed conditions (conditions)
• Allergies (allergies)
• Vital signs — e.g. blood pressure, resting heart rate (vitals)
• Family history — conditions in your relatives (patients.family_history)
• Lifestyle information — sleep, exercise, diet, alcohol, smoking, and similar (lifestyle, patients.background)
• Imaging and ECG studies — X-ray, ultrasound, CT, MRI and ECG files you upload, stored whole, together with any results derived from them (studies, plus the file itself in the scans bucket or, on desktop, as an encrypted vault blob)
• Uploaded documents — for each document you upload we keep its filename, content type, size and checksum, the verbatim text of any clinician's written report on a page, and a rendered image of each page that was classified as an imaging or ECG page — those pages only (documents, document_pages.report_text, and the page images in the scans bucket or vault blobs). An ordinary lab PDF with a text layer produces no page image at all. Where a page image does exist it is the most exposing thing we hold: the page of a scan, or of a report that was scanned rather than typed, usually shows your name, date of birth, medical record number and your doctor's name, printed on the page.
• The analysis Helios produces about you — findings, the recommended protocol, and what was withheld for safety (analyses). This is derived data, but it reconstructs the clinical picture and is treated as health data.

Identity and account data

• Your name and date of birth, if you enter them (patients.name, patients.dob). These are optional in the data model and you can use a nickname and your age instead. [COUNSEL: we would like to remove dob entirely — age is what the reasoning actually needs — and this notice should be updated if that happens.]
• Your age and sex, which the reasoning engine requires.
• On the hosted app: your email address, used for sign-in and nothing else (profiles), and an internal account tier. If you choose to set a password, Supabase stores a hash of it — never the password itself, and it is not visible to us. Setting one is optional: the emailed sign-in link works whether or not you do.

Technical data

• On the hosted app: a sign-in session token, stored in your browser's local storage by the Supabase client (apps/web/lib/supabase.ts).
• Ordinary server logs from the hosted API. These are meant to contain no health values; a redaction layer and an automated check exist to keep it that way, and any leak found is treated as an incident.
• No analytics, no advertising, and no behavioural profile. See §7.

4. Why we process it, and on what legal basis

Explicit consent is the only basis we rely on for health data. We do not claim "legitimate interests" over your medical record, and we do not rely on Art. 9(2)(h) (healthcare provision) — Helios is not a healthcare provider and no clinician is responsible for it. See the Medical Disclaimer.

You can withdraw consent at any time, and withdrawal stops the processing from that point (§9). It does not make what happened before it unlawful.

[COUNSEL: confirm that consent is a valid basis here rather than a contract-necessity argument, and confirm the wording of the consent screens themselves meets Art. 7 and the CNIL's guidance on granularity — in particular that the health-data consent is separate from the terms acceptance, and that the LLM transfer consent is separate again. Note that the transfer consent is a standing consent scoped to the three enumerated transfers in §6, not a consent re-asked before each call; §6 explains why, and what is done instead.]

5. Where your data is

Desktop app: on your Mac, and nowhere else that we control. If you are in France, your health data is in France, because it is on your desk.

Hosted app: at the date of this draft, no part of the hosted stack is in the EEA:

This is not the intended end state. EU region pinning is planned, and the hosted app is being closed to health data in any case (§2).

Stated plainly, because this is the section a French controller processing Art. 9 health data on US infrastructure has to say it in, not bury it: Ateliersavant Europe SAS is established in France; the infrastructure that processes hosted-app health data is not. infra/REGIONS.md — created for this purpose, confirmed against the actual project configuration and deploy commands, not inferred — states this conclusively: Supabase (database and storage) and the API's Cloud Run compute both run in us-east-1/us-east1, United States; none of the hosted stack is in the EEA. The table above matches that file row for row. Web hosting (Vercel) is the one line neither document can state from configuration alone — see infra/REGIONS.md for why — and it is left as an honest gap rather than a guess, for the reason infra/REGIONS.md itself gives: an invented region in a transfer document is worse than admitting it must be read from the Vercel dashboard.

⚠️ We will not publish an "EEA hosting" claim that is not true. This section must be rewritten — not softened — when and only when the regions actually change, and this notice must state the position on the day it is published, not the position we are aiming at. [COUNSEL: advise whether the current US hosting of already-stored health data requires proactive notification to affected users independently of this notice.]

6. When data leaves — precisely

This is a complete list, derived from the code, of everything that leaves the application to a party outside it.

It leaves to Anthropic when — and only when — you ask for an AI feature

There are three paths, and they are not equally exposed:

1. Reading the text of a lab report. Before the call, lines that look like labelled identifiers — name, date of birth, MRN, address, phone, ordering physician, account, specimen ID — are stripped out (apps/api/app/ingestion/llm.py, redact_phi()). Your lab values are not stripped, because reading them is the entire point of the request.
2. Reading a scanned lab report. If the PDF has no text layer, Helios renders each page as an image and sends the image (up to 60 pages) (apps/api/app/ingestion/vision.py). ⚠️ No redaction is possible on an image. If your name, date of birth, medical record number or your doctor's name is printed on that page, it goes too. This is the largest exposure in the product and we will not describe it as anything smaller.
3. The chat feature. Each message sends your age, your sex, the name of every medication and therapy you have recorded, your healthspan score and the band it falls in, every biomarker with its value, unit, optimal range and status, every finding with its severity and detail, every recommendation with its evidence tier and rationale, every additional test Helios suggests for you, with the priority and the reason it gives, and up to eight previous turns of your own conversation (apps/api/app/chat.py, _context()). No name, date of birth or record number is included — but this is unambiguously your health data, and it is close to the whole of your clinical record.

On the desktop app these calls use your own Anthropic API key from your own Keychain, so they are billed to you and made on your account, under whatever retention and training terms apply to that account — we have not confirmed zero-data-retention or no-training terms for it, and the consent you grant says so rather than promising a protection we have not verified (legal/subprocessors.md §1). On the hosted app the intended posture is that these paths are disabled until a data processing agreement, zero-retention terms and an EU endpoint are in place with Anthropic. See "What is true today".

The consent that permits those three paths, exactly as it works

You give this consent once. It is a standing permission covering the three transfers listed immediately above — the text of a lab report, the page images of a scanned report, and the chat feature — and nothing else. We are not going to describe it as a fresh decision taken before every call, because it is not one, and a record that logged your one click as though it were a hundred separate decisions would be less honest than this, not more.

What it does instead:

• The scope is closed. Those three paths are the whole of it. A new way of sending your data to Anthropic cannot quietly run on this consent: the software refuses any transfer it does not recognise, and an automated test fails our build if the paths in the code stop matching the ones described in this section. Adding a fourth means changing this notice, which changes its version — at which point your existing consent stops counting and you are asked again.
• Every single transfer is recorded. Before any of the three paths sends anything, an entry naming which path it was goes into your own audit log. If that entry cannot be written, the transfer does not happen. So there is a per-transfer record; it lives in the log of events, which is where a record of something happening belongs, rather than being filed as though it were a hundred consents.
• You can withdraw it whenever you like, and it stops immediately. The next call is refused; nothing is grandfathered.

One limitation we will not hide: this consent is all three paths or none. If you want the chat feature but do not want page images of a scan sent, there is currently no way to say so. That is a real gap and it is the first thing to fix if this consent is revisited.

[COUNSEL: the key question for the DPIA — where a user supplies their own API key and grants a standing consent, scoped to these three enumerated transfers and audited per transfer, naming Anthropic, the US destination and the retention terms, is Ateliersavant a controller for that transfer at all, a joint controller, or outside it? The code cannot resolve this and does not pretend to.]

It leaves to research databases — but nothing about you goes with it

When Helios attaches evidence to a recommendation it queries Europe PMC and ClinicalTrials.gov. What is sent is a topic string — for example "testosterone replacement outcomes". No identifier, no value, no symptom, no medication of yours is included. This is not a policy statement; it is asserted by an automated test (apps/api/tests/test_phi.py) that fails if a patient value ever appears in an outbound evidence query. That test is wired into the repository's CI workflow (.github/workflows/ci.yml), which is configured to run it on every push and every pull request.

NOT YET IMPLEMENTED as of 72c20d6. That workflow was added on this branch and has never run — the branch has not been pushed — and CI is not a required check on main, so a failure of this test does not yet block anything. Milestone M19 (full quality gate) is where the workflow is expected to have run green; making it a required check is a branch-protection setting the owner applies on GitHub, which no commit can do.

It does not leave to anyone else

Nothing about you is sold, shared for advertising, used to train any model that we control, or disclosed to anyone else, except where we are legally compelled — and on the desktop app, compulsion would reach nothing, because we hold nothing.

The image-analysis services referred to in our technical documentation (scan-ai, seg-ai) are our own software running on our own private network. They are not a third party and no data is transferred to anyone by using them. They are not reachable from the desktop app at all. They are listed in legal/subprocessors.md for completeness rather than because they are recipients.

7. Telemetry: we collect none

Helios contains no analytics, no crash reporter, no error-monitoring SDK, no session recording, no advertising or tracking pixel, and no product telemetry of any kind — not in the desktop app, not in the web app, not in the API.

This is unusual enough that it should be checkable rather than believed, so: there is no analytics dependency in apps/web/package.json, and a search of the codebase for the usual SDKs (Sentry, PostHog, Google Analytics, Mixpanel, Amplitude, Plausible, Vercel Analytics, Speed Insights) returns nothing outside of ordinary English words. When the macOS privacy manifest (PrivacyInfo.xcprivacy) ships with the desktop app it will declare no collected data types, because there are none to declare — that file does not exist yet at the date of the snapshot below.

We know of no telemetry we want badly enough to be the reason we started collecting data about people's use of a medical tool. If that ever changes it will be opt-in, announced in this notice with a version bump, and never retroactive.

8. Who else touches the data

The full list, with what each one receives and on what legal footing the transfer rests, is maintained as a live document at legal/subprocessors.md, because it changes more often than this notice does. It covers Anthropic, Supabase, Google Cloud, Vercel and the sign-in email provider; the research databases we query with topic strings; our own internal image-analysis services; and Apple, for signing the desktop app. It also records, deliberately, the recipients that do not exist.

International transfers. Anthropic, Supabase, Google and Vercel are all US companies. Any transfer of personal data to them must rest either on the EU–US Data Privacy Framework, where the company is certified under it, or on Standard Contractual Clauses plus a transfer impact assessment. The current status of each is a checkbox in legal/subprocessors.md, and several are unchecked. [COUNSEL: confirm which mechanism applies to each named recipient and whether a transfer impact assessment is required for the Anthropic transfer given it carries Art. 9 data. Do not treat any of these as settled from this document.]

9. Your rights, and exactly how to use them here

You have all of the following rights, and nothing below qualifies the rights themselves. What the table describes is the mechanism for each one in this product. Consent withdrawal, export and deletion now exist end to end — a /settings route (apps/web/app/settings/page.tsx) with a panel for each (ConsentPanel.tsx, ExportPanel.tsx, DeleteAccountPanel.tsx) calling API routes that do the work for real, not a stub — and, as of this wave, a person can reach that screen from inside the running app too.

Landed as of c352253, and the navigation gap closed this wave: /settings is now linked from the app chrome — AppRail's SETTINGS_ITEM in apps/web/components/AppRail.tsx on desktop, and a signed-in link in apps/web/components/SiteHeader.tsx on hosted. RequireAuth.tsx:41's auth-redirect exemption for the route is unaffected and still correct. Consent withdrawal, export and deletion are reachable by clicking a link, not only by typing the URL.

The mechanisms are real, and, as of this wave, reaching them is too. Every route above answers correctly when called directly — apps/api/tests/test_erasure.py, test_consent_gate.py and the export tests exercise exactly that — and a beta tester using the shipped app chrome can now navigate to /settings and use each panel (marker above). This notice still cannot be published, but that is for the outstanding counsel sign-off, not because the mechanism-versus-in-app-path gap this paragraph used to describe is still open.

Email privacy@ateliersavant.com for any of these if you would rather not use the in-app panels, or for restriction and objection (§18/§21), which have no in-app control. We will respond within one month (Art. 12(3)), and will tell you if we need the permitted extension.

We do not charge for any of this and will not ask you for a reason.

Automated decision-making. Helios analyses your data automatically and produces findings and a suggested protocol. This is decision-support: it produces information for you and your clinician, it makes no decision about you, it has no legal effect and nothing is done to you as a result of it. Every recommendation carries a dose range, an evidence tier, and a flag saying a licensed clinician must decide. We do not consider this to be a decision within Art. 22(1). [COUNSEL: confirm — the analysis is unquestionably automated processing of health data, and if any part of it were ever used to gate access to something, Art. 22 would engage.]

10. How long we keep it

Retention periods are set out per data category in legal/retention-policy.md, which is the authoritative document and is kept in step with what the code actually does.

The short version: on the desktop app we keep nothing, because we never have it — your data lives on your machine until you delete it, which today means deleting the vault directory yourself. On the hosted app, your data is kept until your account is closed, and the hosted health data is in any case being wound down. Note that "until you delete it" is not yet something the product does for you on either platform: there is no deletion endpoint, and §9 says so in full rather than implying otherwise here.

11. Complaining

If you think we have handled your data unlawfully, please tell us first at privacy@ateliersavant.com — but you do not have to, and you can complain directly to the French supervisory authority:

Commission Nationale de l'Informatique et des Libertés (CNIL) 3 Place de Fontenoy — TSA 80715 75334 PARIS CEDEX 07, France www.cnil.fr

If you live in another EU or EEA country you may complain to your own national supervisory authority instead.

12. Children

Helios is not for anyone under 18 and we do not knowingly process a child's data. [COUNSEL: France sets the digital-consent age at 15 under Art. 8 GDPR as implemented by the Loi Informatique et Libertés — confirm whether an 18+ restriction stated in the Terms is sufficient, or whether an age gate is required given the health-data context.]

13. Changes to this notice

The version number in the front matter of this file changes whenever the text does. Material changes — a new recipient, a new purpose, a new place your data is stored — will be told to you in the app before they take effect, and where a change affects what you consented to, we will ask you again rather than assume.

---

What is true today

Snapshot of the legal-core branch, 2026-07-27. This table exists so that nobody publishes this notice while a sentence in it is aspirational. Re-derive it before publishing; do not trust it as it ages.

Publication rule: this notice may not be published while any row above reading "Not at the date of this snapshot" or "No" still corresponds to a sentence in the body that is written in the present tense. Either the code lands or the sentence changes.