Privacy policy

1. Data controller

ColocPro ([Forme juridique — ex. SASU]), [Adresse du siège social], France, is the data controller for personal data collected through ColocPro.

Privacy contact: contact@colocpro.fr

2. Data we collect

• Identity data: name, email, phone (optional), profile photo (optional)
• Professional data: practice name, address, role, charge share percentages
• Usage data: room bookings, charges, expenses, internal colleague messaging
• Uploaded documents: leases, insurance, internal rules, and other admin files
• Connection data: technical logs, IP address, session cookies
• AI assistant conversations: chat history to provide the service
• Billing data: via Stripe (when paid subscription is active)

3. Data we do NOT collect

ColocPro is not patient management software. We do not intentionally collect patient records, diagnoses, or health data under GDPR Article 9.

You must not use ColocPro to store patient data. You remain solely responsible for content you upload or communicate.

4. Purposes and legal bases

• Account creation and management — contract performance
• Service delivery (scheduling, charges, documents, messaging) — contract performance
• Transactional emails — contract performance / legitimate interest
• AI assistant — contract performance
• Billing and subscriptions — contract performance / legal obligation
• Security and abuse prevention — legitimate interest

5. Sub-processors

ColocPro uses the following sub-processors:

• Supabase — Hébergement base de données, authentification et stockage fichiers (UE)
• Resend — Envoi d'emails transactionnels (invitations, notifications) (UE / USA)
• Stripe — Paiement et facturation des abonnements (UE / USA)
• Google — Connexion OAuth (optionnelle) (UE / USA)
• OpenAI — Assistant IA (conversations et suggestions) (USA)

6. Retention periods

• Account data: duration of contractual relationship, then 3 years for evidence
• Uploaded documents: while the practice is active, deleted within 30 days after practice deletion
• AI conversations: 12 months maximum, then deleted or anonymized
• Technical logs: 12 months maximum
• Billing data: 10 years (accounting obligation)

7. Your rights

Under GDPR, you have the right to access, rectify, erase, restrict, port, and object to processing.

Contact contact@colocpro.fr to exercise your rights. You may also lodge a complaint with the CNIL (www.cnil.fr) or your local supervisory authority.

8. Security

Data is hosted in the European Union, encrypted in transit (TLS) and at rest. Each practice is logically isolated from others.

9. International transfers

Some sub-processors (OpenAI, Stripe, Google, Resend) may process data outside the EU under Standard Contractual Clauses or equivalent safeguards.

10. AI assistant

Messages sent to the AI assistant are transmitted to OpenAI. ColocPro configures the API to exclude your data from model training.

Do not send patient data or sensitive health information through the AI assistant.