This translation is provided for your convenience. In the event of any discrepancy, only the French version of this document is legally binding. Read the French version
1. Data controller
| Data controller | Tribulys |
| SIREN | 104 623 095 |
| Registered office | Lille (59000), Nord, France |
| Data contact | privacy@tribulys.fr |
For any question regarding the processing of your data or the exercise of your rights, contact us at privacy@tribulys.fr.
2. Data collected
2.1 Identification and account data
When you create your account: email address, chosen display name, password (stored in hashed, unreadable form), registration date and time, internal unique identifier.
2.2 Data entered in the Service
The information you record in Tribulys to coordinate care for your loved one:
- Care journal: timestamped notes, observations, alerts, author of the entry, note type.
- Calendar: events, appointments, caregiver visits, schedules.
- Medications: medication name, dosage, intake times, administration confirmations.
- Documents: files uploaded by circle members.
- Circle: information about invited members (email, role: family, nurse, doctor, physiotherapist, home care worker).
2.3 Payment data
For the paid subscription: on the Web, payment card data is collected and managed directly by Stripe ; in the iOS app, payment is managed by Apple via the App Store. Tribulys never stores bank card details. We only retain transaction references, billing history and the information necessary for accounting purposes (amount, date, transaction identifier).
2.4 Technical and browsing data
For security purposes and the proper functioning of the Service: IP address (anonymised in logs), browser and operating system, pages visited, connection timestamps, technical error logs.
Tribulys uses session cookies essential to the operation of authentication (Supabase cookies). No advertising or third-party tracking cookie is placed.
3. Purposes and legal bases of processing
| Provision of the Service | Performance of the contract (Art. 6(1)(b) GDPR): account creation, management of the journal, calendar, medications, circle. |
| Health data | Explicit consent (Art. 9(2)(a) GDPR): medication tracking and notes of a medical nature. You may withdraw this consent at any time. |
| Billing & accounting | Legal obligation (Art. 6(1)(c) GDPR): invoices retained for 10 years (French Commercial Code, Art. L. 123-22). |
| Security & fraud prevention | Legitimate interest (Art. 6(1)(f) GDPR): connection logs, detection of abnormal access. |
| Improvement of the Service | Legitimate interest (Art. 6(1)(f) GDPR): aggregated and anonymised usage analysis. No identifiable individual data is used. |
| Service communications | Performance of the contract (Art. 6(1)(b) GDPR): transactional emails (registration confirmation, invitation, care alert). |
4. Retention periods
| Account data | For the duration of the active subscription + 3 years after termination (civil contractual limitation period: Art. 2224 French Civil Code). |
| Journal, calendar, medications | For the lifetime of the active circle + 30 days after account deletion (grace period allowing for accidental restoration). |
| Billing data | 10 years from the close of the accounting year (legal obligation: Art. L. 123-22 French Commercial Code). |
| Technical logs | 12 months maximum, in accordance with CNIL recommendations (deliberation no. 2021-122). |
| Session cookies (Supabase) | Duration of the browsing session (deleted when the browser is closed). |
| Consent cookie (Cookiebot) | 1 year: remembers your cookie consent choices. |
5. Data recipients: processors
Tribulys uses the following processors, bound by data processing agreements (DPAs) compliant with the GDPR:
Supabase Inc. : database and authentication
Role: storage of all Service data (accounts, circles, journal, calendar, medications). Hosted in the region EU-West (Irlande). Guarantees: signed DPA, SOC 2 Type II certification, AES-256 encryption at rest, TLS in transit.
Stripe Payments Europe : payments (Web)
Role: secure processing of card payments made from the Web. PCI DSS Level 1 certified. Data transferred to the United States on the basis of the European Commission's Standard Contractual Clauses (SCCs).
Apple Distribution International : payments (iOS app)
Role: processing of subscriptions purchased via the iOS app (Apple In-App Purchase / App Store). Apple manages the transaction and payment details; Tribulys only receives an anonymous subscription identifier. Headquarters: Hollyhill Industrial Estate, Cork, Ireland.
Vercel Inc. : application hosting
Role: deployment of the web application. Data passing through Vercel servers in Europe (region eu-central-1). Guarantees: signed DPA, SCCs for transfers to the United States.
Tribulys never sells, rents or transfers your personal data to third parties for commercial or advertising purposes.
6. Transfers outside the European Union
Data is primarily hosted within the European Union. In connection with the use of the Stripe and Vercel services (whose headquarters are in the United States), certain transfers may occur to third countries. These transfers are governed by the European Commission's Standard Contractual Clauses (SCCs: EU Implementing Decision 2021/914), guaranteeing an adequate level of protection.
7. Data security
Tribulys implements appropriate technical and organisational measures to protect your data against any unauthorised access, alteration, disclosure or destruction:
- TLS (HTTPS) encryption of all communications;
- AES-256 encryption of data at rest (on the Supabase side);
- Hashed passwords (bcrypt): Tribulys can never access your password in plain text;
- Authentication via time-limited JWT tokens;
- Row Level Security (RLS): each user only has access to the data of their own circles;
- Logging and monitoring of abnormal access;
- Access to production data limited to authorised developers on a need-to-know basis.
In the event of a data breach presenting a risk to your rights and freedoms, Tribulys undertakes to notify the CNIL within 72 hours (Art. 33 GDPR) and to inform you without undue delay if the breach is likely to result in a high risk (Art. 34 GDPR).
8. Your rights
In accordance with the GDPR and the French Data Protection Act (loi Informatique et Libertés), you have the following rights over your data:
| Right of access | Obtain confirmation that data concerning you is being processed and obtain a copy of it (Art. 15 GDPR). |
| Right to rectification | Have inaccurate or incomplete data corrected (Art. 16 GDPR). Directly accessible from your Settings. |
| Right to erasure | Right to be forgotten: request the deletion of your data under the conditions set out in Art. 17 GDPR (except where legal retention obligations apply). |
| Right to data portability | Receive your data in a structured, commonly used and machine-readable format (Art. 20 GDPR). Export available from the Service. |
| Right to object | Object to processing based on Tribulys's legitimate interest (Art. 21 GDPR), unless there are compelling legitimate grounds. |
| Right to restriction of processing | Obtain the restriction of processing in certain situations (Art. 18 GDPR). |
| Withdrawal of consent | Withdraw your consent to the processing of health data at any time, without affecting the lawfulness of processing carried out before its withdrawal. |
| Automated decision-making | Tribulys does not carry out any automated decision-making or profiling producing legal effects concerning you. |
To exercise any of these rights, send your request by email to privacy@tribulys.fr attaching a copy of proof of identity. We undertake to respond within one month (Art. 12 GDPR), extendable by two months in the case of a complex request.
10. Health Data Hosting (HDS)
11. Complaints: supervisory authority
If you consider that the processing of your data does not comply with the GDPR, you have the right to lodge a complaint with the competent supervisory authority, in France the Commission Nationale de l'Informatique et des Libertés (CNIL) :
| Website | www.cnil.fr |
| Postal address | CNIL, 3 Place de Fontenoy, TSA 80715, 75334 Paris Cedex 07 |
| Phone | +33 (0)1 53 73 22 22 |
We encourage you to contact us first at privacy@tribulys.fr in order to resolve any issue amicably.
12. Changes to this policy
Tribulys reserves the right to modify this policy at any time to reflect changes to the Service, regulations or our practices. In the event of a substantial change, users will be notified by email with 30 days' notice. The update date shown at the top of this page is authoritative.