Privacy policy

Data controller

The data controller is SKEEWAI, a French simplified joint-stock company (SAS), 75 route de Lyons-la-Forêt, 76000 Rouen, France, registered with the Rouen Trade and Companies Register under number 898 628 524, publisher of the website and of the Recov'Up applications.

For any question about your personal data or to exercise your rights: contact@recovup.fr.

Data we collect

On this website. The contact form collects what you type into it: profile, first name, surname, organisation, email address, phone number if you give it, and your message. The site stores your display language in your browser's local storage, without any identifier. It sets no cookies.

Data common to all applications.

• Identity and account: first name, surname, email address, password (stored hashed, never in clear text), and optionally a nickname, a profile picture and a language.
• Declarative profile, filled in at set-up: type of job, goals, interests and, depending on the application, declarative health information (presence of pain, wellbeing needs, conditions). This data is only processed if you enter it.
• Login and security: session tokens, login attempts, timestamps, IP address and device type in our audit logs.
• Consents: type, version, date, IP address and user agent, for the traceability required by the GDPR.
• Notifications: device notification token and preferences.
• Subscription: status, product, platform (Apple or Google), price and currency. We neither collect nor store any bank details.
• Content and support: messages sent to support, content you publish, files you may upload.

Wellbeing and health data (special category, Article 9 GDPR). Depending on the application, and only from what you enter voluntarily: mood, personal journal, habits, answers and scores on screening questionnaires (for example PHQ-9, GAD-7), assessments (musculoskeletal disorders, sleep), care or rehabilitation pathway data. This data is processed on the basis of your explicit consent and benefits from the reinforced measures described below. Details per application are in the last section.

Activity, sensor and location data. Some applications, only with your permission and when you enable the feature concerned, may access your physical activity (steps, calories via Apple Health or Health Connect), your location (route tracking), your microphone (sleep analysis), your camera (profile picture, movement games) or Bluetooth devices (gym equipment).

We use no advertising identifier and run no targeted advertising.

Purposes and legal bases

• Answering a request sent from the website: legitimate interest (Article 6.1.f), then pre-contractual steps if a commercial discussion follows.
• Creating and managing your account, authenticating you: performance of the contract (Article 6.1.b).
• Providing the wellbeing and health features you use: explicit consent (Article 9.2.a).
• Tracking your activity, challenges and progress: consent (Article 6.1.a) or performance of the contract.
• Sending you notifications and reminders: consent (Article 6.1.a), revocable at any time.
• Managing subscriptions and access to premium content: performance of the contract (Article 6.1.b).
• Ensuring security, preventing fraud and abuse: legitimate interest (Article 6.1.f).
• Meeting our legal, accounting and health data hosting obligations: legal obligation (Article 6.1.c).
• Improving the service through aggregated and anonymised statistics: legitimate interest (Article 6.1.f).

Retention periods

We keep your data for as long as necessary, then delete or anonymise it.

• Requests sent from the website: three years after the last exchange.
• Account data (identity, email address): for the life of the account, then deletion three years after closure.
• Wellbeing and health data: five years, in line with health data hosting obligations.
• Published content (messages, posts): until you delete it or close your account.
• Technical and login logs: twelve months at most, then anonymisation (Article L34-1 of the French Postal and Electronic Communications Code).
• Invoices and subscription data: ten years (Article L123-22 of the French Commercial Code).

Recipients and processors

Your data is neither sold, rented nor used for advertising. It may be shared with processors acting on our behalf, strictly to the extent necessary:

• AZNETWORK, HDS-certified host: hosting of the applications' servers and data, including health data.
• Vercel Inc.: hosting of this website.
• Resend: transactional emails from the applications and delivery of contact form messages.
• Calendly: appointment booking, in a window embedded in the site, only if you open the calendar.
• RevenueCat: subscription management (price, currency and platform only, no bank details).
• Google (Firebase Cloud Messaging) and Apple (APNs): delivery of notifications.
• Apple App Store and Google Play: distribution of the applications and payment handling.
• Recov'Up media servers: delivery of videos and content.

Health data is hosted in France by our HDS-certified provider. Some technical processors (notifications, stores, subscription management, website hosting) may process limited data outside the European Union; these transfers are governed by the European Commission's standard contractual clauses or equivalent mechanisms.

Health data hosting

Health data is hosted by a provider certified under the French HDS scheme (Hébergeur de Données de Santé), in accordance with Article L.1111-8 of the French Public Health Code. This certification imposes reinforced requirements of security, confidentiality, integrity, availability and traceability.

Security

We implement appropriate technical and organisational measures: encryption in transit (HTTPS, TLS), password hashing, access control and logging, data segregation per application, HDS hosting for health data, and on-device processing of the most sensitive data whenever possible (for example the sound analysis in Recov'Up Sommeil). In the event of a data breach likely to put your rights at risk, we will notify the persons concerned and the CNIL as required by law.

Your rights

Under the GDPR you have the rights of access, rectification, erasure, restriction, objection and portability, and the right to withdraw your consent at any time. Some rights can be exercised directly in the application (profile changes, account deletion). For any other request, write to contact@recovup.fr: we reply within one month. If you believe your rights are not respected, you may lodge a complaint with the CNIL, the French data protection authority (www.cnil.fr).

Deleting your account

You can delete your account at any time from the application (Settings, then Delete account), from the online deletion page below, or by writing to contact@recovup.fr. Requests are handled within thirty days at most. Deletion erases your associated personal data, subject to the legal retention periods above. Data stored locally on your device is erased on sign-out or uninstall.

Permissions and data minimisation

We only request the permissions strictly necessary for the feature you use, and each one is explained when requested. You can refuse or revoke them at any time in your device settings; some features may then be unavailable.

Minors

The service is not intended for people under fifteen, the age of digital consent in France. We do not knowingly collect data from minors without the consent of the holder of parental authority.

Provisions specific to each application

This section details, for each application, the data and permissions that add to the common base.

Recov'Up TMS (prevention of musculoskeletal disorders). Data: history of assessment batteries (scores, answers), self-reported daily fatigue level, progress. Permissions: camera (profile picture), notifications, background audio playback. No access to connected health data, location or microphone.

Recov'Up Challenge (activity challenges in the workplace). Data: step count and active calories read via Apple Health or Health Connect, including in the background; location, including in the background, to record the route of a run or walk; participation in challenges and teams; posts, comments, likes and messages; link to the company through a code. Apple or Google health data is aggregated and sent as totals: we do not receive your raw health history. Permissions: connected health, location, camera, notifications.

Recov'Up Santé Mentale (psychological wellbeing). Data: personal journal, daily mood, habits, breathing exercises, screening questionnaire results (PHQ-9, GAD-7: score and date), mood before and after a session. Permissions: local notifications, camera (profile picture). No access to connected health data, location or microphone. A support resources screen (French helpline 3114) is shown when a strong signal is detected.

Recov'Up Sommeil (sleep tracking). Data: sleep self-assessments including the Epworth score, derived night indicators (snoring, breathing pauses, movement, ambient sound level). Permissions: microphone, foreground service, notifications. Night sound analysis runs entirely on your device; no raw audio recording is sent to our servers. Any audio excerpts stay local and are automatically purged after 48 hours.

Recov'Up Soins (care and rehabilitation pathways). Data: care programme (condition, injury date, diagnostic elements, equipment), sessions and exercises, questionnaire answers, scores and progress, optional link to a practitioner. Permissions: camera (profile picture, image upload).

Recov'Up Cancer (support). Account and profile data, content viewed, journal and assessments depending on the features enabled. No sensitive native permission.

Recov'Up Accident du travail (follow-up after a workplace accident). Data: accident file (date, description, compensation elements) and related follow-up. No sensitive native permission.

Recov'Up Salle de sport (activities on gym equipment). Data: sessions (discipline, duration, calories, points), paired Bluetooth devices, gym identifier. Permissions: camera and microphone for movement games processed locally, Bluetooth to connect to machines. Location, where requested, is only a technical requirement of Bluetooth scanning on older Android versions and is not used to locate you.

Changes

We may update this policy. In the event of a substantial change, you will be informed by an appropriate means. The date of the last update appears at the top of the page.