Privacy policy
LISA is a habit-coaching service for people living with Crohn’s disease, ulcerative colitis or irritable bowel syndrome (IBS). It also welcomes people who have digestive symptoms but no diagnosis yet, and asks them to see a doctor. To do that job it necessarily handles information about your health. This page says exactly what we hold, why, who else touches it, and what you can make us do about it.
This policy covers the LISA website and the LISA application.
1. Who is responsible
The controller of your personal data is KAPTOR, a French SARL with share capital of €10,000, registered office Hangar 15, Quai des Chartrons, 33300 Bordeaux, France, registered under SIREN 894 296 466 (RCS Bordeaux). It acts through its manager, Arnaud Autran.
For anything in this policy — including every request under section 6 — write to hello@startwithlisa.com. A person reads it. We answer within one month.
2. What we collect
Account data. Your email address and authentication identifiers, so you can sign in and so we know whose plan is whose.
Onboarding and questionnaire answers. What you tell us at sign-up about your diagnosis, symptoms, energy, sleep, diet and daily life. This is health data. It is the input the plan is built from.
Your answers to the doctor card. If you have no diagnosis yet or report a warning sign, a card asks whether you already see a doctor for your gut, whether you have booked an appointment and, a week later, how it went. We keep those answers and the dates the card was shown and answered, so it can come back at the right time. This is health data.
“Your answers”, the summary for your doctor. The card can put together, on your phone, a summary of the answers you already gave us. It is built on your phone and is not sent to us or stored by us. If you share it, your phone’s share menu sends it to the person or app you choose; we do not see it and are not part of that exchange.
Your plan and your progress. Which habits you were given, which days you held them, which are earned and which are still locked.
Your conversations with the coach. Everything you write to Lisa, and everything she writes back, including the daily check-ins.
Subscription data. Your subscription status, its renewal dates, and the customer identifier given to us by our payment provider. We never see or store your card number.
Contact form submissions. Your name, email address, the subject you picked and your message.
“Send me a few tips” requests. Only the email address you type into that box on the home page. It is used to send you that one email and is not added to any list: we keep no copy of it once the message is sent.
How you arrived and how far you went. The campaign tags and the advertisement numbers in the link you followed, the page you landed on (without advertising click identifiers unless you accepted advertising), your cookie choice, and the dates of the sign-up steps you reached (questionnaire started, checkout started or abandoned). Recorded for every visitor who starts the questionnaire.
Technical data. Server logs from our hosting and functions provider, kept for security and debugging.
We do not collect your location, your postal address, your phone number, your social-security or insurance numbers, or any document from your medical file. When LISA asks you to see a specialist near you, it does not ask where you live and does not use your phone’s location.
3. Why we are allowed to hold it
| What | Why | Legal basis |
|---|---|---|
| Account, plan, progress, subscription | Running the service you signed up for, free or paid | Performance of a contract, GDPR Art. 6(1)(b) |
| Health data: questionnaire answers, doctor card answers, coach conversations | Building and adapting your plan; when you have no diagnosis yet or report a warning sign, giving you a general plan and a card asking you to see a doctor, and bringing it back until you have booked; preparing on your phone the summary of your answers | Your explicit consent, GDPR Art. 9(2)(a) |
| Contact form | Answering you | Your consent, Art. 6(1)(a) |
| “Send me a few tips” | Sending you that one email | Your consent, Art. 6(1)(a) |
| Advertising campaign statistics (totals only) | Counting, as totals per advertisement, campaign, week and version of the questionnaire, how many visitors reach each step of sign-up and how many become customers, to decide where to spend our advertising budget. Only totals leave our database; small totals are withheld; nothing goes to an advertising platform | Legitimate interest, GDPR Art. 6(1)(f). You can object (section 6) |
| Server logs, anti-abuse measures | Keeping the service up and unabused | Legitimate interest, Art. 6(1)(f) |
| Invoices and accounting records | We are required to keep them | Legal obligation, Art. 6(1)(c) |
Health data is a special category under Article 9 of the GDPR. We process it only on the basis of the explicit consent you give when you start onboarding. You can withdraw that consent at any time (see section 6). Withdrawing it means we can no longer run a plan for you, so it ends the service.
4. Who else touches your data
We do not sell your data. We do not use it to train anyone’s general-purpose models. No health information (your condition, your symptoms, your questionnaire answers, your conversations or your plan) is ever shared with an advertising platform.
If, and only if, you accept advertising cookies, we do share with Meta and TikTok the fact that a browser reached a step in the funnel: created an account, started a checkout, or subscribed, plus the amount of a subscription. See the cookie policy for exactly what that involves and how to refuse it. These are the only third parties involved, each doing one job:
Google Ireland Limited / Google LLC: Firebase. Authentication, database, server functions and
hosting. Your account data, plan, progress and conversations are stored here. Servers are in the
United States (us-central1).
Anthropic PBC: the AI coach. The content of your conversations, and the plan context and questionnaire answers needed to answer you (including, where it applies, that you have no diagnosis yet or reported a warning sign), are sent to Anthropic’s API to generate Lisa’s replies. Your name, email address and account identifiers are not sent. Anthropic processes the request, returns the reply, and does not use it to train its models. Servers are in the United States.
Stripe Payments Europe, Ltd. Payment and subscription management. Stripe receives your email address and your payment details directly: your card details go to Stripe, never to us.
Sendinblue SAS (Brevo). Sending the daily check-in emails and delivering contact-form messages. Receives your email address and the content of the message being sent. Servers are in the European Union.
Axeptio SAS: the consent banner. Records and stores the cookie choice you make, which is what lets us prove your preference was respected. Servers are in the European Union. This one runs without asking, because it is the thing that does the asking.
PostHog, Inc.: audience measurement. Only if you accept. Counts how many people reach each
step of the site, using the European Union cluster (eu.i.posthog.com). Receives no health
data and no account content. Separately, and for everyone, PostHog receives the nightly campaign
totals described in section 3, which carry no identifier.
PostHog, Inc.: crash reports. Sent without asking, on the basis of our legitimate interest in a service that works. When a page fails, PostHog receives a technical description of the error, the version of the application, the page concerned and, if you are signed in, your account identifier. No cookie is set for this and no profile of you is built from it unless you have accepted audience measurement. It receives no health data, none of your answers and none of your messages. Same European Union cluster.
Meta Platforms Ireland Ltd. and TikTok Technology Limited: advertising measurement. Only if you accept. Receive the funnel step reached and, for a subscription, the amount. Where an email address is involved it is sent only as an irreversible SHA-256 fingerprint computed on our servers. Both are joint controllers with us for this measurement.
Transfers outside the EU. Firebase and Anthropic process data in the United States, as may Meta and TikTok. Those transfers rely on the European Commission’s Standard Contractual Clauses, together with the EU–US Data Privacy Framework where the provider is certified under it.
5. How long we keep it
- Account, plan, progress, doctor card answers and conversations: for as long as your account exists, then deleted within 30 days of you closing it or asking us to.
- “Your answers”, the summary for your doctor: not kept by us. It exists only on your phone and wherever you choose to share it.
- Subscription and invoice records: 10 years, because accounting law requires it.
- Contact form messages: the message is emailed to us and is not stored in any database. It lives in our mailbox, and we delete it within 12 months of the matter being closed.
- “Send me a few tips” addresses: not kept at all. The address goes onto the outgoing message and is never written to a database or a mailing list, so there is nothing to unsubscribe from.
- Anti-abuse counters for the two landing-page forms: an irreversible hash of your IP address, kept 24 hours. The IP address itself is never written down.
- Server logs: 30 days.
6. Your rights
You can ask us to give you a copy of your data, correct it, delete it, hand it over in a portable format, restrict what we do with it, or object to a particular use. You can withdraw your consent to health-data processing at any time, which ends the service going forward but does not undo what was lawful before. You can also tell us what should happen to your data after your death, under French law n°2016-1321.
To exercise any of these, email hello@startwithlisa.com. We reply within one month.
If you think we have got it wrong, you can complain to the CNIL — cnil.fr — or to the courts.
7. Automated decisions
Lisa is built on a large language model, so parts of your plan are generated automatically. It is not a decision that produces legal effects for you: it is a suggestion of daily habits, drawn from a fixed, human-curated catalogue, with rules in code limiting what may ever be recommended. Medication and medical treatment are never in scope. A human being, you, decides whether to act on any of it.
Whether you see a doctor card, and whether you get the general plan or the full plan, is set by fixed rules from the answers you give: no diagnosis yet, or a warning sign such as blood in your stool. It is not a judgement about your health. You can change your answers in the app, and if you think the result is wrong, write to hello@startwithlisa.com: a person reads every message.
8. Cookies and tracking
No tracker runs until you accept it. No advertising pixel and no audience measurement runs in your browser before you have made a choice on the banner, and refusing is one click, exactly like accepting. There is no session recording at all. What the questionnaire needs to work is stored without asking and is listed in the cookie policy.
One thing is sent from your browser to another company without asking: a crash report when a page fails, described in section 4. It sets no cookie, reads nothing from your device and carries no health data.
If you accept, we use PostHog to count how many people reach each step of the site, and the Meta and TikTok pixels to measure which advertisements lead to a subscription. The cookie policy lists every cookie, its purpose and its duration, and you can change your mind at any time through Cookie preferences at the bottom of every page.
Some measurement is sent from our servers rather than your browser, because a payment finishes on Stripe’s site where the browser cannot observe it. That is not a way around your choice: your decision is stored against your account, and no event about you is sent to Meta, TikTok or PostHog if you refused. Separately, our servers count, as totals only and for everyone, how many visitors from each advertisement reach each step of sign-up (section 3, “Advertising campaign statistics”). You can object to being counted (section 6).
The application separately stores what it needs to keep your progress in the questionnaire and, once you have an account, to keep you signed in. It is listed in the cookie policy and it is not used to track you.
9. Children
LISA is for adults. You must be 18 or over to subscribe.
10. Security
Traffic is encrypted in transit. Access to the database is governed by per-user rules so one account cannot read another’s data, and the parts of your record written by the service — your plan, your conversations, your billing status — cannot be altered from a client at all. If a breach ever affects your rights and freedoms, we will tell you and the CNIL, as the law requires.
11. Changes
We may update this policy to keep it accurate and lawful. The date at the top always reflects the last change. If a change materially affects how we handle health data, we will tell you directly rather than quietly editing this page.