Privacy policy
LISA is a habit-coaching service for people living with Crohn’s disease, ulcerative colitis or irritable bowel syndrome (IBS). To do that job it necessarily handles information about your health. This page says exactly what we hold, why, who else touches it, and what you can make us do about it.
This policy covers the LISA website and the LISA application.
1. Who is responsible
The controller of your personal data is KAPTOR, a French SARL with share capital of €10,000, registered office Hangar 15, Quai des Chartrons, 33300 Bordeaux, France, registered under SIREN 894 296 466 (RCS Bordeaux). It acts through its manager, Arnaud Autran.
For anything in this policy — including every request under section 6 — write to hello@startwithlisa.com. A person reads it. We answer within one month.
2. What we collect
Account data. Your email address and authentication identifiers, so you can sign in and so we know whose plan is whose.
Onboarding and questionnaire answers. What you tell us at sign-up about your diagnosis, symptoms, energy, sleep, diet and daily life. This is health data. It is the input the plan is built from.
Your plan and your progress. Which habits you were given, which days you held them, which are earned and which are still locked.
Your conversations with the coach. Everything you write to Lisa, and everything she writes back, including the daily check-ins.
Subscription data. Your subscription status, its renewal dates, and the customer identifier given to us by our payment provider. We never see or store your card number.
Contact form submissions. Your name, email address, the subject you picked and your message.
“Send me a few tips” requests. Only the email address you type into that box on the home page. It is used to send you that one email and is not added to any list — we keep no copy of it once the message is sent.
Technical data. Server logs from our hosting and functions provider, kept for security and debugging.
We do not collect your postal address, your phone number, your social-security or insurance numbers, or any document from your medical file.
3. Why we are allowed to hold it
| What | Why | Legal basis |
|---|---|---|
| Account, plan, progress, subscription | Running the service you paid for | Performance of a contract — GDPR Art. 6(1)(b) |
| Health data: questionnaire answers, coach conversations | Building and adapting your plan, and pausing it when you report a warning sign | Your explicit consent — GDPR Art. 9(2)(a) |
| Contact form | Answering you | Your consent — Art. 6(1)(a) |
| “Send me a few tips” | Sending you that one email | Your consent — Art. 6(1)(a) |
| Server logs, anti-abuse measures | Keeping the service up and unabused | Legitimate interest — Art. 6(1)(f) |
| Invoices and accounting records | We are required to keep them | Legal obligation — Art. 6(1)(c) |
Health data is a special category under Article 9 of the GDPR. We process it only on the basis of the explicit consent you give when you start onboarding. You can withdraw that consent at any time — see section 6. Withdrawing it means we can no longer run a plan for you, so it ends the service.
4. Who else touches your data
We do not sell your data. We do not use it to train anyone’s general-purpose models. No health information — your condition, your symptoms, your questionnaire answers, your conversations or your plan — is ever shared with an advertising platform.
If, and only if, you accept advertising cookies, we do share with Meta and TikTok the fact that a browser reached a step in the funnel: created an account, started a checkout, or subscribed, plus the amount of a subscription. See the cookie policy for exactly what that involves and how to refuse it. These are the only third parties involved, each doing one job:
Google Ireland Limited / Google LLC — Firebase. Authentication, database, server functions and
hosting. Your account data, plan, progress and conversations are stored here. Servers are in the
United States (us-central1).
Anthropic PBC — the AI coach. The content of your conversations and the plan context needed to answer you are sent to Anthropic’s API to generate Lisa’s replies. Your name, email address and account identifiers are not sent. Anthropic processes the request, returns the reply, and does not use it to train its models. Servers are in the United States.
Stripe Payments Europe, Ltd. Payment and subscription management. Stripe receives your email address and your payment details directly — your card details go to Stripe, never to us.
Sendinblue SAS (Brevo). Sending the daily check-in emails and delivering contact-form messages. Receives your email address and the content of the message being sent. Servers are in the European Union.
Axeptio SAS — the consent banner. Records and stores the cookie choice you make, which is what lets us prove your preference was respected. Servers are in the European Union. This one runs without asking, because it is the thing that does the asking.
PostHog, Inc. — audience measurement. Only if you accept. Counts how many people reach each
step of the site, using the European Union cluster (eu.i.posthog.com). Receives no health
data and no account content.
Meta Platforms Ireland Ltd. and TikTok Technology Limited — advertising measurement. Only if you accept. Receive the funnel step reached and, for a subscription, the amount. Where an email address is involved it is sent only as an irreversible SHA-256 fingerprint computed on our servers. Both are joint controllers with us for this measurement.
Transfers outside the EU. Firebase and Anthropic process data in the United States, as may Meta and TikTok. Those transfers rely on the European Commission’s Standard Contractual Clauses, together with the EU–US Data Privacy Framework where the provider is certified under it.
5. How long we keep it
- Account, plan, progress and conversations: for as long as your account exists, then deleted within 30 days of you closing it or asking us to.
- Subscription and invoice records: 10 years, because accounting law requires it.
- Contact form messages: the message is emailed to us and is not stored in any database. It lives in our mailbox, and we delete it within 12 months of the matter being closed.
- “Send me a few tips” addresses: not kept at all. The address goes onto the outgoing message and is never written to a database or a mailing list, so there is nothing to unsubscribe from.
- Anti-abuse counters for the two landing-page forms: an irreversible hash of your IP address, kept 24 hours. The IP address itself is never written down.
- Server logs: 30 days.
6. Your rights
You can ask us to give you a copy of your data, correct it, delete it, hand it over in a portable format, restrict what we do with it, or object to a particular use. You can withdraw your consent to health-data processing at any time, which ends the service going forward but does not undo what was lawful before. You can also tell us what should happen to your data after your death, under French law n°2016-1321.
To exercise any of these, email hello@startwithlisa.com. We reply within one month.
If you think we have got it wrong, you can complain to the CNIL — cnil.fr — or to the courts.
7. Automated decisions
Lisa is built on a large language model, so parts of your plan are generated automatically. It is not a decision that produces legal effects for you: it is a suggestion of daily habits, drawn from a fixed, human-curated catalogue, with rules in code limiting what may ever be recommended. Medication and medical treatment are never in scope. A human being — you — decides whether to act on any of it.
8. Cookies and tracking
Nothing is set until you accept it. No analytics, no advertising pixel, no third-party script of any kind loads before you have made a choice on the banner, and refusing is one click, exactly like accepting. There is no session recording at all.
If you accept, we use PostHog to count how many people reach each step of the site, and the Meta and TikTok pixels to measure which advertisements lead to a subscription. The cookie policy lists every cookie, its purpose and its duration, and you can change your mind at any time through Cookie preferences at the bottom of every page.
Some measurement is sent from our servers rather than your browser, because a payment finishes on Stripe’s site where the browser cannot observe it. That is not a way around your choice: your decision is stored against your account, and nothing is sent for anyone who refused.
The application separately stores what is strictly necessary to keep you signed in. That is an essential function, exempt from consent, and it is not used to track you.
9. Children
LISA is for adults. You must be 18 or over to subscribe.
10. Security
Traffic is encrypted in transit. Access to the database is governed by per-user rules so one account cannot read another’s data, and the parts of your record written by the service — your plan, your conversations, your billing status — cannot be altered from a client at all. If a breach ever affects your rights and freedoms, we will tell you and the CNIL, as the law requires.
11. Changes
We may update this policy to keep it accurate and lawful. The date at the top always reflects the last change. If a change materially affects how we handle health data, we will tell you directly rather than quietly editing this page.