Privacy policy

Data controller

TENET HOLDING, 6 rue d’Armaillé, 75017 Paris — bonjour@hebeia.life.

Quotes and coordination

Requests sent to the concierge service help prepare a quote and coordinate appointments: contact details, availability and practical requirements. Do not send results, prescriptions, reports or medical reasons. Quote preparation is based on requested pre-contractual steps; support is based on contract performance.

Hair questionnaire

The five answers to the hair questionnaire only adapt the screens displayed in your browser. They are not saved in a database, cookie or browser storage, or sent to HEBEIA, the physician or Doctolib. This questionnaire asks for no name, email, document or photograph. A new visit starts without remembered answers. The final link opens Doctolib, which applies its own privacy policy.

Payment and records

Stripe collects billing details and payment data on its own secure page. HEBEIA does not receive your full card number. For orders placed through a payment link, Stripe stores references, the product, amount, billing details and payment status. For legacy private quotes, Cloudflare D1 stores opaque quote and payment references, service level, price, VAT rate, accepted services and terms, early-start choice, dates and payment or refund status. The private quote link grants access to this summary: do not share it publicly.

Recipients

Authorised TENET HOLDING staff access information necessary for their work. Cloudflare provides hosting and security; Stripe processes payments; email is used for administrative correspondence. Professionals receive only the practical information needed for coordination with you. Medical results are exchanged directly between you and the relevant professionals.

Retention

Administrative correspondence is retained during the service, then archived within statutory evidence and limitation periods. Accounting documents and supporting records are retained for ten years from the close of the financial year. Data no longer needed for contractual or legal purposes is deleted. Opening notifications remain consent-based and are deleted after notification or withdrawal of consent.

Your rights

Contact bonjour@hebeia.life to exercise applicable access, rectification, erasure, restriction, objection or portability rights. You can withdraw consent and lodge a complaint with the French CNIL.

Hosting, transfers and cookies

Where providers process data outside the European Union, transfers must be covered by GDPR safeguards. No advertising or audience-measurement trackers are enabled on the website. Banner dismissal is remembered for six months. Stripe applies its own policy on its checkout page.