Your data, plainly.

This website is a design concept published by its author as a portfolio piece. There is no clinic behind it: requests are not read by anyone outside the author and are never used to contact you.

Because no real controller exists, the protections below are built into the system itself rather than handled by a person.

Only what you type into the booking form:

• your name, phone number and email;
• the treatment you are thinking about and the time you chose;
• the booking code we create for you, and the history of its status (requested, confirmed, declined, completed, cancelled).

We do not ask for and do not store any health information, photographs or payment details. There are no patient accounts.

To arrange the consultation you asked for: hold the time, let the clinic confirm or decline it, and let you check or cancel it with your code. Basis: steps taken at your request before an agreement (GDPR, Article 6(1)(b)).

To keep the booking system safe: we limit the number of active requests per email and log failed attempts to open a booking (the code only, for one day). Basis: our legitimate interest in preventing abuse (Article 6(1)(f)).

We do not use your data for advertising, profiling or newsletters.

Only the clinic team signed in to the clinic desk. You see your own booking with your code and email; nobody else can read it.

• Supabase stores the bookings in its European region (Ireland), as our processor.
• Vercel hosts the website and keeps short technical logs of visits (such as IP address).
• Typefaces are loaded from Google Fonts and one script from the unpkg CDN; these services see your IP address when the page loads.

Vercel and Google are US companies; where data leaves the European Union they rely on the EU–US Data Privacy Framework or standard contractual clauses.

• Booking requests: deleted 30 days after the chosen time, whatever their status.
• Failed attempts to open a booking: one day.
• Clinic team accounts: until the person leaves the team.

This site sets no cookies and uses no analytics. Your browser keeps two small notes for the current tab only: your booking code (so the booking page can fill it in) and whether you have already seen the opening animation. The clinic desk keeps its team members signed in on their own device.

You can ask to see, correct or delete your data, to restrict or object to its use, to receive it in a portable format, and to leave instructions for what happens to it after your death. Every request is deleted automatically 30 days after its time, and you can stop it at once yourself.

To stop a request at once, cancel it on the booking page.

If you think your data is mishandled, you can complain to the French data protection authority, the CNIL: 3 Place de Fontenoy, TSA 80715, 75334 Paris Cedex 07, cnil.fr.

If this page changes, the new version and its date appear here. In force since 22 October 2026.