Privacy policy

Controller and scope

Aïda Hamzi is the controller for the website. Her enterprise number, administrative address and practice address are stated above. This policy covers browsing, contact and PDF sales; the website provides neither patient records nor online care.

Data and legal bases — GDPR Article 6

Contact: name, email, subject and message to answer your request; Article 6(1)(b) for pre-contractual steps you request, or Article 6(1)(f) for other correspondence and reasonable follow-up. The legitimate-interest assessment must be documented. The form checkbox acknowledges the information; it is not general consent to processing.

Orders: email supplied by Stripe, products, prices, references, payment status, access and quotas; Article 6(1)(b) to perform the sale and deliver PDFs. Evidence of terms and express choices includes version, hash, basket and server timestamp; Article 6(1)(f) to establish and defend rights. Invoicing and accounting: Article 6(1)(c), subject to confirming the applicable duties. The website does not receive full card numbers.

Stripe Checkout collects your name, billing address and, where applicable, the legal business name and VAT number. Stripe retains this information for invoicing; it is not stored in the website’s order database.

Security: IP address, URL, timestamps, browser technical information and Turnstile token; Article 6(1)(f) to prevent abuse and protect access. Withdrawal and refunds: identity, email, reference and statement to meet legal duties (Article 6(1)(c)). The site adds no marketing or advertising tracking. Required data are marked in forms; without them a reply or delivery may be impossible.

Health and children — Articles 8 and 9

Do not send diagnoses, assessments, medical records or patient information through contact, checkout or withdrawal forms. Health data are unnecessary to buy a PDF. If sensitive data nevertheless arrive, access must be restricted and necessity assessed before retention; encryption does not anonymise them.

An Article 6 basis is insufficient for health data: a separate Article 9(2) condition is required. Explicit consent (9(2)(a)) or care (9(2)(h), with Article 9(3) safeguards) cannot be invoked without checking the conditions, professional status and applicable confidentiality duties. This site assumes no care-related basis. [TO CONFIRM: accidental sensitive-data protocol and legal framework for records kept outside this website].

Parents and representatives should provide only essential administrative information when contacting us. Children need age-appropriate information and the representative’s authority must be checked. Belgium’s age threshold of 13 concerns only consent to information-society services offered directly to a child; it does not itself authorise health processing or purchases. There are no child accounts or child profiling.

Recipients and international transfers

Cloudflare: processor for data entrusted to Pages/Functions, D1, R2 and the encrypted relay under its DPA; its own account and security operations follow its policy. Turnstile verifies requests. Stripe: processor for instructed services, separate controller particularly for fraud, financial obligations and its own purposes. Roles depend on each processing activity, not only the provider’s name.

Resend (Plus Five Five, Inc.): processor for confirmations, personal links and acknowledgements; separate controller for account and usage data. Its DPA provides for processing primarily in the United States and standard contractual clauses. Cloudflare provides clauses for relevant transfers and the Data Privacy Framework where applicable; Stripe provides a transfer addendum. These are available safeguards, not proof of their applicability to our accounts.

Google Search Console monitors indexing and performance in Google Search. It is not Google Analytics: the site code integrates no Google Analytics, GTM or Google audience tracking script. Google processes searches within its own service; this site adds no transfer of form or order data to Google. Ownership verification and sitemap submission do not add a tracker to pages.

Contacts and requests also reach the recipient’s Outlook mailbox (Microsoft). This service, visible in the contact address, must be included in the inventory; account type, terms, locations and exact role remain to be confirmed. No other direct provider was identified in the processing reviewed. Providers may nevertheless engage further subprocessors.

[TO CONFIRM: actual contracting entities, accepted DPAs, subprocessor lists, countries, validity and scope of adequacy or standard clauses and transfer assessments with supplementary measures]. Exclusively Belgian or European processing is not guaranteed. Request information and a copy of safeguards at the contact address.

Actual retention and outstanding decisions

PDF access: 7 days after payment, links up to 48 hours, 3 downloads per product. Expiry does not erase orders, evidence or backups. Before payment the access cookie expires no later than 7 days after the Checkout session; an authenticated visit then shortens it to the end of paid access.

Messages remain in the recipient mailbox with no intentional browser-storage copy. Orders, choices, quotas and outbox remain in D1; tokens are hashed and order-email bodies encrypted at rest. Withdrawal requests are encrypted in D1 and acknowledged by email. No general automatic deletion of these records is promised or implemented.

Retention policy defined for activation before opening: contacts without a sale, 12 months after closure for reasonable follow-up; ordinary purchase support, 2 years after closure for conformity follow-up. These are minimisation choices, not universal statutory periods. A dispute justifies a separate archive limited to necessary evidence until final settlement and expiry of applicable remedies.

Minimum evidence of orders, choices, supply and withdrawal: restricted archive target of 10 years after performance or closure, to validate against applicable limitation rules, without retaining every technical datum for 10 years. Accounting and tax evidence: determine the applicable period from actual status, financial year and VAT regime; [TO CONFIRM: exact Belgian obligation and starting date, including 10-year tax retention where applicable]. This point was not validated through an accessible official source during this review.

Abuse keys and technical logs controlled by the publisher: target 30 days except a documented incident; withdrawal throttling still uses a one-hour window and daily key. Secrets and tokens: initial browser access capped at 8 days, reduced to day 7 after payment; initial server authorisation 30 days, paid access always 7 days; links at most 48 hours. Expired tokens must no longer be usable.

Current operation: access expiry is enforced, but mailbox, D1 archives, encrypted email bodies, abuse keys and backups are not automatically purged. Integrity controls make some D1 records immutable; an approved archive and erasure procedure is required before promising these periods. Monthly review and restricted access are part of the procedure awaiting approval. Provider log and backup periods require separate confirmation; this policy does not authorise unlimited retention.

Security and encryption limits

The contact form encrypts name, email, subject and message in the browser using the verified OpenPGP public key. The server relays them without decrypting those fields. HTTPS, server-side Turnstile verification and access checks protect exchanges. No system guarantees absolute security.

Fields exist in plain text before encryption; compromised browsers or scripts can expose them. Metadata and Turnstile tokens are not end-to-end encrypted. Ordinary replies, checkout and withdrawal acknowledgements do not use the contact form’s OpenPGP encryption. Encrypted outbox storage does not prevent email providers from accessing sent messages.

Your rights and complaints

You may request access, rectification, erasure, restriction, portability where applicable and object to processing based on legitimate interests. Where processing relies on consent, you can withdraw it for the future as easily as you gave it. Rights have conditions and exceptions; evidence may need to be retained for legal duties or disputes.

Write to the address below. Proportionate identity checks may be requested if there is doubt, without routinely requesting an identity-card copy. Replies are normally due within one month; a justified two-month extension may be notified during that first month. You can complain to the Belgian Data Protection Authority, rue de la Presse 35, 1000 Brussels, through its official website. The site’s code adds no automated decision with legal effects under Article 22; Stripe’s own fraud checks are also covered by its information.