Skip to main content

Privacy Policy

Data controller

D2R SOLUTIONS, a simplified joint‑stock company (SAS), 20 rue de Villenauxe, 51120 Nesle‑la‑Reposte, France, is the data controller for personal data collected on reflexolib.com.

For any question regarding your data, or to exercise your rights: hello@reflexolib.com

Data we collect

Visitors — pages viewed, referring site, screen width and browser language. Your IP address is not stored: it is transformed, together with your browser, into an identifier that cannot be traced back to you.

Clients — first name, last name, email address, telephone number, history of your appointments, reviews posted, notification preferences, and messages exchanged with your practitioner.

Practitioners — first name, last name, email address, telephone, SIRET, ADELI number where applicable, office address and its geographic coordinates, presentation, diplomas, specialties, photographs, services, rates, opening hours. For subscribed practitioners: billing data. Practitioners who use the ReflexoDesk software keep their clients’ files on their own computer; these files are not transmitted to us.

What these data are used for

  • create and manage your account;
  • publish practitioner profiles in the directory and search engines;
  • connect clients and practitioners, and manage appointments;
  • send messages related to an appointment: confirmation, reminder, request for review;
  • send the newsletter, if you have consented;
  • collect subscriptions from practitioners;
  • measure site traffic;
  • fulfil our accounting and legal obligations.

On what legal basis

  • Performance of the contract: account, appointment, profile publication, subscription.
  • Consent: newsletter, and linking a Google profile by the practitioner. You may withdraw it at any time.
  • Legitimate interest: traffic measurement, service security, abuse prevention.
  • Legal obligation: invoicing and accounting retention.

Who receives your data

We do not sell or rent your data. They are transmitted only to the service providers necessary for the operation of the service:

Stripe *(United States and European Union)* — billing data of subscribed practitioners. Your bank details are entered directly with Stripe and never pass through our servers.

Google *(United States)* — the address of a practitioner’s Google profile that they have linked, in order to read the reviews. The photographs of the review authors, as well as the site fonts, are loaded by your browser from Google’s servers, which therefore receive your IP address. For practitioners who have connected it: the occupied slots of their Google calendar.

Ollama *(United States)* — the published contents that we automatically translate into the other languages of the site, practitioner profiles included. No client data is sent there.

Our messaging service *(France)* — recipient email addresses and the content of messages related to appointments and the newsletter.

A practitioner accesses the data of clients who have booked an appointment with them, and becomes responsible for its use.

Your data may finally be disclosed to a judicial or administrative authority that requests it in the forms provided by law.

Transfers outside the European Union

Stripe, Google and Ollama are established in the United States. These transfers rely on the European Commission’s standard contractual clauses and, for providers that have adhered, on the EU‑US data‑protection framework.

The site hosting and its database remain in France, on our own infrastructure.

How long we keep them

  • Active account: as long as your account exists, then 3 years after its deletion.
  • Appointments: 5 years.
  • Accounting records and invoices: 10 years, as required by law.
  • Traffic measurement: 90 days in detail, then as daily totals without individual data.
  • Reviews: as long as the practitioner’s profile exists.
  • Address subscribed to the newsletter: until you unsubscribe, then only proof of unsubscription is retained.

Google reviews are not retained by us: they are read from Google at display and erased from our memory no later than twenty‑four hours, only the practitioner’s profile address being recorded.

Your rights

You have the right of access, rectification, erasure, restriction, objection, portability, and the right to withdraw your consent at any time.

To exercise them, write to hello@reflexolib.com. We respond within one month. We may ask you to verify your identity if a serious doubt exists.

If our response does not satisfy you, you may contact the French data‑protection authority: www.cnil.fr.

Cookies

This site does not place any cookie, nor audience‑measurement, advertising, or social‑network cookies. No consent banner is therefore shown.

To keep you logged in, your browser stores an authentication token in its local storage. It remains on your device, is transmitted only to our servers to identify you, and disappears on logout. You can delete it by clearing site data in your browser.

Our traffic measurement does not rely on any persistent identifier: it does not track you from one visit to another.

Security

  • Encryption of exchanges via HTTPS.
  • Passwords stored as bcrypt hashes, never in plain text.
  • Data access compartmentalised by role: a practitioner sees only their clients.
  • Connection secrets to third‑party services encrypted at rest.
  • Regular backups of the database, kept on our infrastructure.

No system being infallible, we would inform you without delay, as well as the CNIL, in case of a data breach likely to prejudice you.

Changes

This policy may evolve with the service. Any substantial modification will be notified to you by a message if you have an account.