Médicaliment
FR Try free for 3 days→
Médicaliment /Privacy

PRIVACY

Your data.
Explained clearly.

How Médicaliment processes the data necessary for it to work, for account security, and for the service.

Last updated: August 18, 2026

Draft to be finalized before publication
In brief

This page explains the categories of data Médicaliment may process, their purpose, and your rights. Items marked "to be confirmed" must be finalized before publication.

1. Data controller

Médicaliment is published by Platinium LTD. Contact: info@platinium.biz.

2. Data that may be processed

  • email address and information necessary for the account;
  • information voluntarily entered to use Médicaliment's features;
  • technical and security data necessary for operation;
  • information related to the subscription and transactions, depending on the payment provider;
  • requests sent to support.
Health-related data

The medications or other health information entered in Médicaliment may constitute sensitive data. The legal bases, safeguards and exact data flows must be aligned with the service's actual architecture before final publication.

3. Purposes

Data is used to provide the requested features, secure accounts, manage subscriptions, respond to support, prevent abuse, and comply with applicable obligations.

3a. MIA, the health assistant

Médicaliment includes MIA, an assistant that answers questions about medicines and health from official sources (package leaflets, public health pages). MIA is a service of Platinium LTD; its detailed privacy policy is available at mia.medicaliment.fr/privacy. Using it is optional and requires accepting that policy in the MIA screen.

  • Sign-in: the app sends your Médicaliment account token to the MIA service to check your subscription or trial. MIA keeps only a hash of the account identifier, a question counter and the date of your consent; no e-mail, name or token.
  • Questions: your question and the latest messages of the conversation are sent to the MIA service, then to OpenAI (United States) to write the answer. They are processed without being stored by MIA; OpenAI does not use them to train its models and may keep them for up to 30 days to detect abuse. This transfer outside the European Union is covered by the European Commission's standard contractual clauses.
  • Profile: only if you allow it in the MIA screen (a setting you can change at any time), the names of your conditions and medicines, as chosen in your Médicaliment profile, are sent with each question. This is health data: it is used only to find the leaflets and pages that concern you and to word the answer, is not kept by MIA, and is sent to OpenAI under the same conditions as the question. Your blood tests, diaries and other Médicaliment data are not sent.
  • Voice: speech recognition is provided by your phone or browser (Apple, Google); reading aloud happens on the device.
  • Legal basis: your explicit consent (Article 9(2)(a) GDPR), which you can withdraw by unticking the profile setting or by no longer using MIA.

MIA gives general information and does not replace medical advice.

4. Email address verification

Confirming the email address verifies that the user controls the address associated with their account and helps limit abuse of the trial period. It is separate from any marketing consent.

5. Marketing communications

The choice to receive news or commercial offers must be presented separately. Declining these communications does not prevent messages strictly necessary for the account, its security, or the service.

6. Payment

Payments are processed through the provider(s) presented during sign-up. The data actually received or retained by Médicaliment must match the actual integration.

7. Retention

  • Account (e-mail, hashed password, subscription and trial status, login dates and count, sign-up source): as long as the account exists. Deleting the account immediately erases this data, along with the related subscriptions, partner data and Stripe customer.
  • Login log (IP address, browser, date), used for security and abuse prevention: 180 days, then automatically deleted.
  • E-mail confirmation and password reset links: stored as a hash, valid for a limited time (from a few minutes to a few hours).
  • Health and tracking data entered in the app (conditions, treatments, food diary, blood glucose, weight, pain, test results, scans): stored only on your device, not on our servers. It is erased with the app or browser data; the exported backup remains under your control.
  • Analyses (photo of a product or meal, analysis of your diet or a blood test, questions to MIA): the items sent are processed to produce the answer and are not kept by our servers. The providers involved (section 8) process them under their own terms; OpenAI does not use them to train its models and may keep them for up to 30 days to detect abuse.
  • Diary report sent by e-mail: sent to the address you enter, not kept by our servers.
  • Payment: Médicaliment never receives your card details. Invoices and payment records are kept by Stripe and Platinium LTD for the period required by accounting and tax obligations.
  • Support exchanges and end-of-trial survey answers: 3 years after the last exchange.
  • Missing ingredient reports: product names only, no personal data.

8. Recipients and providers

Your data is accessible to the Platinium LTD team within the scope of its tasks, and to the following providers, only for the service described:

  • LWS (Groupe LWS SARL, France): hosting of the servers, database and website.
  • Stripe (Stripe Payments Europe, Ireland): payments, subscriptions and partner payouts.
  • OpenAI (United States): analysis of photos (products, labels, meals) and answers from the MIA assistant (section 3a).
  • Groq (United States): analysis of the diet and blood test results you submit.
  • Namecheap – Private Email (United States): sending e-mails (address confirmation, password, diary reports, support).
  • Open Food Facts (France): looking up a product from its barcode; only the barcode is sent.
  • jsDelivr: download of technical models (text and image recognition) that run on your device.

Transfers to the United States are covered by the safeguards provided for by the GDPR (European Commission standard contractual clauses or the EU–US Data Privacy Framework, depending on the provider). Your data is neither sold nor rented.

9. Security

Technical and organizational measures are implemented to protect data against unauthorized access, loss, alteration, or disclosure.

10. Your rights

Depending on the applicable framework, you may have rights of access, rectification, erasure, restriction, objection, portability, and withdrawal of consent where it is the basis for processing.

To exercise a right: info@platinium.biz.

11. Account deletion

Where an account deletion feature is offered, it initiates deletion subject to any applicable legal retention obligations.

12. Complaint

You can contact the competent data protection authority if you believe processing does not comply with the applicable rules.