Legal

Privacy policy

This policy explains how CHUTEX SAS ("CHUTEX") processes your personal data when you use the website, the shop, the CHUTEX app, our connected devices and, in France, the Chutex Care telecare service. It follows Regulation (EU) 2016/679 (GDPR) and the French Data Protection Act. Last updated: 24 October 2026.

Last updated: 2026-08-25

1. Who is responsible for your data

CHUTEX SAS, LE BRITANNIA, 20 Boulevard Eugène Deruelle, 69003 Lyon, France, SIREN 942 212 259, is the data controller in the general case: website, shop, app, connected devices and support.

If you have an active Chutex Care contract, CHUTEX CARE, is the controller of the data of that contract (alerts, location, people to notify). CHUTEX SAS then provides the app, the hosting and the technical support on its behalf. When the contract ends, CHUTEX SAS becomes the controller again; CHUTEX CARE keeps only the records it must retain (invoices, alert history).

Data protection contact: contact@chutex-innovation.com

2. The data we process

Depending on the services you use, we process:

website and shop: identity, contact details, delivery and billing addresses, orders and payment references (payment is processed by Mollie; we do not keep card numbers), browsing data according to your cookie choices;
account and app: phone number, name, email, language, preferences, paired devices, technical data (phone model, app version, notification identifier);
wellness measurements from connected devices, depending on the device: heart rate, oxygen, temperature, steps, sleep, variability, weight and body composition, estimated blood pressure and glucose, ECG trace;
Chutex Care service (France): alerts, 4G wristband position, home address and access information, people to notify;
exchanges with Aria, the AI assistant: text and voice, and, only if you have allowed it, items from your health space;
visual check-up (Chutex Vision), when it is open to you: photos and silent videos, questionnaire answers; the images stay on our servers in France and no external AI model receives them at present;
support: emails, forms, return photos, and the contacts to notify that you name (you confirm that you have their agreement).

3. Health data

Wellness measurements, alerts, the position of a monitored person and some answers or images in the app can reveal information about a person's health. They are data concerning health within the meaning of the GDPR (Article 9): we process them with your explicit consent or, for an alert, to protect a vital interest, with enhanced safeguards.

Chutex offers wellness and prevention services. They do not provide any diagnosis, do not replace medical advice and are not medical devices. The expression "health data" comes from data protection law; it does not make the service a medical one.

4. Memory

The Memory service (sales currently closed) will be operated by a separate company that is being set up. Until it exists, CHUTEX SAS is the controller of the data of the people who have access to it.

your exchanges with Aria in writing and by phone, their transcripts and the memories you confirm;
the audio recording of your calls, only if you have allowed it in the settings;
the life context you declare and, with your permission, some data from your health space;
the texts and images of your book, and your delivery and billing details.

This data is used to provide the service. Memories can reveal sensitive information: they are processed only with your explicit consent, which you can change at any time. They are not sold, passed on or used for advertising. You can view, correct, remove or export them.

Exchanges with Aria are processed by OpenAI (United States), see section 8.

5. Waiting lists: Memory, Chutex Sport and Chutex Physio

On the pages of these services you can leave your email address to be notified when they open. CHUTEX SAS is the controller of this processing, which is based on your consent.

your email address and the chosen service;
the language, the market and the form page, the text of the consent box you selected, its version and date;
the date of your sign-up and, where applicable, of your re-registration.

This data is used only to send you a single email on the day the service opens: no other communication, no marketing, no disclosure. Your IP address is used only to limit abusive sign-ups, and is held in memory for 10 minutes only: it is not stored.

You can withdraw your consent and have your address deleted at any time by email to contact@chutex-innovation.com.

6. Purposes and legal bases

Each processing activity relies on a legal basis. Where consent is required, you can withdraw it at any time without affecting processing already carried out.

Performance of a contract: account and authentication, orders, delivery, invoicing, customer service, operation of the app and connected devices, Chutex Care telecare.
Consent: app health data shared with Aria, phone location, notifications, non-essential cookies and trackers, marketing, waiting lists, Memory.
Legitimate interest: system security, fraud prevention, aggregated statistics, handling of complaints.
Vital interest: emergency alert for a Care beneficiary who cannot communicate.
Legal obligation: invoicing, accounting, tax, replies to requests to exercise rights and to competent authorities.

7. Recipients and processors

Your data is accessible only to staff with access rights at CHUTEX and CHUTEX CARE and to the following providers, who receive only what their task requires:

Free Pro (Istres, France), the server that hosts the database and the app, operated on our behalf by INFORMATIQUE DOM;
Mollie (Netherlands), payment; Shopify, shop (being replaced by our own order register); Revolut, bank; Pennylane (France), accounting for Chutex Care;
Sendcloud and carriers, delivery; partner marketplaces (through Mirakl), when you order from them: they are responsible for their own processing and send us what is needed for delivery;
Brevo and Resend, emails; SMSmode, text messages; Microsoft 365, support mailbox;
Expo, Apple and Google, notifications; Twilio and ElevenLabs, calls and voice;
OpenAI (United States), Aria assistant and Memory, and the site's advertising pixel if you accept advertising;
Lulu (United States), printing of Memory books; Lefu (China), body composition calculation for the Vita scale;
Wherever SIM, SIM cards for the wristband; beaconDB, Google and OpenStreetMap, location and maps;
Google Analytics, PostHog and TikTok, audience measurement and advertising, only if you accept the matching category; Cloudflare, technical protection;
the people you have named, emergency services and intervention partners, only for an alert or an intervention.

Your data is neither sold nor passed on to third parties for their own marketing.

8. Hosting and transfers outside the European Union

Data is hosted in France by Free Pro (Istres), a hosting provider certified as a Health Data Host (Hébergeur de Données de Santé, HDS).

Some providers are located, or process data, outside the European Union. United States: OpenAI, Twilio, ElevenLabs, Lulu, Resend, PostHog, Google, TikTok, Expo, Apple, Cloudflare. China: Lefu, for the Vita scale (sex, age, height, weight and impedances of one weighing, sent from our servers without name, email address or account identifier).

Requests to OpenAI go to its global interface, with retention on the provider's side switched off. No European zero-retention project is in service at present. Health context is sent only if you have allowed it, and visual check-up images are sent to no external model.

Chapter V of the GDPR requires appropriate safeguards for these transfers (adequacy decision, EU-US framework or standard contractual clauses). These safeguards are not yet documented for every provider, in particular Lefu: we are consolidating them. If you live outside the Union, your data is transferred from your country to France and the GDPR applies to it. The site's fonts and images are hosted by CHUTEX: no external measurement, advertising or font service is called before you make your cookie choice.

9. Retention periods

These are the periods applied by our systems. A daily automated job deletes data that has exceeded the retention period set for its category.

Account and app: Kept as long as the account is active. After an erasure request (from the app or by email), the account is made anonymous and the data linked to it is deleted within one month at most, except for what the law requires us to keep (invoices, proof of alerts).
Orders and invoices: 10 years (accounting obligation).
Wellness measurements: 5 years from the measurement, or until your account is deleted if that comes first.
Location and raw 4G wristband frames: 5 years from recording.
Telecare alerts and related information: 5 years after the alert is closed.
Website and app usage, notifications: 5 years from recording.
Logs: Access logs for sensitive data: 5 years. Web server logs: 14 days. Application logs: limited in volume and renewed continuously.
One-time login codes: 7 days at most, 3 hours once used.
Proof of your consents: While the consent lasts, then 5 years.
Visual check-up images: 365 days from capture; 7 days for an abandoned session; deletion on request.
Backups: Encrypted copies of the database kept for 8 days: deleted data disappears within that time.
Support messages: Kept while your request and any warranty matter are handled; deleted on your request within one month.
Marketing: 3 years from the last contact, or until you withdraw consent.
Waiting lists: Until the opening email of the service is sent, then deletion; 3 years at most after the last sign-up.
Cookies: You are asked for your choice again 13 months at most after it is recorded. Trackers placed after consent follow the cookie policy.
Memory: Memories and conversations: until you delete them or your account. Audio: not kept by default; with your agreement, 365 days at most. Replaced book drafts: 30 days.

10. Security

encryption of website and app traffic (TLS); the link from the 4G wristband to our servers is not encrypted;
role-based access, single-use SMS code for login;
logging of access to sensitive data;
daily encrypted database backup, weekly restore test; no off-site copy at present;
visual check-up images are encrypted;
processing agreements with our providers, being consolidated for some of them;
security incident procedure, with notification of the authority and of the people concerned when the law requires it.

11. Your rights

You have the following rights over your personal data:

access: know whether we process data about you and receive a copy;
rectification of inaccurate or incomplete data;
erasure, in the cases provided by law;
restriction of processing in some cases;
objection, in particular to marketing, without having to give a reason;
portability of the data you provided;
withdrawal of your consent at any time;
instructions on what happens to your data after your death (France).

To exercise your rights: the "Your data rights" form (link in the site footer), the profile menu of the app (including account deletion), email to contact@chutex-innovation.com or letter to LE BRITANNIA, 20 Boulevard Eugène Deruelle, 69003 Lyon, France. We reply within one month, extendable by two months for complex requests. We may ask for proof of identity if there is reasonable doubt.

You may lodge a complaint with the data protection authority of your country. In France: the CNIL, www.cnil.fr, 3 Place de Fontenoy, 75007 Paris.

12. Minors, cookies and updates

Our services are not intended for minors without parental consent. If you think your child has sent us data, write to us to request its deletion.

The use of cookies and trackers is described in the cookie policy: strictly necessary trackers do not need your consent, the others depend on your choice.

We update this policy when our services or the regulations change; the date of the last update is at the top of the page. It is governed by French law.