Privacy policy

1. Identity of the data controller for the website, prospects, clients and users

The data controller is MANU ASSISTANT, a SAS (French simplified joint-stock company), with share capital of €100, registered with RCS Paris 102 725 827, registered office: 4 rue de l’Amiral Courbet, 75016 Paris, France, email: contact@manuassistant.com.

2. Two processing frameworks

2.1. Data managed directly by Manu Assistant

Manu Assistant acts as data controller for data relating to the website, contact enquiries, commercial relationships, billing, user accounts and platform security.

2.2. Data processed when practitioners and client organisations use the Service

For follow-up data, including information entered by the patient in Théra and sent to their practitioner, the professional, practice or client organisation generally acts as data controller. Manu Assistant then acts as processor under the terms of the contract and applicable GDPR annex.

3. Data that may be processed

3.1. Website, prospects and contacts

Identity, professional contact details, practice or organisation, message content, commercial correspondence, technical connection data and strictly necessary browsing preferences.

The website also uses daily aggregate usage counters: event type, page group and button placement, without a visitor identifier. The collector does not record names, emails, patient data, form content, full URLs, campaign parameters, IP addresses or browser fingerprints in these counters. Technical data required for transmission is processed by the network infrastructure. This measurement is not combined with contacts or user accounts and does not track an individual across the website, Manu and Théra.

3.2. Service users

For professional accounts: first and last name, email address, role, associated practice or organisation, technical identifiers, access history, activity logs, support and billing. For Théra patient access: identity and invitation email address, link to the practitioner, authentication information, preferences and technical information needed for the account's operation and security.

3.3. Data entrusted to the Service by clients

• Consultation and documents: patient identity, notes, case history, assessment, clinical report, history, patient message, letter to the doctor and optional audio for transcription.
• Programme and follow-up in Théra: exercises, instructions, schedules, questionnaires, responses, reported feelings and information about completing the programme.
• Calendar: date, time, reason for the appointment, practitioner, patient and information needed to book or voluntarily import an appointment.
• Video consultation: audio and video transmitted during the call, authentication and admission information, session identifier and metadata. No audio or video recording is enabled within this scope.

This data is used to prepare the session, produce requested documents, share the programme and enable practitioner follow-up. The patient sees the items shared in their Théra space; this access does not open the entire professional record. The practitioner can view the patient's feedback in Manu, within their authorised access scope.

4. Purposes and legal bases when Manu Assistant acts as data controller

• Responding to contact enquiries and arranging a demonstration : legitimate interests and, where applicable, pre-contractual steps.
• Creating and administering accounts : performance of the contract.
• Managing subscriptions, billing and client relationships : performance of the contract and legal obligations.
• Ensuring the Service's security, availability and traceability : legitimate interests and security obligations.
• Understanding website use and improving its operation : aggregate statistics solely on behalf of Manu, without identifying visitors or targeted advertising. Details and the option to disable measurement are set out in the cookie policy.
• Sending B2B communications about the Service : legitimate interests, subject to the right to object.

5. Hosting, recipients and processors

Within the limits of their duties, data is accessible to authorised MANU ASSISTANT teams, technical providers required to operate the Service and, where necessary, subprocessors involved in hosting, security, authentication, email delivery, payment and certain text generation features.

The Service's technical infrastructure relies in particular on services operated through Amazon Web Services (AWS). Depending on the features enabled, Manu Assistant may also use an artificial intelligence provider to generate certain content from minimised information reviewed by the practitioner.

The website statistics collector is separate from the contact services and patient applications. Its counters are hosted on AWS in the Paris region and accessible only to people authorised to operate the website. No form or account data is transmitted to it.

Application data is hosted on AWS in Paris. Video consultations use Amazon Chime SDK, with media configured in Paris and a control API in Frankfurt. The security scope distinguishes this transmission from the audio used to prepare a document. AWS's HDS certification does not automatically certify Manu; the service's contractual and operational coverage remains to be established.

To book a sales demonstration, the Calendly calendar is loaded after submitting the dedicated form. Your name, email and enquiry context are sent to prefill the booking. Do not enter patient data. See the Calendly privacy policy and our cookie policy.

6. AI processing and transfers outside the EU / EEA

Where certain features rely on an artificial intelligence provider, Manu Assistant applies data minimisation and, where appropriate, pseudonymisation to transmitted content. If a transfer outside the European Union or European Economic Area is necessary, it is governed by the appropriate legal mechanisms in force, including applicable standard contractual clauses, supplemented where necessary by suitable additional measures.

7. Retention periods

• Prospect and contact data : for the time needed to handle the request and then, where applicable, according to the relevant commercial policy.
• Account, client relationship and billing data : for the duration of the contractual relationship and then for the applicable statutory periods.
• Security logs : for a period proportionate to security and traceability purposes, normally up to 6 months unless a specific justified need arises.
• Aggregate website statistics : 90 days; expired counters are excluded from reports, with asynchronous technical deletion. Any technical collector logs are retained for 7 days and do not contain received events.
• Data entrusted to the Service by clients : according to the instructions of the client acting as data controller, the Service settings and the applicable contractual framework.
• Video consultation metadata : technical expiry 30 days after the session's scheduled start in DynamoDB in Paris, with asynchronous deletion. This rule does not extend to patient records, accounts or backups.
• Audio recordings : when used, they are intended for transcription and are automatically deleted after processing, with a target of prompt deletion, normally within 24 hours at the latest, except in the event of a documented technical incident, legal requirement or justified security need.

8. Security

Manu Assistant implements technical and organisational measures appropriate to the nature of the data processed, including encryption in transit, access control, permission management, logging, logical separation of client spaces, backups and procedures for continuity, recovery and incident handling.

9. Data breaches

In the event of a personal data breach, Manu Assistant applies its internal incident management procedures and, where required, assists the client acting as data controller so that it can meet its legal notification obligations and, where applicable, inform data subjects.

10. Data subjects' rights

10.1. Patient data

For care-related data, including programmes, responses and feedback submitted in Théra, send your request to the professional or practice responsible for your follow-up. Manu Assistant assists them within the limits of its role as processor. To close your Théra access or request deletion of a Manu account, follow the procedure without logging in. Closing an account does not automatically erase documents that the practice must retain.

10.2. Prospect, client and user data

Subject to the legal conditions, you have rights of access, rectification, erasure, restriction, objection and, where applicable, portability. You can exercise your rights by writing to contact@manuassistant.com or to the postal address above. You also have the right to lodge a complaint with the CNIL.

11. Cookies

To learn more about the trackers used on the website and how to manage your choices, see our Cookie policy.

12. Updates

This policy may change to reflect legal, regulatory, technical or operational developments. The version date at the top of the page is authoritative.