1. Who we are
ActiveHEAL is an exercise oncology therapy platform specialising in breast cancer patients.
- Website address: https://activeheal.org
- Contact: info@activeheal.org
- Data Protection Officer: Alejandro D.
2. What personal data we collect and why
Contact forms
When you use our contact forms, we collect:
- First and last name
- Email address
- Telephone number (optional)
- Message or enquiry
Purpose: To respond to your enquiries and provide you with information about our services.
Legal basis: Consent (GDPR Art. 6.1.a)
Retention: 2 years after the last contact.
User registration
If you register on our platform, we collect:
- Username
- Email address
- Password (encrypted)
- Profile information (optional)
Purpose: To manage your user account and provide access to our services.
Legal basis: Performance of a contract (GDPR Art. 6.1.b)
Retention: For as long as your account is active, plus 5 years after deactivation for legal reasons.
Cookies
We use the following cookies:
Essential cookies:
- WordPress session cookies (required for the site to work)
- Authentication cookies (if you log in)
You can manage cookies through your browser settings.
Embedded content from other websites
Articles on this site may include embedded content (for example videos, images, articles, etc.). Embedded content from other websites behaves in exactly the same way as if you had visited the other website.
These websites may collect data about you, use cookies, embed additional third-party tracking and monitor your interaction with that embedded content.
3. Who we share your data with
We do not sell or share your personal data with third parties except in the following cases:
Essential service providers
- OVHcloud (web hosting, France) – data stored on European servers
- FluentCRM (contact management) – processed locally on our server
Legal obligations
We may disclose your data if required by law or in response to valid requests from public authorities.
4. How long we keep your data
- Contact forms: 2 years after the last contact
- User accounts: For as long as the account is active + 5 years
- Session cookies: Deleted when the browser is closed
5. What rights you have over your data
Under the GDPR, you have the following rights:
Right of access
You can request a copy of the personal data we hold about you.
Right to rectification
You can ask us to correct any inaccurate or incomplete data.
Right to erasure (“right to be forgotten”)
You can ask us to delete your personal data, unless we are required to keep it for legal obligations.
Right to restriction of processing
You can ask us to limit the use of your data in certain circumstances.
Right to data portability
You can ask to receive your data in a structured, commonly used format.
Right to object
You can object to the processing of your data at any time.
Right to withdraw consent
If processing is based on your consent, you can withdraw it at any time.
To exercise these rights, contact: info@activeheal.org
Response time: 1 month (may be extended by a further 2 months in complex cases)
6. Where your data is sent
Your data is stored on secure servers located in:
- Primary location: France (OVHcloud)
- Backup location: France (OVHcloud)
All data remains within the European Union.
7. Security measures
We implement the following technical and organisational security measures:
Technical security
- Encryption in transit: HTTPS/TLS (Let’s Encrypt)
- Encryption at rest: MariaDB database with AES-256-CBC
- Firewall: OVH perimeter network firewall + UFW on the server
- Authentication: Two-factor authentication available
- Backups: Automatic daily backups with 7-day rotation
Organisational security
- Access to personal data limited to authorised staff only
- Data protection training for all staff
- Secure password policies
- Regular security audits
8. International data transfers
We do not carry out international data transfers outside the European Union.
9. Security breaches
In the event of a security breach affecting your data:
- We will notify you within 72 hours of becoming aware of it
- We will inform the competent supervisory authority (CNIL in France)
- We will take immediate measures to mitigate the impact
10. Children’s data
Our services are intended for adults (over 18). We do not knowingly collect data from minors without parental consent.
If you become aware that a minor has provided personal data, please contact us immediately.
11. Changes to this privacy policy
We reserve the right to update this privacy policy at any time. Significant changes will be notified:
- By a notice on our website
- By email (if you have an account)
Last updated: 16 October 2025
12. Contact information and complaints
Data Protection Officer contact
- Email: info@activeheal.org
- Response: Within 1 month
Supervisory authority
If you believe that the processing of your data infringes the GDPR, you have the right to lodge a complaint with:
Commission Nationale de l’Informatique et des Libertés (CNIL)
- Website: www.cnil.fr
- Telephone: +33 1 53 73 22 22
13. Legal basis for processing
The processing of your data is based on:
- Consent (Art. 6.1.a GDPR) – contact forms, newsletters
- Performance of a contract (Art. 6.1.b GDPR) – management of user accounts
- Legal obligation (Art. 6.1.c GDPR) – record keeping as required by law
This privacy policy complies with:
- General Data Protection Regulation (GDPR) – EU 2016/679
- French Data Protection Act (Loi Informatique et Libertés)
- ePrivacy Directive – Directive 2002/58/EC
Version: 1.0
Effective date: 16 October 2025