Privacy Policy
Last updated: August 2026
Conspicuis (identified under SIREN number 940914062) places absolute importance on the protection of your personal data, particularly when it comes to sensitive data related to mental health and wellbeing.
This Privacy Policy aims to explain to you transparently what data is collected, how it is protected, and what your rights are.
1. Identity of the Data Controller
The processing of personal data collected via the Helloshame application is carried out by:
- PublisherConspicuis
- SIREN940914062
- Contact & DPOdpo@helloshame.com
2. Nature of Data Collected (Mental Health Focus)
As part of the use of our services, we collect only the data strictly necessary for the operation of the application, derived from our secure technical architecture:
Profile and onboarding information
Basic identification data, pseudonyms, language preferences, themes, as well as primary challenges and emotional goals provided during account initialization.
Mental health and wellbeing data
Daily emotional journal notes, mood scores, and emotional intensities.
Therapeutic interactions
Chat messages and conversation histories with the support assistant.
Creations and memories
Art therapy artworks, descriptions, and associated visuals saved in your personal gallery.
Transactional data
Subscription management and payment histories.
Community participation
Membership in discussion circles and technical support tickets.
3. Legal Bases and Purposes of Processing
The processing of your data is based on the following legal grounds:
- Your explicit consent: Collected upon your registration and onboarding journey, essential for processing sensitive mental health data (Article 9 of the GDPR).
- Performance of the contract: Provision of application services, journey personalization, and account management.
- Compliance with our legal obligations: Platform security and billing management.
4. Data Segregation: B2C vs. B2B Specificity (Employee Programs)
Segregation barrier and absolute access isolation
Integrating B2B offerings targeted at companies for employee wellbeing requires formalizing an absolute segregation barrier to reassure users:
In B2C Mode (Independent User)
- •Implementation of strict end-to-end encryption.
- •No one other than you has the right or technical ability to view your health data, barring an explicit transfer initiated by you or by someone you expressly authorize.
In B2B Mode (Corporate Wellbeing)
- •Total and strict anonymity: The employer funding or providing the program never has access to individual data, journal notes, messages, or employee journeys.
- •Strict aggregation rule (Minimum threshold): No statistics or data will be visible for a group of fewer than 10 people. No data linked to a single individual will be displayed. All reporting is done in the form of aggregated, anonymized sets to preserve the integrity and privacy of each employee.
5. Hosting, Security, and Subcontractors
To guarantee the highest level of security, your data benefits from the following infrastructures:
Technical hosting
Initial storage on secure servers located in Paris (France West) via Supabase and Vercel, with an established trajectory toward 100% French hosting certified HDS (Health Data Host).
Standards & Certifications
Compliance with the most stringent international standards, including ISO 27001, HIPAA compatibility, and enhanced protection of health information (PHI).
Data flow security
Systematic end-to-end encryption in transit and at rest.
6. Retention Period
You retain total control over your data.
In the absence of any intervention or activity on your account, your personal and health data are automatically deleted after a period of 2 years.
7. Your Rights
In accordance with applicable regulations, you have the following rights regarding your data at any time: