Privacy policy

This policy explains what data ReSomnia (resomnia.app) processes, why, where it is hosted and how to exercise your rights. It covers the patient app (/dashboard) and the clinician area (/pro).

1. Data controller

Data controller: ADLX Studio, sole proprietorship of Andy Leleux, enterprise number (CBE) BE 0784.326.261, Belgium.

For any question about your personal data, to exercise your rights or to report an incident, write to hello@resomnia.app.

2. Data collected

2.1 Patients: health data (GDPR art. 9)

The app processes health data, which is given enhanced protection by Article 9 of the GDPR:

• Sleep diary: times of going to bed, falling asleep, waking and getting up; number and length of awakenings; perceived quality; how you felt on waking.
• Treatments: use of sleeping pills or anxiety medication, if you record it.
• Lifestyle habits: caffeine, alcohol, naps, stress level.
• Menstrual cycle (optional): periods, day of the cycle, premenstrual symptoms, hot flushes, pregnancy.
• Questionnaires: results of the ISI, Epworth, PSQI and chronotype (MEQ) tests.
• Programme: progress in the 6-week CBT-I programme, ticked boxes, sleep window, relapse prevention plan.
• Thought journal: sleep-related thoughts and how you reframed them.
• Profile (optional): first name, last name, date of birth, sex.
• Account: sign-in email address (sign-in link).
• Messages: exchanges with your clinician, if you have turned on sharing.

2.2 Clinicians

• Clinician account: sign-in email, last name, first name, profession, professional number and professional contact details provided at registration.
• Training and access level: the CBT-I training you declare, and the level set at approval (full access or view only).
• Profile (optional): title, short bio, website, address and postcode, consultation options and languages, session length, payment methods. This information is used to manage your account and is not shown to patients.
• Photo (optional): cropped and resized in your browser, which removes its metadata (including GPS location), then stored in a private space at Supabase (European Union). In the app, only your account can access it; the service's technical administrator can access it for operations and maintenance, as with other hosted data.
• Follow-up: links with the patients who have given you access, messages exchanged.

2.3 Audience measurement

Plausible Analytics (Plausible Insights OÜ, Estonia, hosted in the European Union) measures traffic on the public website and the app: pages viewed, referral source, device type. No cookies, no personal identifier, IP addresses not stored; only the page path is sent, never URL parameters or screen content.

Microsoft Clarity (Microsoft Corporation) is used only on the public website (resomnia.app, /nl, /en), never in the app or the clinician area, and only if you accept it in the cookie banner. It produces click maps and anonymised browsing recordings, with typed fields masked, to improve the page. Legal basis: your consent, which you can withdraw at any time via the "Cookies" link at the bottom of the public website. Data is processed by Microsoft, including outside the European Union (EU-US Data Privacy Framework). Microsoft's policy: privacy.microsoft.com.

ReSomnia does not set any advertising cookies.

Newsletter (optional)

This section also applies to visitors to the site. If you sign up on the site or in your profile: your email address, language, where you signed up, and the dates of signing up, confirming and unsubscribing. The sign-up page is deleted on confirmation. Signing up on the site is confirmed by a link sent by email; a hash of your IP address is kept for 2 days to limit abuse. No health data, and the list is not linked to your file. Purpose: sending you our new guides and news about the app. Legal basis: consent (Art. 6.1.a GDPR), which you can withdraw at any time from any email or from your profile. Retention: until you unsubscribe, then 3 years as proof of withdrawal; a sign-up that is never confirmed is deleted after 30 days; deleting your account also deletes the entry for its address. Providers: Vercel (handling the request), Infomaniak (sending emails), Supabase (storage).

3. Purposes

Patients

• To track your sleep and your progress in cognitive behavioural therapy for insomnia (CBT-I).
• To calculate personalised reference points (sleep efficiency, proposed sleep window).
• To share your data with the clinician you designate, and with them alone.
• To back up your data to your account so you can find it on all your devices.

Clinicians

• To manage your account and verify your status as a healthcare professional before activating the clinician area.
• To give you access to the data of the patients who have explicitly shared their follow-up with you.
• To set your access level (full or view only), based on your profession and the training you declare.
• To keep your optional profile, for managing your account.

4. Legal basis

• Patients: explicit consent (GDPR art. 6(1)(a) and 9(2)(a)), given when the account is created and confirmed each time you share with a clinician.
• No data is shared without action on your part: you yourself give your clinician a 6-digit code or an invitation.
• Clinicians: performance of the service requested at registration (GDPR art. 6(1)(b)).

5. Retention period

• Patient account: until the account is deleted. The "Delete my account and my data" button in your profile immediately and permanently deletes your account and all your data (diary, tests, messages, thoughts, programme).
• On your device: a working copy of your data stays in the browser for offline use. It is erased when you sign out.
• Sharing: revoking a share immediately cuts off the clinician's access. A record of the share is kept to show who had access to what, then erased with your account.
• Clinician account: for as long as it is active, or until it is deleted on request.
• Clinician photo: until you remove it, or until you delete your account from the app, which erases it first.

6. Your rights

• Access to your data.
• Rectification, directly in your profile.
• Erasure, with the "Delete my account and my data" button in the app.
• Portability, with the PDF export on the "Report for your clinician" page.
• Withdrawal of consent at any time, in particular by revoking sharing with a clinician.
• Objection to processing.

To exercise these rights, write to hello@resomnia.app. We respond within one month at most.

You can also lodge a complaint with the Belgian Data Protection Authority: www.dataprotectionauthority.be.

7. Security

• Encryption in transit: HTTPS required (HSTS).
• Encryption at rest: encrypted database.
• Separation: access rules at database level (Row Level Security). Each patient sees only their own data; each clinician sees only the data of the patients who have given them access, and only the authorised parts (diary, tests; thought journal turned off by default).
• Passwordless sign-in: email sign-in link.
• Clinician access levels: a clinician with view-only access reads what you share with them, according to your choices, but can neither write to you nor receive your messages. The database enforces this. If a clinician moves to this level, they lose access to your earlier conversations, which stay in your record and which you can still read.
• Sharing codes: valid for 24 hours, blocked after 10 incorrect attempts in 15 minutes.

8. Cookies

In the app and the clinician area, ReSomnia uses only strictly necessary technical cookies: the sign-in session cookie (30 days at most) and the configuration of the authentication client. These do not require consent. On the public website only, with your agreement: Microsoft Clarity cookies (_clck up to 1 year, _clsk 1 day), and the cookie that remembers your choice. The app also keeps a copy of your data on your device (browser local storage) so that it works offline; it is erased when you sign out.

9. Hosting and processors

• Supabase: database, authentication and file storage (clinician photo), European Union region (Frankfurt).
• Vercel: delivery of the web app files. No health data is stored there.
• Infomaniak Network SA (Switzerland, a country recognised as adequate by the European Union): sending sign-in emails and support mailbox.
• Plausible Insights OÜ (European Union): cookie-free audience measurement.
• Microsoft Corporation: Microsoft Clarity, on the public website only and with consent.

Fonts are served by resomnia.app itself: no calls to a third-party font service.

10. Transfers outside the European Union

Health data is stored in the European Union. Occasional access by the support teams of our processors is governed by the European Commission's standard contractual clauses.

11. Regulatory status

ReSomnia is not a medical device within the meaning of Regulation (EU) 2017/745. It is a CBT-I support tool that makes follow-up easier between a patient and their clinician. It makes no diagnosis, prescribes no medicine and does not replace a consultation.

12. Changes

Any significant change to this policy will be announced by email to the users concerned at least 30 days before it takes effect.

See also: Terms of use · Legal notice