Privacy policy

01In short

02Data controller

The data controller is ABALABS, rue Saint-Exupéry, 29470 Plougastel-Daoulas, France, registered under SIRET number 909 269 367 00035 ("we").

For any question about your data: [email protected]. We have not appointed a data protection officer; this address is the single point of contact.

03Data kept only on your phone

The following data is stored locally on your device (SQLite database and app preferences). It is not sent to any server and we have no access to it.

• the first name entered at sign-up;
• your year of study;
• your answers and the history of your quizzes and mock exams;
• your statistics and your spaced-repetition pile;
• your settings (theme, sounds, reminders, usage statistics, etc.).

This data is deleted when you uninstall the app or clear its data in your phone's settings. It is not included in our backups, since we never receive it.

04Weekly challenge (Supabase)

This data is processed only if you join the challenge. If you don't, none of the following applies to you.

Data processed

• an anonymous account: a random identifier, with no email or password;
• your username, your year of study and, if you choose one, your medical school;
• your profile visibility (public or private);
• the answers you ticked in the challenge, your scores and your times;
• your league points;
• your Premium status (active or not).

What other players see

If your profile is public, your username, medical school, score, time and, where applicable, your Premium badge are visible to other players in the rankings. If your profile is private, you play the challenge and see your score, but you don't appear in any ranking. Choose a username that doesn't identify you if you don't want to be identifiable.

Purposes and legal basis

This data is used to run the challenge: record your paper, calculate your score, build the player and school rankings, award league points, grant the second attempt and the badge to Premium subscribers, and enforce the challenge rules (preventing cheating and multiple accounts). The legal basis is the performance of the contract formed by the terms of use (Article 6(1)(b) GDPR).

Hosting

The database and anonymous authentication are provided by Supabase, Inc. The data is stored in the London (United Kingdom) region of Supabase's infrastructure.

Deletion

You can delete all this data from the app: challenge profile › "Supprimer mes données" (Delete my data). See also the Data deletion page.

05Subscriptions and purchases (RevenueCat, Apple, Google)

Premium purchases are made and paid for through Apple's App Store or Google Play. Payment is processed exclusively by Apple or Google: we never see your banking details, nor the name or email address of your store account.

To manage subscriptions, we use RevenueCat, Inc., which receives:

• a RevenueCat identifier, equal to the anonymous player identifier described in section 4;
• your purchase history (product, date, renewals, cancellation) as sent by the store;
• your Premium status.

Our server checks your Premium status with RevenueCat to grant the second challenge attempt and the crown badge.

Purposes: providing the features you purchased, restoring your purchases, handling renewals and support. Legal bases: performance of the contract (Article 6(1)(b) GDPR) and compliance with our accounting and tax obligations (Article 6(1)(c)). Apple and Google process your payment data as separate controllers, under their own privacy policies.

06Usage statistics (PostHog)

To understand how the app is used and fix problems, we measure usage with PostHog, on its infrastructure hosted in the European Union (eu.i.posthog.com).

Data sent

• a random anonymous identifier. Never your first name, your username or your answers;
• events: app opened, screens viewed, quizzes started and finished (mode, subject, year, score as a percentage, duration), challenge participation, reminders turned on, technical errors in the app;
• properties: year of study, reminders on or off, challenge member or not, medical school, Premium status.

No session recording (no screenshots or replays of your activity) and no use for advertising purposes.

Legal basis and objection

This processing is based on our legitimate interest in measuring the app's audience and improving it (Article 6(1)(f) GDPR). It is on by default and you can object at any time in Paramètres › Confidentialité (Settings › Privacy): no further events are then sent.

07Notifications

Review reminders are off by default. If you turn them on, they are scheduled locally on your phone, with no notification server: no data is sent to deliver them. You can turn them off in the app or in your phone's settings.

08Emails and reviews

When you report a question or send feedback from the app, it opens your email app with a pre-filled message addressed to [email protected]. The address and content are visible before sending and nothing is sent without your action. If you send it, we receive your email address and the content of the message, which we use only to reply to you and correct the content (legal basis: legitimate interest, Article 6(1)(f)). Our mailbox is provided by Microsoft (Outlook).

The store review prompt uses Apple's or Google's native dialog. Your rating and comment are processed by Apple or Google under their own rules; we don't receive your identity this way.

09What we don't do

• no advertising in the app;
• no selling, renting or exchanging of your data;
• no ad tracking: we don't use your device's advertising identifier (IDFA on iOS, advertising ID on Android);
• no access to your location, contacts, camera or microphone;
• no account with an email or password.

10This website

The easymedecine.abalabs.app website sets no cookies and uses no analytics tool or third-party service: fonts and images are served from the site itself. Only your theme preference (light, dark or automatic) may be saved in your browser's local storage; it never leaves your device.

The site is hosted by Scaleway SAS (France), which may keep technical logs (IP address, date, page requested) to keep the service secure and running.

11Recipients and providers

Your data is accessible only to ABALABS and to the providers below, who act on our behalf (processors) or, for Apple and Google, as separate controllers. Other players see the public profile information described in section 4.

We may also disclose data where required by law or at the request of a competent judicial or administrative authority.

12Transfers outside the European Union

• United Kingdom (challenge data stored by Supabase): the United Kingdom is covered by an adequacy decision of the European Commission, which recognises a level of protection equivalent to that of the European Union.
• United States (RevenueCat, and possible technical access by Supabase or PostHog staff for maintenance and support): these transfers are covered by the EU–US Data Privacy Framework where the provider is certified, and otherwise by the standard contractual clauses adopted by the European Commission.

You can ask us for a copy of the applicable safeguards at the contact address.

13Retention periods

14Your rights

Under the GDPR and the French Data Protection Act, you have the following rights:

• access to your data and a copy of it;
• rectification of inaccurate data;
• erasure of your data;
• restriction of processing;
• objection to processing based on our legitimate interest, including usage statistics;
• portability of the data you provided to us;
• setting instructions on what happens to your data after your death (Article 85 of the French Data Protection Act).

How to exercise them

• In the app, without writing to us: turn off usage statistics (Paramètres › Confidentialité), make your profile private, or delete your challenge data (challenge profile › "Supprimer mes données").
• By email at [email protected]. Since your account is anonymous, give your username, your year and, where applicable, your medical school, so we can find your data. We may ask for additional information if there is any doubt about your identity.

We reply within one month, which may be extended by two months for complex requests; we would let you know.

If you believe your rights are not being respected, you can lodge a complaint with the CNIL (the French data protection authority): cnil.fr/fr/plaintes, or by post to CNIL, 3 place de Fontenoy, TSA 80715, 75334 Paris Cedex 07, France.

15Minors

Easy Médecine is aimed at higher-education students, generally at least 17 years old. The app is not intended for children under 15. If you are under 15, ask one of your parents for permission before joining the challenge. Purchases made by a minor are subject to the parental controls offered by Apple and Google.

If you learn that a child under 15 has joined the challenge without permission, write to us: we will delete their data.

16Security

We keep the data we collect to the strict minimum. Communications with our servers are encrypted (HTTPS). Access to challenge data is restricted by access-control rules at the database level, and anonymous authentication avoids storing any email or password.

17Changes

We may update this policy, for example when adding a feature. The version and date at the top of this page are then updated. If there is a significant change, we will let you know in the app.

18Contact

ABALABS, rue Saint-Exupéry, 29470 Plougastel-Daoulas, France
[email protected]

↑ Back to top