Your health data is sacred. Here is what we collect, why, where we store it, and how you take back control at any time. No resale. No profiling. No transfer outside the EU.
Weave is a family and care coordination application centered on a fragile loved one living at home. By nature, the service handles particularly sensitive data: health information, family contacts, location data during emergencies. This privacy policy describes our commitments regarding this data, in accordance with Regulation (EU) 2016/679 (GDPR) and French Act n°78-17 of 6 January 1978, known as the "Data Protection Act".
The data controller is Weave SAS, 12 rue du Faubourg Saint-Honoré, 75008 Paris, France, Paris Trade Register 928 451 327. Our Data Protection Officer (DPO) can be reached at contact@schoenfg.com.
We apply the principle of data minimization: only data strictly necessary for a given purpose is collected. Optional fields are flagged as such in the application.
| Category | Details |
|---|---|
| Identity | First name, last name, email, bcrypt-hashed password, phone (optional), profile picture (optional). |
| Technical account | Internal UUID identifier, JWT sessions, creation date, last login, preferences (theme, language). |
| Circle | Care recipient's name, family relationship, date of birth, picture (optional), member composition and roles. |
| Postal address | The care recipient's address (useful for routing home-care requests), reusable across members to avoid duplication. |
| Health (HDS) | Pathologies, chronic conditions, blood type, treatments, prescriptions, medication intakes, checkups, allergies. |
| Coordination | Tasks, written and voice messages, sticky notes, memories (photos / videos), expenses, shared documents. |
| Professionals | Contact details of caregivers attached to the circle (family doctor, physio, nurse). |
| Payment | Stripe token (the card number is never handled by our servers), invoice history, French CESU certificates. |
| Geolocation | The responder's GPS coordinates only during a Phase 3 SOS, after explicit consent. |
| Usage | Anonymized technical logs, audit events (creation / modification / deletion of sensitive records). |
All health data (prescriptions, conditions, treatments, intakes) is stored with Outscale (Dassault Systèmes), a hosting provider certified HDS under article L.1111-8 of the French Public Health Code. Server location: metropolitan France.
Encryption is applied:
External medical sharing (a signed public page for an occasional caregiver) relies on a token with a short validity period (configurable TTL, 24 hours by default) and only exposes a subset explicitly chosen by the lead caregiver.
| Provider | Role | Location |
|---|---|---|
| Outscale (Dassault Systèmes) | HDS-certified health-data hosting | France |
| OVHcloud | Application & marketing site hosting | France |
| Stripe Payments Europe | Premium billing and partner agency payment (Phase 3) | Ireland (EU) |
| Mailgun (Sinch France) | Sending of transactional emails | France |
| Sentry (Functional Software EU) | Error monitoring (no personal data) | EU |
| Partner home-care agencies (Phase 3) | Home interventions on SOS request | France |
All our sub-processors are bound by an agreement compliant with article 28 of the GDPR (signed Data Processing Agreement). Health data remains stored exclusively in metropolitan France, with our HDS-certified hosting provider.
Stripe Payments Europe Ltd (our payment processor, based in Ireland) may, in certain limited technical operations (anti-fraud, support), share data with its parent company Stripe Inc. (United States). These transfers are framed by the Standard Contractual Clauses (SCCs) approved by the European Commission (decision 2021/914) and by Stripe Inc.'s adherence to the Data Privacy Framework. No medical data is concerned by these transfers; only the information strictly necessary to process a payment (amount, tokenized card number, technical metadata) may be shared.
The list of sub-processors is kept up to date; any substantial change will be notified to you.
In accordance with articles 15 to 22 of the GDPR, you have the following rights:
To exercise your rights: contact@schoenfg.com or via your account settings. Reply within 30 days maximum (extendable to 60 days for complex requests, with a reasoned notification). In the event of disagreement, you may file a complaint with the French CNIL: cnil.fr/en/plaintes.
Account creation is reserved for adults. The care recipient of a circle may be a minor or a person with reduced autonomy; the account is then created and managed by a legal representative (parent, conservator, guardian), who certifies their status and gathers the required consents.
For care recipients under a legal protection measure, consent procedures follow the rules of the measure (simple curatorship, reinforced curatorship, guardianship).
circle_memberships table.Weave only uses cookies that are strictly necessary for the service to operate (session, preferences) and, where applicable, anonymized audience-measurement cookies that are exempt from consent under CNIL recommendations.
Full details about these trackers, their lifetime and how to refuse them are available on our dedicated cookies page.
In the event of a breach likely to create a risk for your rights and freedoms, Weave notifies the French CNIL within 72 hours in accordance with article 33 of the GDPR, and informs you individually without delay where the risk is high (article 34).
This policy may be updated to reflect changes to the service or to regulations. Any substantial change is notified to you by email and via an in-app banner at least 30 days before it comes into force. The last update date is shown at the top of this page.
Data Protection Officer
Email: contact@schoenfg.com
Mail: Weave SAS — DPO, 12 rue du Faubourg Saint-Honoré, 75008 Paris, France.