Privacy at Vylea

Controller

The controller responsible for processing personal data within the meaning of the General Data Protection Regulation (GDPR) is:

In short

Vylea is software for practices and self-employed professionals: clients, appointments, treatment records, invoices. It is for businesses only, not consumers. Two roles need to be kept apart:

For your account and your use of the software I am the controller. For your clients' data, you are the controller and I am your processor under Art. 28 GDPR; Vylea provides the contract for this (data processing agreement, available via the terms and in the app). Requests from clients about their data therefore go to you; I support you with them.

Vylea contains no advertising and does not sell data. The app runs no analytics script. There is no profiling and no automated decision with legal effect.

When you open the web pages

When you open a page, your browser sends data without which it cannot be delivered: IP address, date and time, the requested address, the referrer and the browser identifier. The pages are hosted by Netlify; the domain vylea.app runs through Cloudflare, which secures the connection and fends off attacks. During a security check Cloudflare may set a cookie (cf_clearance).

On the public pages (home, help, legal) Cloudflare Web Analytics measures in aggregate how often pages are viewed: page, approximate region, referrer, device type and browser. According to Cloudflare this sets no cookies, builds no profile and does not store your IP address.

The legal basis is Art. 6(1)(f) GDPR: delivering the pages securely and seeing how they are found. The providers decide how long they keep their logs.

Netlify, Inc.

101 2nd Street, San Francisco, CA 94105, USA

Data may be transferred to the USA. Netlify, Inc. is certified under the EU-U.S. Data Privacy Framework; the legal basis is the European Commission’s adequacy decision (Art. 45 GDPR).

Provider’s privacy policy

Cloudflare, Inc.

101 Townsend St., San Francisco, CA 94107, USA

Data may be transferred to the USA. Cloudflare, Inc. is certified under the EU-U.S. Data Privacy Framework; the legal basis is the European Commission’s adequacy decision (Art. 45 GDPR).

Provider’s privacy policy

Account and sign-in

You sign in with “Sign in with Apple” or with Google. I process the Apple identifier or your email address and, if you allow it, your name. You can optionally protect the account with a second factor (authenticator app). Account and session run through Supabase. People working in a practice or team are added with an invitation code; the practice owner sees the members and assigns rights.

The legal basis is Art. 6(1)(b) GDPR (contract for using the service). I keep the data as long as your account exists.

Supabase Pte. Ltd.

65 Chulia Street #38-02/03, OCBC Centre, Singapore 049513, Singapore

Transfers to a country outside the EU are based on the European Commission’s standard contractual clauses (Art. 46(2)(c) GDPR).

Provider’s privacy policy

Apple Distribution International Ltd.

Hollyhill Industrial Estate, Hollyhill, Cork, Ireland

Transfers to a country outside the EU are based on the European Commission’s standard contractual clauses (Art. 46(2)(c) GDPR).

Provider’s privacy policy

Google Ireland Limited

Gordon House, Barrow Street, Dublin 4, Ireland

Data may be transferred to the USA. Google LLC is certified under the EU-U.S. Data Privacy Framework; the legal basis is the European Commission’s adequacy decision (Art. 45 GDPR).

Provider’s privacy policy

Client data and records

Everything you enter in Vylea is stored at Supabase: client master data (name, address, health insurer), appointments with notes, treatment records, treatment photos, uploaded documents and receipts, invoices, the income and expense ledger and a change log. Transfer is encrypted, and access is limited to your practice by row-level rules. Invoices and PDFs are created in your browser.

This is mostly health data (Art. 9 GDPR). I process it only on your behalf and on your instructions, based on the data processing agreement (Art. 28 GDPR). The legal basis towards your clients is yours as controller, for healthcare professions usually Art. 9(2)(h) GDPR. I do not use the data for my own purposes.

Supabase Pte. Ltd.

65 Chulia Street #38-02/03, OCBC Centre, Singapore 049513, Singapore

Transfers to a country outside the EU are based on the European Commission’s standard contractual clauses (Art. 46(2)(c) GDPR).

Provider’s privacy policy

iOS and Android apps

This statement describes the web pages and the web app. The iOS and Android apps use the same account and the same storage at Supabase. In the iOS app, data is additionally kept encrypted on the device. Optionally, and off by default, you can store a backup in your own Google Drive in the iOS app and have appointments (with the client's name in the title) created in Google Calendar and invoices via Google Docs. This only happens with your explicit consent (Art. 6(1)(a), for health data Art. 9(2)(a) GDPR), which you withdraw in the settings. Without activation nothing goes to Google.

Google Ireland Limited

Gordon House, Barrow Street, Dublin 4, Ireland

Data may be transferred to the USA. Google LLC is certified under the EU-U.S. Data Privacy Framework; the legal basis is the European Commission’s adequacy decision (Art. 45 GDPR).

Provider’s privacy policy

Storage in your browser

The web app keeps in your browser what it needs to work: the session (for this tab only, it ends when you close it), a notice after automatic sign-out due to inactivity, light/dark mode and the chosen specialty in the item catalogue. These are not cookies for recognising you.

The legal basis is § 25(2) no. 2 TDDDG (strictly necessary) and Art. 6(1)(b) GDPR.

Deleting and exporting

You find a data export in the settings. You delete your account in the app under Settings → Delete account. Your access is deactivated immediately; client names, addresses and other identifying details are irreversibly overwritten, that is anonymised, not physically deleted. Invoices and bookings remain in anonymised form because tax-relevant records must be kept for ten years (§ 147 AO; Art. 17(3)(b) GDPR). Create an export first; nothing can be restored afterwards.

Your rights

You have the right of access to your data (Art. 15 GDPR), to rectification (Art. 16), erasure (Art. 17), restriction of processing (Art. 18) and data portability (Art. 20). You can object to processing based on legitimate interests (Art. 21). An email to the address above is enough.

You can also lodge a complaint with a data protection supervisory authority (Art. 77 GDPR), for example in the country where you live.