Privacy Policy

Version 1 — August 2026

1. Who are we?

PostSurgNutrition is operated by SELARL Cabinet dentaire du Docteur Mouraret, represented by Dr Sylvain Mouraret, dental surgeon and developer of the application.

SELARL Cabinet dentaire du Docteur Mouraret is responsible for determining the purposes and means of the processing of personal data carried out in connection with PostSurgNutrition.

2. Purpose of the application

PostSurgNutrition provides general nutritional information and recipe suggestions based on the user's procedure category, date of procedure, dietary preferences, allergies and disliked foods.

The application is designed to help users organize suitable meals during their post-operative healing period following oral or maxillofacial surgery.

PostSurgNutrition does not provide any diagnosis, medical prescription, medical treatment, clinical follow-up or emergency medical service. The application does not replace advice, instructions or follow-up provided by a surgeon, dental surgeon, physician, dietitian or other qualified healthcare professional.

Users must follow the recommendations given to them by their healthcare professional. In the event of unusual symptoms, complications or concerns regarding recovery, they should contact their healthcare professional promptly. In an emergency, they should contact the appropriate emergency services.

3. Personal data we collect

When you create and use a personalized PostSurgNutrition account, we may collect and process the following information:

• Account information: email address, unique account identifier and account creation date.
• Post-operative period information: general procedure category and date of procedure.
• Dietary preferences: dietary pattern, selected allergens and disliked foods.
• Consent records: indication that consent was obtained, date of consent and version of the legal information accepted.
• Technical and security information: information strictly necessary to authenticate the user, secure the account, operate the application and diagnose technical errors.

PostSurgNutrition does not request medical reports, clinical photographs, detailed diagnoses, prescriptions or free-text medical notes.

Information about allergies and disliked foods is optional. However, recipe suggestions may be personalized less precisely if this information is not provided.

4. Why and on what legal basis we use your data

We process personal data only for the following purposes:

• Account creation and authentication: to create, secure and manage the user's account and allow access to the application.
• Personalized recipe suggestions: to select recipes based on the general procedure category, date of procedure, dietary preferences, declared allergens and disliked foods.
• Calculation of the post-operative phase: to calculate the time elapsed since the declared procedure date and adapt the suggestions and information displayed by the application.
• Recording consents and compliance obligations: to record the date of consent to the processing of health data, the version of the Terms of Use accepted and the version of the Privacy Policy presented to the user.
• Security and technical operation of the application: to prevent unauthorized access, maintain service continuity and analyze technical or security incidents.

Legal bases for processing.

Account creation, authentication and management, as well as the provision of PostSurgNutrition features, are based on performance of the service requested by the user, in accordance with Article 6(1)(b) of the General Data Protection Regulation (GDPR).

Dietary preferences and disliked foods entered by the user are processed to personalize recipe suggestions as part of providing this service.

Certain information processed by PostSurgNutrition, in particular the procedure category, procedure date and declared allergies, constitutes or may constitute health data. Its processing is based on the user's explicit consent in accordance with Article 9(2)(a) GDPR, in addition to the applicable legal basis under Article 6 GDPR.

Consent to the processing of health data is collected separately when the account is created. The user may withdraw this consent at any time. Withdrawal of consent does not affect the lawfulness of processing carried out before the withdrawal.

Where the relevant data is necessary for personalization of the service, deletion of that data or withdrawal of consent may prevent the corresponding personalized suggestions from being provided.

PostSurgNutrition retains the information necessary to demonstrate that consent was collected, including the consent date and the version of the legal information presented to the user, in order to comply with applicable accountability and consent-demonstration obligations.

5. Who receives your data and where is it processed?

Personal data may only be accessed by authorized persons acting on behalf of SELARL Cabinet dentaire du Docteur Mouraret when such access is necessary for account administration, security, technical support or the exercise of users' rights.

PostSurgNutrition uses Google Firebase and Google Cloud services for account authentication, database hosting and the technical operation of the application. Google generally acts as a processor on behalf of the controller for these services.

The main application data associated with user accounts is stored in Cloud Firestore. The PostSurgNutrition database is configured in the European multi-region eur3, which includes infrastructure located in Belgium and the Netherlands, with a witness region in Finland.

Firebase Authentication processes information necessary for account creation, security and authentication, including information such as the email address, technical authentication data, IP address or device information. This service is operated exclusively from data centers located in the United States.

Certain technical operations may also involve Google or its authorized subprocessors in other countries.

Where personal data is transferred outside the European Economic Area, such transfers are governed by the mechanisms provided for by applicable law and by Google's contractual terms concerning data processing.

We do not sell personal data and we do not use health information for targeted advertising or commercial profiling.

6. Data retention and account deletion

Personal data is retained only for as long as necessary to provide the PostSurgNutrition service, manage the user account and comply with applicable legal obligations.

Account information, procedure information, dietary preferences, declared allergies and disliked foods are retained for the lifetime of the account unless deleted earlier by the user or where consent is withdrawn when that consent is the condition allowing the relevant data to be processed.

Users may request deletion of their account and the associated personal data at any time, either directly from the application or by contacting the address stated in this Privacy Policy.

Following an account deletion request, the user's active data stored by PostSurgNutrition and the associated Firebase Authentication account are deleted as soon as reasonably possible, subject to information that must be retained temporarily to comply with a legal obligation or to establish, exercise or defend legal claims.

According to information provided by Google, once deletion of a Firebase Authentication user has been initiated, the corresponding authentication information is removed from Firebase active and backup systems within a period of up to 180 days. This technical retention period concerns Firebase Authentication systems and does not mean that the user's active account data remains accessible in PostSurgNutrition during that period.

Information needed to demonstrate that consent and applicable legal documents were validly presented and accepted may be retained, after account deletion or withdrawal of consent to the processing of health data, in a separate restricted-access archive.

This archive contains only the information necessary for evidentiary purposes, including the user's email address and former technical account identifier, the date and version of the health-data consent, the version of the Privacy Policy presented to the user, the date and version of the Terms of Use accepted, and the date and reason for account deletion. It does not contain the procedure category or date, dietary preferences, declared allergies, disliked foods, selected meals or shopping-list information.

These archived items are retained for a maximum of five years from account deletion or withdrawal of consent, solely to demonstrate compliance with applicable legal obligations and, where necessary, to establish, exercise or defend legal claims. They are not used to provide or personalize the PostSurgNutrition service, for advertising or for commercial profiling.

PostSurgNutrition does not retain or use procedure information, declared allergies or dietary preferences for advertising or commercial profiling purposes.

7. Your data protection rights

In accordance with applicable personal data protection law, and subject to the conditions laid down by the GDPR, you have:

• a right of access to your personal data;
• a right to rectify inaccurate or incomplete data;
• a right to erasure in the cases provided for by law;
• a right to restriction of processing in the cases provided for by the GDPR;
• a right to data portability where the legal conditions for this right are met;
• the right to withdraw your consent to the processing of health data at any time. Withdrawal does not affect the lawfulness of processing carried out before the withdrawal;
• a right to object where that right applies to the processing concerned.

You can also modify certain information directly from your account and request deletion of your account from within the application.

To exercise your rights or ask any question regarding the processing of your personal data, you may contact: contact@postsurgnutrition.com

We will respond to your request as soon as possible and, in principle, within one month of receipt. This period may be extended by two months where the complexity or number of requests justifies it. In that case, you will be informed of the extension and the reasons for it within the initial one-month period.

You also have the right to lodge a complaint with the French data protection authority, the Commission nationale de l'informatique et des libertés (CNIL), if you consider that the processing of your personal data does not comply with applicable law.

8. Security of personal data

We implement technical and organizational measures designed to provide a level of security appropriate to the nature of the data processed and the associated risks.

These measures include in particular:

• the use of secure authentication mechanisms;
• access rules designed to prevent one user from accessing another user's data;
• restriction of administrative access rights to duly authorized persons and service providers, to the extent necessary for their tasks;
• use of the security mechanisms provided by Google Firebase and Google Cloud;
• removal of access rights that are no longer necessary;
• the ability for users to delete their account and associated personal data;
• monitoring and remediation of identified technical or security incidents.

Despite the measures implemented, no IT system or Internet-accessible service can guarantee absolute security. In the event of an incident likely to affect the confidentiality, integrity or availability of personal data, appropriate measures will be taken in accordance with applicable law.

9. Changes to this Privacy Policy

This Privacy Policy may be updated to reflect changes in PostSurgNutrition, its features, the technical services used or applicable law.

In the event of a material change concerning, in particular, the purposes of processing, the categories of data processed or the conditions under which health data is processed, users will be informed appropriately.

Where required by law, new consent will be requested before the relevant processing is implemented.

Continued use of the application will not, by itself, constitute explicit consent to a new use of health data.

10. Age restriction

PostSurgNutrition is intended for persons aged 18 or over.

The application is not intended for minors and must not be used to create or manage an account on behalf of a person under 18.

If we learn that personal data relating to a minor has been collected in breach of this restriction, we will take appropriate steps to delete that data.