The Tongue Teacher SAS
Version 1.0 dated 13/11/2025
Article 1 – Purpose of the Policy
1.1 Purpose and Transparency
This Privacy Policy is intended to inform healthcare practitioners using the Services provided by The Tongue Teacher SAS about the collection, use, and protection of their personal data.
1.2 Scope
It applies exclusively to practitioners’ personal data collected in the context of using the Services (practitioner dashboard and mobile application).
Article 2 – Data Controller
2.1 Identification
The data controller is The Tongue Teacher SAS, a simplified joint-stock company under French law, whose registered office is located at 44 Avenue Maurice Thorez, 13110 Port-de-Bouc, France.
2.2 Contact Details
For any questions relating to data protection, practitioners may contact The Tongue Teacher SAS:
- by mail: 44 Avenue Maurice Thorez, 13110 Port-de-Bouc, France ;
- by email: dpo@tongueteacher.com
Article 3 – Data Collected
3.1 Identification and Contact Data
First name, last name, email address, phone number.
3.2 Professional Data
Practice address, RPPS or FINESS number, VAT number where applicable.
3.3 Billing Data
Information necessary for invoicing and payment. Payments are processed via Stripe Payments Europe Ltd. The Tongue Teacher SAS does not store any banking data.
3.4 Connection and Security Data
IP addresses, connection logs, and security logs.
3.5 Browsing Data
Information collected via cookies and trackers, including analytical and technical data.
3.6 Usage and Practice Data
The Tongue Teacher SAS also collects data relating to the practitioner’s use of the platform, including:
– patient cohorts monitored and their aggregated characteristics;
– cohort adherence and progression rates (in anonymized form);
– programs launched by the practitioner and their frequency of use;
– practitioner configuration preferences (validation thresholds, customization of programs or self-assessments, exercise selection).
These data are used solely for the proper functioning of the Services and for the continuous improvement of the platform.
They are not used for any commercial exploitation aimed at individually targeting practitioners.
Article 4 – Purposes and Legal Bases for Processing
4.1 Account Management
Creation and management of the practitioner account, provision of the Services – legal basis: performance of the contract.
4.2 Invoicing and Legal Obligations
Issuing invoices, accounting retention – legal basis: legal obligation.
4.3 Security and Fraud Prevention
Access management, IP tracking, abuse prevention – legal basis: legitimate interest.
4.4 Improvement of the Services
Analysis of usage and feature optimization – legal basis: legitimate interest.
4.5 Commercial Communication and Newsletters
Sending information, updates, and newsletters – legal basis: consent (opt-in).
4.6 Personalized Provision of the Services
These data are used to allow the practitioner to use the platform according to their preferences and defined settings.
Legal basis: performance of the contract.
4.7 Statistics and Global Analysis
The Tongue Teacher SAS may use and aggregate these data to produce global statistics on program usage, performance, patient adherence levels, or the state of orthodontic practice by region or country.
These statistics are produced in aggregated and anonymized form.
They do not allow identification of a patient nor individual exploitation of a practitioner’s activity for commercial prospecting purposes.
Legal basis: legitimate interest of The Tongue Teacher SAS (Service improvement, global studies).
Article 5 – Data Retention Periods
5.1 Identification Data and Practitioner Account
Retained for the entire duration of the contractual relationship and deleted within twelve (12) months after termination.
5.2 Billing and Accounting Data
Retained for ten (10) years in accordance with legal obligations.
5.3 Connection Data and Logs
Retained for a maximum period of twelve (12) months.
5.4 Browsing Data (Cookies)
Retained for varying durations depending on the type of cookie (see Article 8).
5.5 Consistency with the GTC
The retention periods defined above are aligned with those provided in the GTC.
In case of discrepancy, the GTC shall prevail.
Article 6 – Data Recipients
6.1 Internal Access
Data are accessible only to authorized personnel of The Tongue Teacher SAS, subject to confidentiality obligations.
6.2 Technical Processors
- HDS hosting: OVH and Amazon AWS HDS;
- Payment: Stripe Payments Europe Ltd;
- Emailing: Brevo (Sendinblue).
6.3 Other Recipients
The Tongue Teacher SAS may engage other trusted processors. This Policy will be updated where applicable.
6.4 Sub-Processors
Certain technical providers of The Tongue Teacher SAS (for example Amazon AWS or Brevo) may themselves use sub-processors to deliver their services. These sub-processors are required to comply with GDPR requirements and provide appropriate data protection safeguards.
Article 7 – Transfers Outside the European Union
7.1 Location
Data are hosted within the European Union.
7.2 No Transfer
No transfer of personal data outside the EU is planned.
7.3 Safeguards in Case of Future Transfer
If a transfer were to occur, The Tongue Teacher SAS undertakes to implement safeguards compliant with the GDPR (Standard Contractual Clauses, enhanced security measures).
7.3 Occasional Transfers Outside the EU
Although no systematic transfer outside the European Union is planned, certain providers (e.g., technical support of Stripe, AWS, or Brevo) may occasionally process data from a third country. In such cases, The Tongue Teacher SAS ensures that these transfers are governed by GDPR-compliant safeguards, in particular the Standard Contractual Clauses (SCC) adopted by the European Commission.
Article 8 – Cookies and Trackers
8.1 Essential Technical Cookies
Used to ensure the proper functioning of the Services. They are exempt from consent.
8.2 Analytical Cookies
Used to analyze Service usage to improve quality and performance. Collection is subject to consent if the data are not anonymized.
8.3 Marketing Cookies
Used to deliver personalized content and communications. Their placement is subject to the practitioner’s prior consent.
8.4 Settings
The practitioner may configure their preferences via the cookie banner displayed upon first connection.
Article 9 – Data Subject Rights
9.1 GDPR Rights
Practitioners have the right of access, rectification, erasure, restriction, objection, and portability of their data.
9.2 Exercising Rights
These rights may be exercised at any time by sending a request to: dpo@tongueteacher.com.
9.3 Response Time
The Tongue Teacher SAS undertakes to respond to requests within a maximum of thirty (30) days, in accordance with the GDPR.
Article 10 – DPO Contact Details
10.1 Contact
The Data Protection Officer (DPO) of The Tongue Teacher SAS is externalized.
They may be contacted at the following address: dpo@tongueteacher.com.
Article 11 – Security and Confidentiality
11.1 Security Measures
The Tongue Teacher SAS implements the technical and organizational measures necessary to ensure the security and confidentiality of personal data.
11.2 HDS Hosting
All data are hosted on HDS-certified servers, in compliance with requirements relating to health data.
11.3 Breach Notification
In the event of a personal data breach, The Tongue Teacher SAS will notify the CNIL and, where applicable, the data subjects, in accordance with Articles 33 and 34 of the GDPR.
Article 12 – Policy Updates
12.1 Right to Modify
The Tongue Teacher SAS may modify this Policy at any time, particularly to comply with legal, regulatory, or technical developments.
12.2 Notification
Any substantial modification will be notified to practitioners electronically or by any other appropriate means.
12.3 Entry into Force
This Policy enters into force on the date of its publication and remains applicable until replaced by a new version.