Privacy

Version 30 October 2026.

Who

BV La Lumière Consulting (SRL), Avenue Louise 323 bte 9.1, 1050 Ixelles, Belgium. Enterprise no. 0762.735.942, VAT BE0762735942. We decide how your data is used, which makes us the controller. Contact for anything here: frederic@lalumiereconsulting.be.

What we keep, why, and the legal basis

• Your account: email, plan, subscription status, the amounts and your country as Stripe returns them, and the campaign tag on the link you came from. To run your subscription. Basis: the contract (GDPR art. 6(1)(b)).
• Payment records. To keep our accounts. Basis: a legal obligation (art. 6(1)(c)).
• Your health data (below). To run Matthieu for you. Basis: your explicit consent (art. 9(2)(a)), which you give on the consent screen, the first step after you order, before you connect or upload anything, and the contract.
• Sign-in times, connection times and how much AI each member uses, with no health values. To keep the service secure and its cost in check. Basis: our legitimate interest in security and in running the service (art. 6(1)(f)).
• Other mail from Frederic, only if you ticked the box. Basis: your consent (art. 6(1)(a)). One click in each mail stops it.
• Page counts: no cookie, no identifier, no IP address.

Your health data

• What we keep:
  • From Apple Health, through the Shortcut on your iPhone, once a day: sleep, heart rate, heart rate variability, steps, workouts and weight.
  • From Oura, once you sign in to Oura from your account: sleep, readiness and activity.
  • Blood test and MoleQlar results you upload: the PDF and the markers you confirm.
  • What you enter: your goals, training, meals, supplements, medicines with their supply dates, and the names of your doctor and coach.
  • What Matthieu writes for you: your daily brief, your plan, its answers, and the questions you ask it.
• Where: Fly.io's servers in Amsterdam, encrypted at rest. Only Frederic has access.
• Never: sold, used for advertising, shared with MoleQlar or any other company, used for any other business of Frederic's, or used to train a model.
• No decision with legal or similarly significant effect is made about you by automated means.

Matthieu is an AI

• Matthieu runs on our servers and uses Claude, a model made by Anthropic. To write your brief or your plan, read a test you upload, or answer a question, we send Anthropic the part of your health data that job needs.
• Anthropic processes it for us, under its data processing agreement with us. It doesn't use it to train its models, and it deletes it within 30 days.
• Your Oura numbers are never sent to Anthropic or any other AI. You see them in the app. Matthieu reads sleep and recovery from Apple Health, where the Oura app can write them.
• Each member has a daily AI limit. If you reach it, Matthieu pauses until the next day and we see that it paused, not what it read.
• Private mode, optional, for Mac users: Matthieu runs in your own Claude Code under your own agreement with Anthropic. Your chats then stay on your Mac and only the summary you sync reaches us.

Who receives data

• Fly.io, Inc. (USA): hosting, servers in Amsterdam.
• Anthropic, PBC (USA): runs Matthieu's AI, as above.
• Brevo SAS (Paris, France): sign-in and account mail, servers in France and Belgium. No health data is ever put in a mail.
• Stripe: payments. Your card details go to Stripe, never to us.
• Oura: when you connect it, Oura sends us your numbers. We send Oura nothing about you beyond the sign-in.
• YouTube (Google): only when you press play on the film. Google then receives your IP address under its own privacy policy.
• Nobody else. No doctor, coach, pharmacy or shop receives anything from us. What you send them, you send yourself from your own mail.

Outside the EU

Fly.io, Inc., Anthropic, PBC, Stripe, LLC and Brevo's network provider Cloudflare are US companies. Transfers to them rely on the EU-US Data Privacy Framework (Commission Implementing Decision (EU) 2023/1795). Where a company isn't listed under it, the standard contractual clauses in its data processing agreement apply.

How long

• Health data: while your account is open.
  • If you delete it: gone from our server at once, from backups within 30 days.
  • If you close your account: deleted 30 days after it closes.
  • What Anthropic received: deleted by Anthropic within 30 days.
• Account data: until 30 days after your account closes.
• Payment records: 7 years, as Belgian accounting law requires.
• Sign-in, connection and AI-use log lines: 12 months.
• An email that didn't subscribe and didn't tick the box: 12 months.
• Consent for other mail: until you stop it.

Your choices and rights

• Withdraw consent any time with "Withdraw consent and delete my health data" in your account settings. Your health data is deleted, Apple Health and Oura are disconnected, Matthieu stops, and you can cancel with a refund of the unused part. Withdrawing doesn't affect what was done before.
• You can see, correct, download (Download in your account, as JSON), delete, restrict or object to the use of your data. Mail frederic@lalumiereconsulting.be. We answer within one month.
• The service can't run without your health data, which is why the consent is needed for the subscription.
• You can complain to the Belgian Data Protection Authority, Rue de la Presse 35, 1000 Brussels, contact@apd-gba.be, www.dataprotectionauthority.be, or to the authority in your own country.

If a member names you

When a member enters you as their doctor or coach, we store your name, role and practice in their account so they can see it. We never contact you. Mail us to object.

Cookies

One cookie, set only when you sign in, keeps you signed in for 90 days. No other cookie and no outside measurement tool. The film loads from YouTube only when you press play.

Age

Matthieu Bridge is for people 18 and older.

Changes

We mail you before any change to this notice that affects you.