Privacy notice

Controller

Kogulan Natarajan, Entrepreneur individuel, 61 rue de Lyon, 75012 Paris, France, info@gesalpai.ch, +33 7 51 83 13 96.

This notice describes current processing. It is not GDPR, nFADP, HIPAA or clinical certification.

Data we process

Account: email address, password handled by the authentication provider, session metadata.

Service: CSV files you upload, generation settings, technical logs, run identifiers, evaluation reports and generated synthetic CSVs.

Payment: Stripe receives the data needed to take payment. Gesalp stores subscription and usage state on the account.

Support: the content of messages you send to the address above.

Purposes

Create and authenticate the account, run hosted tabular generation, produce the evaluation report, bill paid plans, provide support and keep the service secure.

Do not upload identifiable patient information. The current offer is not PHI processing.

Where processing happens

Website: Vercel Inc. (United States).

API: a VPS from Contabo GmbH; the exact server country is not published here.

Supabase (project region eu-north-1, Stockholm).

Amazon Web Services, region eu-central-1 (Frankfurt), including object storage, orchestration, OMOP mapping and Bedrock referee calls. Some evaluation jobs call Amazon Bedrock as an automated referee, not as the writer of synthetic rows.

Stripe for payment.

We do not claim France-only, EU-only or Switzerland-only hosting.

What we do not do

We do not sell your files.

We do not train a Gesalp-owned public model on your CSVs.

We cannot certify cloud vendors’ training policies; their processing follows their terms.

Retention and deletion

Account and run data are kept while the account is active.

No measured backup window is published here. A delete action in the product does not by itself prove every copy is gone.

For access, correction or deletion requests: info@gesalpai.ch. We will confirm what could be removed.

Your rights

The controller is established in France, so the GDPR applies. You may request access, rectification, erasure, restriction, objection and portability, and complain to the CNIL (https://www.cnil.fr).

Swiss nFADP is not the publisher’s regime merely because the domain is .ch.