Privacy policy

01Data Controller

The controller of the personal data collected through the coreod.ch website is COREOD LTD (company number 16185144, 128 City Road, London, EC1V 2NX, United Kingdom).

For any question relating to your data: contact@coreod.ch

01bEstablishment in the European Union and point of contact

This website is published by COREOD LTD (a company incorporated under the laws of England and Wales, company number 16185144, registered office 128 City Road, London EC1V 2NX, United Kingdom), acting as the data controller for the data collected through this website.

For the European Union, COREOD LTD acts through its establishment in the Union, Coreod Consulting (SIREN 750 531 469), based in France. This establishment serves as the point of contact for data subjects residing in the European Union and for supervisory authorities, including the French data protection authority (CNIL).

Data subjects may exercise their rights (access, rectification, erasure, restriction, objection and portability) and raise any question relating to the protection of their data at: privacy@coreod.ch.

Given this establishment in the European Union, COREOD LTD is not required to designate a representative under Article 27 of the GDPR.

02What data we process

The coreod.ch website is a static showcase website. It does not create accounts, does not offer any login form, and does not deploy any audience-measurement tool, advertising tracker or cookie (see the Cookie Policy). Practices specific to the Noaisis application are described in the "Noaisis application" section below. The only personal data we may process are:

• the data you send us voluntarily when you write to us at contact@coreod.ch (your email address, your name if you provide it, and the content of your message), used solely to respond to your request;
• the technical connection data processed automatically by our hosting provider for the sole purpose of the security and proper operation of the website (for example the IP address at the time of the request, in the server logs), which COREOD LTD does not use for tracking purposes nor cross-reference with your identity.

03Contact and enquiry form

The coreod.ch website offers a contact and enquiry form so that you can join the Noaisis waiting list, request a NeurAixplorer™ demonstration, or reach us about a partnership, a press matter or product information.

Controller. COREOD LTD (company number 16185144, 128 City Road, London, EC1V 2NX, United Kingdom) is the controller of the data collected through this form.

Data collected. Required: your email address. Optional: your first name, last name, company, telephone number and the content of your message, together with the subject you select. We also record the consent you give, the version of the consent text and the date and time of your submission. Please do not enter sensitive personal data in the message field.

Purposes. Your data is used solely to handle your request, to contact you about it and to follow up on our exchange.

Legal bases. Your consent, given by ticking the dedicated box (article 6(1)(a) of the GDPR), and, where your request forms part of a commercial relationship, the performance of pre-contractual measures taken at your request (article 6(1)(b) of the GDPR).

Recipients. Your data is sent to COREOD LTD’s internal teams in charge of your request and is processed through our email provider acting as a processor within the meaning of article 28 of the GDPR. The submission is relayed by a serverless function operated in a European Union region. We do not sell or rent your data and pass it on to no third party for commercial or advertising purposes.

Transfer outside the European Union. COREOD LTD is established in the United Kingdom, a country recognised by the European Commission as offering an adequate level of protection (adequacy decision). Where a processor processes data outside the European Union, the transfer is framed by the appropriate safeguards provided for by the GDPR (standard contractual clauses).

Retention. The data submitted through the form is kept for the time needed to handle your request and, where it leads to a relationship, for a maximum of three years from our last contact, then deleted or archived within the limits of the applicable statutory periods.

Rights. You may at any time withdraw your consent and exercise your rights of access, rectification, erasure, restriction, objection and portability by writing to contact@coreod.ch. Withdrawing your consent does not affect the lawfulness of processing carried out before the withdrawal. You may also lodge a complaint with a supervisory authority, in particular the CNIL (France) or the ICO (United Kingdom).

04Legal bases

The processing of your contact message rests on our legitimate interest in responding to your enquiry (article 6(1)(f) of the GDPR), or on the performance of pre-contractual measures where your request forms part of a commercial relationship (article 6(1)(b)). The processing of data submitted through the contact form rests on your consent and, where relevant, on pre-contractual measures (see section 03). The processing of technical connection data rests on our legitimate interest in ensuring the security and availability of the website (article 6(1)(f) of the GDPR).

05Recipients and hosting

The website is hosted by Vercel Inc. (United States), through its European representative Vercel GmbH (Germany), acting as a processor within the meaning of article 28 of the GDPR. On this basis, technical connection data may be processed on infrastructure located outside the European Union. These transfers are framed by the appropriate safeguards provided for by the GDPR (standard contractual clauses of the European Commission).

The website is designed not to call upon any third-party service while you browse: the fonts and all resources are hosted directly with the website. No request is sent to a third-party server as a result of your mere visit.

We do not sell or rent your data. No data is passed on to third parties for commercial or advertising purposes.

06Noaisis application

This policy also covers the Noaisis mobile application, on iPhone and on Android. The sections below describe how the application processes data, in addition to the website practices described above.

Conversations with Orion and Celeste. Within the application, the content you exchange with the assistant is sent, through our server, to our technical processors in order to generate a response. We use Anthropic (the conversational model provider) and Tavily (web search). This content is sent without your email address or account identifier (only the first name or nickname you gave Orion accompanies your exchanges, if you entered one), and is not stored on Coreod servers.

Anthropic may retain transmitted content for up to 30 days for security and abuse-prevention purposes, after which it is deleted. This period may be longer where its automated safety systems detect a use that breaches its policies, or where the law requires it. Anthropic does not use this content to train its models. Tavily processes web search queries solely to return search results. Neither processor uses your content for advertising, and Coreod does not track you across applications or websites.

Orion’s voice. When you listen to a reply read aloud, the text of that reply is sent to our text-to-speech provider, ElevenLabs, to be read.

Anthropic, Tavily and ElevenLabs are located in the United States. These transfers are governed by the European Commission’s standard contractual clauses or, for ElevenLabs, by its certification under the EU-US Data Privacy Framework.

Your health data. On iPhone (Apple Health). By default, data from the Apple Health application is read locally on your device, read-only: Noaisis never writes to the Health app. It is never stored by Coreod.

If you give your explicit health consent in the app, a factual summary of your Apple Health readings, of your in-app journal (meals, supplements, logged sleep, blood glucose, fasting periods) and of your profile if you have filled it in (age, height, weight, activity, self-description, goals) may be included in your conversations with the assistant. This summary then travels with your message to the processors described above (see the Anthropic section), without your email address or account identifier, and is never stored by Coreod.

On Android (Health Connect). If you allow it, Noaisis reads some of your Health Connect data, read-only, while the app is open and over 30 days at most, to display it to you: steps, distance, floors, active energy, basal metabolic rate (to estimate resting energy), exercise sessions, sleep, resting heart rate, heart rate variability (as a trend) and VO2 max. Noaisis writes nothing to Health Connect and never reads it in the background.

If you also allow Orion and Celeste to use it, through a separate in-app consent you can withdraw, a summary of seven of these readings, with their values (sleep, steps, distance, active energy, resting heart rate, heart rate variability trend, VO2 max), accompanies your message to our AI partner, Anthropic, which processes it on our behalf to generate Orion’s or Celeste’s reply. Floors, basal metabolic rate and exercise sessions stay on your device. Coreod does not keep this data on its servers, does not sell it, does not use it for advertising and does not use it to train an AI. You can withdraw these permissions at any time in Noaisis or in Health Connect.

Noaisis’s use of information received from Health Connect adheres to the Health Connect Permissions policy, including the Limited Use requirements.

As on iPhone, if you give your explicit health consent in the app, Orion may also receive a factual summary of what you record yourself in Noaisis (meals, supplements, nights, blood glucose, fasting periods) and of your profile if you have filled it in (age, height, weight, activity, self-description, goals). It travels with your message to the processors described above, without your email address or account identifier, and is never stored by Coreod.

On both platforms, you can withdraw your health consent at any time in the app settings. From that point on, no health data is included in your conversations.

Food search and barcode scanning. On iPhone, if you allow it, the app uses the camera only to read a food barcode. No image is stored or sent.

On Android, scanning uses the scanner provided by Google Play services: it reads the code on your device, without Noaisis accessing the camera or receiving any image. Google receives technical metrics about how this module works (for example the device model, the version and an identifier specific to the installation), which it processes under its own terms.

When a food is not in the database built into the app, or when you scan a barcode, only your search words or the barcode number are sent to public food databases (such as Open Food Facts) to find the product. Your food journal is stored on your device; it only reaches your conversations with your health consent, as described above.

Account. To use the app, you create a free account with your email address. Your email is the only information this account requires. To create it, we process your email address and send you a six-digit confirmation code, single-use and short-lived. This code serves only to verify that the address is yours. Legal basis: performance of our contract with you (article 6(1)(b) GDPR). Your email is kept for the life of your account. You can delete your account, and the associated data, at any time from within the app (“Delete my account and my data”), through the page coreod.ch/delete-account, or by writing to privacy@coreod.ch.

We use your email for messages that the service requires: your confirmation code, information about your trial and your subscription, a change to our terms, a security alert. We may also write to you about Noaisis, for example to offer you a deal if you have stopped your subscription: where you did not object when this option was presented to you, or where you asked us to. You can decline these offers at any time, and in every message, without losing any of your access to the service.

Subscription. On iPhone, when you start your trial or take out the subscription, the purchase is made with Apple. Apple collects the payment and holds your payment details: Coreod never receives them and never stores them. To know whether your access is open, our servers keep a subscription record containing a technical reference to your account, the current access tier, its expiry date, the date of the last event received from Apple, and the original transaction identifier provided by Apple. This record contains no health data, no amount and no payment method. Legal basis: performance of our contract with you (article 6(1)(b) GDPR), and our legitimate interest in preventing subscription fraud (article 6(1)(f)). It is deleted when you delete your account.

Subscription on Google Play. On Android, purchase, renewal, cancellation and refunds are handled by Google Play. Our server receives confirmation of the subscription from Google Play (purchase reference, status, expiry) to open your access; no payment details. The subscription record described above then carries, instead of Apple’s references, a one-way fingerprint of the Google Play purchase reference; it is deleted when you delete your account. At the time of purchase, the app sends Google Play a one-way fingerprint of a technical identifier of your Noaisis account, without your email address, to link the subscription to your account.

When you turn automatic renewal off or back on, or your subscription ends, Apple or Google Play informs us. Coreod may receive an internal alert containing your account email address, the date and the nature of the event. On the basis of our legitimate interest, we use it to understand why people leave or come back and, where appropriate, to write to you as described above. It contains no health data and none of your conversations, and it is kept for twelve months at most. You can object to this processing by writing to privacy@coreod.ch.

Deleting your Noaisis account does not cancel your Apple or Google Play subscription. To stop the charges, cancel from your Apple account settings or in the Google Play app, as explained in our Refund policy.

Abuse prevention. Only where a serious, objectively established abuse is detected, Coreod keeps an encrypted technical record (such as a time-stamped IP address and technical metadata), strictly to protect the service and defend its rights, on the basis of our legitimate interest (article 6(1)(f) GDPR). This record never contains your conversations with the assistant or any health data, its access is restricted and its retention is capped.

The application displays no advertising and does not track you across any other app or website. Apart from the account email, the subscription record described above and the limited abuse-prevention record, Coreod collects no advertising identifiers or usage analytics. On Android, Google’s barcode scanner module sends Google its own technical metrics (see above).

Our providers for the application. In addition to Anthropic, Tavily and ElevenLabs mentioned above, we rely on Supabase (hosting of the account database and the authentication service) and Brevo (delivery of our emails, including your confirmation code), acting as processors within the meaning of article 28 GDPR.

Apple is not our processor: on iPhone, Apple is the seller of the subscription and acts as an independent controller for the transaction; it passes on to us only information about the status of your subscription.

Google is not our processor: it distributes the Android app through Google Play, collects the subscription payment there and manages the subscription, depending on the country either as the seller or on our behalf, and acts as an independent controller for the transaction; it also provides the barcode scanner, whose technical metrics it processes on its own behalf, under its own terms. Health Connect runs on your device: Noaisis sends Google none of the data it reads there.

Where processing takes place outside the European Union, it is framed by the appropriate safeguards provided for by the GDPR (European Commission standard contractual clauses).

07Retention period

Messages received at contact@coreod.ch are kept for as long as is necessary to handle your request, then archived or deleted according to their nature, within the limits of the applicable statutory periods. The hosting provider’s technical logs are kept for a limited period, in accordance with its security policy.

For the application: your email address is kept for the life of your account; your subscription record is deleted with your account, as described in section 06; the six-digit confirmation code is single-use and short-lived; the abuse-prevention record is kept for a limited and capped period. Coreod never receives or keeps your Health Connect data: it is read and displayed on your device.

08Your rights

In accordance with the GDPR, you have the right of access, rectification, erasure, restriction, objection and portability over your personal data. You may exercise these rights by writing to contact@coreod.ch. You may also lodge a complaint with a supervisory authority, in particular the CNIL (France) or the ICO (United Kingdom).

09Updates

This policy may be updated to reflect changes to the website or to the applicable regulations. The applicable version is the one published on this page.