Privacy policy
What SeptiMap processes, what it does not, and how to check for yourself. No personal health data is collected: SeptiMap has no account, no patient form and no clinical input field.
What SeptiMap does not collect
SeptiMap requires no registration, itself collects no personal data from its visitors, uses no third-party tracker (no pixel, no advertising network, no analytics tool on another domain) and sets no cookie. Two processing operations exist: the technical connection logging performed by the host and a cookieless audience measurement, both described below. This absence of trackers is verified by an automatic check in the repository’s continuous integration, which loads the site, served locally, in a real browser and fails if a single request goes to a domain other than the site’s own; the audience measurement, loaded only on septimap.fr, is not covered by this check.
SeptiMap processes no personal health data: no information about any patient is entered, stored or transmitted. There is no user account, no identifier and no form in which to enter a clinical case. It therefore does not fall under the French requirement for certified health-data hosting (HDS, article L.1111-8 of the public health code), which applies to data that does not exist here.
An earlier version of this page mentioned “aggregated statistics collected by Vercel Analytics” although no such tool was connected. Since 31 October 2026 this measurement is actually in place; it is described below.
Audience measurement (cookieless)
To know which pages are viewed, the site uses Vercel Web Analytics, provided by the host. The script is served by the site’s own domain and talks only to it: no request goes to another domain. It sets no cookie and writes nothing to your browser.
For each page view, the following is measured: the page address, the referring page, the country, the device type, the browser and the operating system. According to Vercel’s documentation, visitors are distinguished only by a fingerprint computed from the request, which is not kept beyond 24 hours; the publisher sees only aggregated totals, never an individual visit.
This measurement serves only to understand how the site is used in order to improve it. It is not combined with any other data and is not used for advertising.
What is stored in your browser
Seven localStorage keys, all local to your device (onboarding state, quiz statistics, exercise progress and recent searches). They are never transmitted, neither to the site nor to a third party. Clearing your browser site data deletes them permanently.
In addition, two sessionStorage keys, deleted when the tab is closed and never transmitted: septimap-b:scroll (address and scroll position of the pages opened in the tab, to restore them when you come back) and septimap:chunk-reload (time of an automatic reload after a site file failed to load, to avoid reloading in a loop).
septimap-onboarded-v2— remembers that the welcome message was dismissed.septimap-quiz-stats— statistics for the “Learn” tab: sessions, answers, correct answers.septimap-srs-v1— spaced-repetition state (which cards to review, and when).septimap-srs-streak— date of the last revision day and streak length.septimap-quiz-errors-v1— quiz questions you missed, to offer them again (a correct answer clears them).septimap-b:recent— your last five searches, suggested in the search field.septimap-b:vignette-hints— number of hints viewed per clinical case.
Offline cache (service worker)
The site installs a service worker that keeps, in your browser’s Cache Storage, a copy of the site’s public files (page shell, scripts, stylesheets, icons, and the 3D models already viewed), and, in IndexedDB, the date each file was cached, used to expire it, to speed up later visits and allow offline display. This cache contains only files of the site, identical for every visitor; it holds no data about you and nothing is transmitted from it, neither to the site nor to a third party. Clearing your browser site data removes it.
AI-generated synthesis
This function is disabled on the current hosting: no request is sent to any inference service, and no synthesis is offered on the cards. If it is re-enabled, this page will describe what is transmitted before the function becomes available.
Hosting logs
Technical hosting and logging are performed by Vercel Inc., acting on behalf of the publisher as a processor (GDPR art. 28). The host logs the IP address, the timestamp and the pages requested, for the security and operation of the service. An IP address is personal data (GDPR art. 4.1): this processing is under the publisher’s responsibility and is carried out under the host’s privacy policy: https://vercel.com/legal/privacy-policy. The audience measurement described above is separate: it does not rely on these logs.
The host is established in the United States; technical logging therefore takes place outside the European Union.
Legal basis, retention, rights
- Legal basis
- Legitimate interest (GDPR art. 6.1.f): security and technical operation of the site. Same basis for the cookieless audience measurement: understanding how the site is used in order to improve it. No processing based on consent.
- Data processed
- IP address, timestamp and pages requested, logged by the host on behalf of the publisher (technical logs). For audience measurement: page viewed, referrer, country, device type, browser and system, aggregated. No other data; no direct collection by the publisher.
- Retention
- That of the host’s technical logs, set by its own policy; for audience measurement, that of the Vercel Web Analytics statistics (visitor fingerprint discarded within 24 hours). The publisher builds no file and retains nothing on its side.
- Recipients
- The host, as technical processor (see Legal notice). No one else.
- Your rights
- The processing operations are technical logging and audience measurement, both operated by the host. The rights of access, rectification, erasure, restriction and objection (GDPR art. 15 to 22) are exercised with the publisher, as controller: contact@septimap.fr. The publisher relays the request to the host. Complaints may be lodged with the CNIL.
- Data protection officer
- None is appointed: the publisher is not required to appoint one (GDPR art. 37) for processing limited to technical logs and aggregated audience measurement.