Privacy policy

Last updated March 2, 2026

Who is responsible for your data

The controller of the personal data described here is MLJ, SASU, publisher of CarePlanTrack, registered in Paris, France under SIREN 934 769 837. The publication director is Jimenez Julien. Any question about this policy, and any request to see, correct or delete your data, goes to jimenezjulien42@gmail.com. A person reads that inbox and replies in writing.

This policy concerns the public website only. If your clinic subscribes to the CarePlanTrack service, the handling of patient records inside the application is governed by the subscription agreement and by the business associate agreement we sign with your practice, not by this page.

What the contact form collects

The home page carries one form. It sends us the following fields, and nothing else: name (your full name), email (your work email address), company (your practice name), role (your role in the clinic, chosen from a list), request (whether you want a demonstration, early access to a new feature or a quote), size (how many providers adjust in your clinic, chosen from a list), message (the free text you write about your care plans) and consent (the checkbox confirming you agree to this policy).

Three hidden fields travel with each submission for routing purposes: form-name, which identifies the form; subject, a fixed line naming the brand and domain; and recipient, the mailbox that receives the message. A fourth hidden field named bot-field exists only to catch automated spam and is always empty when a human submits the form. Our form processor also records the submission date and the IP address the submission came from, as part of its standard spam protection.

Please do not put patient names, dates of birth, diagnoses or any other protected health information into the message box. We do not need it to answer you, and a marketing contact form is the wrong place for it. If you send it anyway, we will delete the submission and ask you to write again without it.

Why we hold it, and on what legal basis

We use what you send for one purpose: to answer your request and, if you ask for it, to arrange and follow up a demonstration of the software. We do not add you to a newsletter, we do not build a profile, and we do not sell, rent or share your details with data brokers or advertising networks. Under the GDPR the legal basis is your consent, given by ticking the consent box, together with our legitimate interest in responding to a commercial enquiry that you started. Under US state privacy laws the processing is a business purpose disclosed to you at the point of collection.

Who processes it with us

The website is hosted by Netlify, Inc., 512 2nd Street, Suite 200, San Francisco, CA 94107, United States. Netlify Forms receives, stores and forwards every submission from the contact form, acting as our processor under contract. Netlify stores form entries in its own dashboard, from which we retrieve and answer them, and it applies its own spam filtering. Netlify also records standard server logs, including IP addresses, for security and abuse prevention.

Replies are sent from an email account operated by Google, so a copy of the correspondence sits in that mailbox. Beyond hosting and email, no other company receives your data from this website. There is no customer relationship management platform behind this form, no advertising pixel, and no lead enrichment service.

Cookies and measurement

This website sets no advertising cookies and runs no third party analytics scripts. There is no Google Analytics tag, no Meta pixel, no session recorder and no cross site tracker on any page. The only fonts loaded from outside the domain come from Google Fonts, which serves the two typefaces used in the design. Nothing on the site is stored in your browser for tracking purposes, which is why you are not asked to dismiss a cookie banner.

How long submissions are kept

Contact form submissions are kept for 24 months from the date we receive them, so that we can find the thread if you come back to us a year later. If your enquiry becomes a subscription, the correspondence is kept for the life of the account and then for the period required by French commercial and tax law. If you ask us to delete a submission earlier, we delete it from the Netlify dashboard and from the mailbox within 30 days and confirm in writing when it is done.

International transfers

MLJ, SASU is established in France and the website's processors are established in the United States. Data you send through this form is therefore transferred across the Atlantic. Those transfers rely on the European Commission's standard contractual clauses, and on the EU to US Data Privacy Framework where the processor participates in it. If you are writing from a US clinic, your data stays with US processors in the ordinary course, and only the reply reaches France.

Your rights

If you live in California, Colorado, Connecticut, Utah or Virginia, you have the right to know what personal information we hold about you, to obtain a copy of it, to have it corrected, to have it deleted, and to be free of discrimination for exercising any of those rights. You may also opt out of the sale or sharing of personal information and of targeted advertising: we do neither, so there is nothing to opt out of, but the request will be honored and answered anyway. California residents may designate an authorized agent to make a request on their behalf.

If you are in the European Union or the United Kingdom, the GDPR gives you the right of access, rectification, erasure, restriction of processing, portability of your data in a machine readable file, and objection to processing based on legitimate interest. Where processing rests on consent, you may withdraw that consent at any time, which does not affect processing already carried out.

To exercise any right, write to jimenezjulien42@gmail.com with enough detail for us to find your record, usually the email address you used in the form. We answer within 30 days and we do not charge for a first request. If you are unhappy with our answer, you may complain to your state attorney general, or, in the European Union, to your national supervisory authority, which in France is the CNIL.

Children

This is a business website aimed at clinic owners and their staff. It is not directed at children, and we do not knowingly collect personal information from anyone under 16 years of age. If you believe a minor has sent us something through this form, write to us and we will delete it without keeping a copy.

Security and changes to this policy

The site is served over HTTPS, form submissions travel encrypted, and access to the form dashboard and the reply mailbox is limited to the publication director and protected by two factor authentication. No system is perfect: if a breach affects data you sent us, we will tell you and the competent authority as required by law.

When this policy changes, the date at the top of this page changes with it, and the previous version is available on request. Substantive changes that affect how we use existing submissions will be announced by email to the address that sent them.