Privacy policy

Preamble

Singular Lab SAS (hereinafter "Singular", "we", "our" or "us") places fundamental importance on protecting your personal data and your privacy.

The purpose of this privacy policy is to inform you clearly, completely and transparently about how we collect, use, store and protect your personal data when you use our nutritional personalization platform.

Regulatory qualification: Singular is a nutritional personalization service for wellness purposes. It is not a medical device within the meaning of Regulation (EU) 2017/745 and does not in any way constitute a medical diagnostic tool, a substitute for medical consultation, or a medication prescription service. The products offered are dietary supplements within the meaning of Directive 2002/46/EC.

1. Definitions

To facilitate understanding of this policy, the following terms are defined:

"Personal data": any information relating to an identified or identifiable natural person (Art. 4 GDPR).
"Health data": personal data related to the physical or mental health of a natural person, including the provision of health care services, which reveal information about the state of health of that person (Art. 4.15 GDPR).
"Processing": any operation performed on personal data (collection, recording, organization, storage, modification, retrieval, consultation, use, etc.).
"Data controller": the natural or legal person who determines the purposes and means of processing personal data.
"Processor": the natural or legal person who processes personal data on behalf of the data controller.
"HDS": Health Data Host (Hébergeur de Données de Santé), a French certification granted to a provider for a defined scope of health data hosting activities and services (Art. L1111-8 French Public Health Code). It applies to the certified scope of the provider concerned; Singular does not itself hold this certification.
"EEA": European Economic Area (European Union + Iceland, Liechtenstein, Norway).
"GDPR": General Data Protection Regulation, Regulation (EU) 2016/679.

2. Data Controller

The data controller for your personal data is:

Company name: Singular Lab SAS;
Legal form: Simplified Joint-Stock Company (Société par Actions Simplifiée);
Trade Register: Paris 999 248 701;
EU VAT number: FR12 999 248 701;
Registered office: 60 rue François 1er, 75008 Paris, France;
Legal representative: Richard Füg, President.

2.1. Data Protection Officer (DPO)

In accordance with Article 37 of the GDPR, and given the large-scale processing of health data, we have appointed a Data Protection Officer whom you can contact for any questions regarding your personal data:

Email: dpo@singularlab.com;
Postal address: Singular Lab SAS - DPO, 60 rue François 1er, 75008 Paris, France.

3. Personal Data Collected

As part of our service, we collect different categories of personal data. We apply the principle of data minimization (Art. 5.1.c GDPR): we only collect data that is strictly necessary for the purposes described below.

3.1. Identification and Contact Data

Email address (required for account creation);
First name (required for personalization);
Last name (optional);
Delivery address (required for orders);
Billing address (required for orders);
If you book a pre-subscription call: first name, last name, email address, selected time slot, and booking status.

3.2. Health Data (special category - Art. 9 GDPR)

Important: This data is subject to enhanced protection and its processing requires your explicit consent.

Biological biomarkers: Numerical values extracted from your blood tests (vitamins, minerals, hormones, etc.), units of measurement;
Nutritional profile questionnaire: Sex at birth, year of birth, current pregnancy or breastfeeding, declared health situations, declared food allergies, declared current treatments;
Personalized interpretations: Categorization data and Singular reference ranges for your nutritional profile;
Nutritional formulations: Personalized composition of your dietary supplement formula (ingredients, dosages).

3.3. Transaction Data

Order and subscription history;
Payment status;
Transaction identifiers (complete banking data is processed directly by our PCI-DSS certified payment provider and is never stored on our servers).

3.4. Technical and Navigation Data

IP address (anonymized for statistics);
Browser type and operating system;
Pages visited and connection timestamps;
Technical cookies necessary for service operation.

3.5. Data We Do Not Retain Long Term or Collect

For minimization and privacy protection purposes:

Original documents: PDF or image files of your blood tests are retained only during processing and any automatic retries, which are limited in number and duration, then purged. They are not retained long term in your record.
Social security number;
Complete date of birth: We only ask for your birth year or age range;
Complete banking data: Processed exclusively by our certified payment provider;
Pre-subscription call booking: no free-text field, medical reason, health data, recording, transcript, or named call report is collected.

4. Legal Bases for Processing

In accordance with the GDPR, all processing of personal data must be based on a legal basis. Here are the legal bases applicable to our processing:

4.1. Explicit Consent (Art. 9.2.a GDPR)

For the processing of your health data, we collect your explicit, freely given, specific, informed and unambiguous consent. This consent is required for:

Analysis of your blood tests and biomarker extraction;
Generation of personalized interpretations of your nutritional profile;
Creation of dietary supplement formulations tailored to your profile.

You can withdraw your consent at any time by contacting our Data Protection Officer (see the "How to exercise your rights" section). Withdrawal of consent does not affect the lawfulness of processing based on consent before its withdrawal.

4.2. Performance of Contract (Art. 6.1.b GDPR)

Some processing is necessary for the performance of our contract with you:

Creation and management of your user account;
Processing of your orders and subscriptions;
Delivery of your personalized products;
Sending transactional emails (order confirmations, delivery tracking, authentication magic links);
Customer service;
Arranging a pre-subscription call at your request.

4.3. Legal Obligation (Art. 6.1.c GDPR)

We are required to retain certain data to comply with our legal obligations:

Retention of invoices and accounting data (10 years - Art. L123-22 French Commercial Code);
Retention of connection logs (1 year - LCEN).

4.4. Legitimate Interest (Art. 6.1.f GDPR)

In limited cases, we process data based on our legitimate interest:

Security of our information system (fraud prevention, intrusion detection, and access logging in accordance with our security policy);
Continuous improvement of our services (anonymized statistics).

5. Processing Purposes

Your personal data is processed for the following purposes:

5.1. Analysis of Your Blood Tests

Legal basis: Explicit consent
Description: Automated extraction of biomarker values from your blood tests to establish your nutritional profile. Original files are retained during processing and bounded automatic retries, then purged.
Retention period: Biomarkers retained for the duration of your account + 3 years.

5.2. Generation of Personalized Interpretations

Legal basis: Explicit consent
Description: Categorization of your biomarkers and association with Singular reference ranges (based on scientific literature) to visualize your nutritional profile. This data does not constitute a medical diagnosis.
Retention period: Duration of your account + 3 years.

5.3. Formulation of Nutritional Recommendations

Legal basis: Explicit consent
Description: Generation of a personalized dietary supplement formula tailored to your biological profile and questionnaire responses.
Retention period: Duration of your account + 3 years.

5.4. Management of Your User Account

Legal basis: Performance of contract
Description: Creation, secure authentication (magic links) and management of your personal space.
Retention period: Duration of the business relationship + 3 years.

5.5. Payment and Subscription Management

Legal basis: Performance of contract / Legal obligation
Description: Processing of your payments via our PCI-DSS certified provider, management of recurring subscriptions, invoice issuance.
Retention period: 10 years for billing data (legal obligation).

5.6. Transactional Emails

Legal basis: Performance of contract
Description: Sending service-related communications (authentication, order confirmations, delivery tracking, important notifications).
Data concerned: Email and first name only. No health data is ever included in emails.

5.7. Security and Audit

Legal basis: Processing security obligations (Art. 32 GDPR) / Legitimate interest (Art. 6.1.f GDPR)
Description: Traceability of health data access, anomaly detection, security incident prevention.
Retention period: 1 year for audit logs.

5.8. Booking a Pre-Subscription Call

Legal basis: Steps taken at your request before entering into a contract (Art. 6.1.b GDPR)
Description: If you choose to book a call, Google Workspace Calendar processes only your first name, last name, email address, selected time slot, and booking status to arrange that call. The form has no free-text field, and the call is neither recorded nor transcribed.
Excluded data: No health data, blood test, biomarker value, questionnaire, formula, or medical reason should be communicated through this channel.
Retention period: 12 months maximum on Singular's side, with quarterly deletion.

6. Recipients and Processors

Your personal data may be transmitted to the following categories of recipients, in strict compliance with the GDPR and under appropriate contractual conditions (Art. 28 GDPR).

6.1. Processors for Health Data (HDS scope)

Infrastructure providers: Secure storage of your health data, databases, and application servers using services and activities within HDS-certified scopes, configured in European regions within the EEA;
Artificial intelligence and document recognition provider: Reading of your blood tests (PDF file or image) and structured extraction of biomarker values (vitamins, minerals, hormones, etc.) using services within an HDS-certified scope and configured in a European region within the EEA; your data is not used to train this provider's models, and the original document is retained only during processing and bounded automatic retries.

6.2. Processors Outside Health Data Scope

PCI-DSS certified payment provider: Secure processing of bank transactions. This provider never receives health data.
Transactional email provider: Sending notifications and authentication emails. Only email and first name are transmitted, never health data.
Logistics provider: Label printing and product shipping. Receives only the delivery address and operational information necessary for preparation and shipping, without your biomarkers or their interpretations.
Google Workspace Calendar, if you book a pre-subscription call: First name, last name, email, time slot, and booking status only, without health data or free-text fields.

6.3. Contractual Framework and Controls

Our relationships with processors are governed, according to the processing and risks concerned, by:

Processing contracts compliant with Article 28 of the GDPR;
Data Processing Agreements (DPA) detailing their obligations;
Security measures reviewed during selection and ongoing monitoring, as well as certifications applicable to their services and exact scope (HDS, ISO 27001, SOC 2, or PCI-DSS, as applicable).

6.4. No Sale of Data

We never sell your personal data to third parties. Your data is never transmitted for advertising or marketing purposes by third parties.

7. Data Transfers Outside the European Economic Area

7.1. Principle: Your Health Data Stays in Europe

Processing involving storage of your health data (biomarkers, health questionnaire, interpretations, formulations) and extraction of your blood tests is configured in European regions within the European Economic Area. This technical location does not necessarily mean that the legal entity of every processor is headquartered in the European Union.

7.2. Exception: Technical Providers

Certain auxiliary technical providers (particularly for transactional emails or the optional arrangement of a call through Google Workspace Calendar) may process data outside the EEA, notably in the United States.

Safeguards in place:

Standard Contractual Clauses (SCCs) approved by the European Commission (Implementing Decision 2021/914);
Transfer impact assessment in accordance with EDPB recommendations;
Additional technical measures (encryption, minimization).

Data concerned: Auxiliary information strictly necessary to provide the service, such as email address, first name, last name, booking time slot, or certain technical data. The health data processing described in Section 7.1 remains configured within the EEA.

8. Health Data Hosting (HDS)

In accordance with Article L1111-8 of the French Public Health Code, hosting personal health data collected during care activities or medical-social monitoring requires specific certification.

An overview of our digital and food-safety controls is available on the Security, quality & traceability page.

8.1. Certified Host

Your health data is hosted using services and activities within HDS-certified scopes of our providers, configured in European regions within the EEA. Singular is not itself HDS-certified. For each provider concerned, certification attests that the certified scope complied with the HDS reference framework at the time of the audit; it does not constitute a guarantee of absolute security. This framework includes in particular:

Formal definition of the activities and services included in the certified scope;
Their assessment against HDS reference framework requirements by an accredited certification body;
Periodic surveillance of this scope;
Security and traceability requirements applicable to the certified activities.

8.2. Technical Security Measures

Encryption at rest: All health data is encrypted with AES-256 algorithm;
Encryption in transit: All communications use TLS 1.2 protocol or higher;
Antivirus analysis: All uploaded files are systematically analyzed before processing;
Processing within the EEA: Blood test reading and value extraction are carried out in a European region within the EEA using services within an HDS-certified scope; your blood tests are not used to train the provider's models;
Purge after processing: Original blood test files are retained only during processing and any automatic retries, which are limited in number and duration, then purged.

8.3. Organizational Security Measures

Restricted access: Only strictly authorized personnel can access health data;
Enhanced authentication: Multi-factor authentication (MFA) mandatory for administrative access;
Granular access control: Role-based system (RBAC) limiting access to what is strictly necessary;
Audit trail: Logging of all health data access;
Training: Regular staff awareness training on data protection.

9. Retention Periods

We retain your personal data only for the duration necessary for the purposes for which it was collected, in compliance with applicable legal obligations.

Data Type	Retention Period	Legal Basis
Original files (blood test PDFs)	During processing and bounded automatic retries, then purged	Minimization (Art. 5.1.c GDPR)
Biomarkers, interpretations, formulations	Duration of account + 3 years	Art. L1111-7 French Public Health Code
Account data (email, name, addresses)	Duration of relationship + 3 years	Civil statute of limitations
Pre-subscription call booking (first name, last name, email, time slot, status)	12 months maximum, with quarterly deletion	Pre-contractual steps (Art. 6.1.b GDPR)
Billing data	10 years	Art. L123-22 French Commercial Code
Audit logs (health data access)	1 year	Processing security (Art. 32 GDPR) and security policy
Connection logs	1 year	LCEN
Authentication links (magic links)	20 minutes	Security
User sessions	30 days	Performance of contract

At the expiration of these periods, your data is deleted or irreversibly anonymized.

10. Your Rights

In accordance with the GDPR (Articles 15 to 22), you have the following rights over your personal data:

10.1. Right of Access (Art. 15)

You can obtain confirmation that data concerning you is (or is not) being processed, and access this data as well as information about the processing.

10.2. Right to Rectification (Art. 16)

You can request correction of inaccurate data or completion of incomplete data.

10.3. Right to Erasure - "Right to be Forgotten" (Art. 17)

You can request deletion of your personal data in cases provided by the GDPR (withdrawal of consent, data no longer necessary, etc.). This right may be limited by our legal retention obligations.

10.4. Right to Restriction of Processing (Art. 18)

You can request restriction of processing of your data in certain circumstances (contesting accuracy, unlawful processing, etc.).

10.5. Right to Data Portability (Art. 20)

You can receive your data in a structured, commonly used and machine-readable format (JSON), and transmit it to another data controller.

10.6. Right to Object (Art. 21)

You can object at any time to processing of your data based on legitimate interest, for reasons relating to your particular situation.

10.7. Right to Withdraw Consent

When processing is based on your consent, you can withdraw it at any time by sending us your request (see the "How to exercise your rights" section). This withdrawal does not affect the lawfulness of processing carried out before the withdrawal.

10.8. Right to Define Post-Mortem Directives

You can define directives relating to the retention, erasure and communication of your data after your death.

10.9. How to Exercise Your Rights?

You can exercise your rights in several ways:

By email: dpo@singularlab.com;
By mail: Singular Lab SAS - DPO, 60 rue François 1er, 75008 Paris, France.

We will respond to your request within a maximum of 30 days from receipt. This period may be extended by two months in case of complex requests, in which case we will inform you.

For security reasons, we may ask you to prove your identity before processing your request.

11. Right to Lodge a Complaint

If you believe that the processing of your personal data constitutes a violation of the GDPR, you have the right to lodge a complaint with the competent supervisory authority.

In France, the competent authority is the Commission Nationale de l'Informatique et des Libertés (CNIL):

Website: www.cnil.fr/plaintes;
Address: CNIL, 3 Place de Fontenoy, TSA 80715, 75334 Paris Cedex 07, France;
Phone: +33 1 53 73 22 22.

We encourage you, however, to contact us first in order to find an amicable solution to any difficulty.

12. Cookies and Trackers

12.1. Strictly Necessary Cookies

These cookies are essential for the operation of the website and cannot be disabled. They are generally only set in response to actions you take that amount to a request for services.

Session cookie: Maintaining your secure connection;
CSRF cookie: Protection against cross-site request forgery attacks;
Preferences: Browsing language.

12.2. Audience Measurement

We measure traffic on our sites with Umami, a tool self-hosted by Singular on its own infrastructure, in Europe. This measurement is exempt from prior consent under the guidelines of the French data protection authority (CNIL), because:

No cookie or tracker is placed in your browser;
The data collected is minimized and anonymous: pages viewed as controlled keys, language, visit source category, performance metrics;
No data is transmitted to third parties or matched with your account or any other processing;
Statistics are kept for thirteen months, then deleted automatically.

This is why our sites display no consent banner. You can nevertheless object to this measurement at any time. The "Disable audience measurement" button on the Cookie Policy page stores a setting in your browser; counting then stops for this browser. This setting can be reversed at any time and disappears if you clear your browsing data.

12.3. Advertising Cookies

We do not use any advertising or commercial tracking cookies.

13. Important Warnings

13.1. Nature of the Service

Singular is a nutritional personalization service for wellness purposes. It is not a medical device within the meaning of Regulation (EU) 2017/745 and does not in any way constitute:

A medical diagnostic tool;
A substitute for medical consultation;
A medication prescription service.

13.2. Dietary Supplements

The products offered are dietary supplements within the meaning of Directive 2002/46/EC, i.e., foodstuffs intended to supplement a normal diet. They are not medicines and are not intended to diagnose, treat, cure or prevent any disease.

13.3. Medical Recommendation

In case of symptoms, known pathology, ongoing medical treatment, pregnancy or breastfeeding, we recommend consulting your doctor or a healthcare professional before starting any supplementation.

13.4. Personalized Interpretations

The interpretation information presented by our service (biomarker categorization, Singular Score) is provided for informational purposes and aims to contextualize your nutritional profile. It does not replace personalized medical advice and does not constitute a medical diagnosis.

14. Changes to This Policy

We may modify this privacy policy to reflect changes in our practices or applicable regulations. In case of substantial modification:

We will notify you by email and/or by a notification in your personal space;
The "last updated" date will be updated at the top of this page;
For modifications affecting the processing of your health data, we will request new consent if necessary.

We invite you to regularly consult this page to be aware of any changes.

15. Contact

For any questions regarding this privacy policy or your personal data:

DPO Email: dpo@singularlab.com;
General Email: contact@singularlab.com;
Postal Address: Singular Lab SAS, 60 rue François 1er, 75008 Paris, France.

16. Reference Texts

GDPR: Regulation (EU) 2016/679 of April 27, 2016;
French Data Protection Act: Law No. 78-17 of January 6, 1978 as amended;
French Public Health Code: Articles L1111-7 and L1111-8 (health data, HDS);
LCEN: Law No. 2004-575 of June 21, 2004 (connection data retention);
French Commercial Code: Article L123-22 (retention of accounting documents);
Directive 2002/46/EC: On dietary supplements;
Regulation (EC) 1924/2006: Nutrition and health claims.

Last updated: July 28, 2026 - Version 1.3