1. Who is the data controller?
The data controller within the meaning of Regulation (EU) 2016/679 (GDPR) is:
- Association Française du Syndrome de Rett (AFSR)
- Registered office: to be completed by AFSR
- Email: contact@afsr.fr
2. What data do we process?
RettApp only processes the data strictly necessary for the informal medical tracking of a child living with Rett syndrome, voluntarily entered by the parent or caregiver.
2.1 Data entered in the application
| Category | Detail | Storage location |
|---|---|---|
| Child profile | First name, last name (optional), date of birth, epilepsy flag. | Local (SwiftData) |
| Epileptic seizures | Date, time, duration, type, trigger, notes. | Local + iCloud (if sharing) |
| Medication | Treatment name, dose, schedule, actual intakes, reasons for on-demand intakes. | Local + iCloud (if sharing) |
| Mood, meals, sleep | Qualitative ratings, sleep / nap durations, hydration. | Local + iCloud (if sharing) |
| Observed Rett symptoms | Type, intensity, duration, date. | Local + iCloud (if sharing) |
| Apple identifier | Sign in with Apple opaque token used for session authentication. | iOS Keychain |
2.2 Data read from Apple Health (HealthKit)
When the application is configured in child mode (an explicit local setting), RettApp may read from Apple Health the types the user explicitly enables:
- Hydration (water intake),
- Meals (dietary energy consumed, number of meals),
- Night sleep and naps (Apple Health sessions),
- Heart rate (average and resting),
- Activity (steps, active energy burned).
No Apple Health data is read by default. Data read by RettApp is aggregated for on-screen display and inclusion in the doctor's PDF report, and remains stored within Apple Health on the user's device.
In parent mode, RettApp does not access Apple Health.
2.3 Technical data
RettApp collects no advertising identifier, no location data, and no anonymized usage analytics. No third-party analytics tool (Google Analytics, Firebase Analytics, etc.) is integrated.
2.4 Face data (TrueDepth, ARKit, Vision)
RettApp does not use the TrueDepth API (depth camera, face recognition, ARFaceTracking). The application does not request Face ID permission, does not read any blendshape, does not process any facial geometry, does not capture any 3D face mesh, and performs no face recognition.
The camera permission (NSCameraUsageDescription) is requested only for the paper follow-up booklet scanning feature (the booklet is filled in by the child's school or care center). A photo is taken, processed locally by VNRecognizeTextRequest (Apple Vision OCR) to extract the page text, then shown to the user for verification. The photo and its OCR text:
- Stay only on the user's iPhone,
- Are never transmitted to an AFSR server or any third party,
- Are discarded when the import sheet is dismissed, except for the structured fields (meal, hydration, sleep) the user confirms — those are saved to the local SwiftData database (the photo itself is not).
The previous "eye-gaze game" module that used ARFaceTrackingConfiguration has been removed from RettApp and released as a separate app (RettGame) with its own App Store identifier, its own Info.plist and its own privacy policy. RettApp and RettGame share neither code nor data.
3. Why do we process this data?
| Purpose | Legal basis (GDPR) |
|---|---|
| Informal medical tracking by parents and caregivers | Consent (article 6.1.a) and vital interest of the data subject (article 9.2.c) |
| Generating PDF reports for the doctor | User consent |
| Parent sharing through iCloud | Explicit consent (dedicated toggle) |
| Authentication (Sign in with Apple) | Performance of a pre-contractual measure at the user's request |
| Donation to the AFSR via Apple Pay | Consent and legitimate interest (fundraising by a public-interest non-profit) |
4. With whom do we share this data?
No server operated by the AFSR receives your data. The only third parties that may have access to technical data related to your use of RettApp are:
- Apple Inc. (One Apple Park Way, Cupertino, CA 95014, USA) — for iCloud (CloudKit) hosting, Apple Pay and App Store distribution. Apple acts as a processor or controller depending on the service. See Apple's privacy policy.
- The other parent(s) to whom you have explicitly granted access through the AirDrop sharing feature. Sharing can be revoked at any time from the application's settings.
- The doctor who receives the PDF report you have decided to send them yourself, outside the application.
5. How long do we keep your data?
Data is kept for as long as you keep the application installed. At any time, you can:
- Erase all data from Settings → Data → Erase all data.
- Uninstall RettApp: iOS will then delete the local database and revoke iCloud access.
- Disable parent sharing: the shared iCloud zone is then deleted.
The donation history kept locally is purged together with other data. The AFSR retains no record on any server.
6. Security
Data is protected by the native iOS and iCloud mechanisms:
- At-rest encryption on the iPhone (iOS Data Protection).
- In-transit encryption (TLS) between the iPhone and iCloud.
- At-rest encryption on Apple iCloud.
- Apple ID + 2FA authentication managed by Apple.
- Parent sharing happens only through AirDrop (in-person, both iPhones must be physically present) to prevent any interception of the invitation link.
- Apple Pay donations rely on PSD2 compliance (3-D Secure / Strong Customer Authentication); no banking information transits through RettApp.
7. Your rights
Under the GDPR, you have the following rights over your personal data:
- Access and portability: export your data from Settings → Data → Export to CSV.
- Rectification and erasure: edit or delete each entry directly from the journal and the dedicated sub-pages.
- Restriction and objection: disable the relevant features (Apple Health, parent sharing, notifications) in iOS Settings or RettApp Settings.
- Withdraw consent: at any time, with no retroactive effect on processing already performed.
- Right to lodge a complaint with the French data-protection authority CNIL (www.cnil.fr) or with your local supervisory authority.
To exercise these rights on data held by the AFSR (for example, your Sign in with Apple identifier if you have contacted us), write to contact@afsr.fr. For data stored on your device or on your iCloud, you keep full control without intermediary.
8. Minors
RettApp is designed for use by adult parents and caregivers tracking a child living with Rett syndrome. The application is not intended for direct use by minors without supervision by a parent or legal guardian. No advertising or profiling targeting minors is performed.
9. Cookies and trackers
The RettApp application uses no cookie and no tracker. This website does not place any tracking cookie; only strictly necessary technical cookies may be used to display the pages.
10. Transfers outside the European Union
Data stored on iCloud may transit through Apple servers located in the United States, under the Data Privacy Framework regime (European Commission's adequacy decision of 10 July 2023). Apple commits to applying Standard Contractual Clauses (SCCs) for any transfer outside the EU not covered by this decision.
11. Changes
This policy may be updated to reflect changes in the application or applicable regulations. Any substantive change will be flagged within the application and the "last updated" date above will be amended.
12. Contact
For any question regarding your data or this policy, please write to contact@afsr.fr.
See also: Legal notice.