Data controller
Jean-Luc Gyger operates the Menolia website and application under the name Kinioo and determines the purposes and means of the processing described in this policy.
Postal address: 2000 Neuchâtel - Switzerland
Email address: contact@menolia.ch
Data processed
Depending on the features you use, Menolia processes the following information:
- Account: email address, supplied name, verification status and sign-in information. Optional Google sign-in uses your verified email address and a Google identifier linked to your account. It is available on the website; availability in the mobile application is not confirmed. A Google photo is not needed for this link.
- Profile and preferences: name, stated stage of your journey, followed topics, language, reminders, favourite articles and notification read status. You may add a profile photo; on mobile you choose the camera or gallery with the corresponding permissions. Support: the name, email, subject and message you send; avoid health information unnecessary for your request.
- Personal tracking: symptoms, intensities, dates, recorded sleep and mood, bleeding, pain, clots, bleeding after intercourse, treatments, doses, schedules and doses taken, consultations, practitioner, questions and notes. This is sensitive health data; it is sent to Menolia to record and display your tracking, so it does not remain solely on your device.
- Technical and security information: sessions, sign-in and error logs, IP address and browser or application information needed for communication and service protection. The IP address also helps suggest a country and currency for offers; this is not GPS positioning and does not determine tax residence.
- Notifications: reminder preferences and time zone; on the Web, browser permission, technical delivery address and encryption keys; for the native journey, a delivery token, installation and session-binding identifiers, platform and environment. These identifiers enable associations and are not anonymous. Notification history and read status are linked to the account.
- Subscriptions on the Menolia website: billing country, customer and transaction identifiers, subscription status, amounts and invoices. The payment flow uses Stripe; card details are entered in the provider’s payment flow. Invoices are issued under the name Kinioo, which operates Menolia.
Your email address and its verification are required for email sign-in. Tracking information and a photo are optional; without certain information, the associated features cannot be provided.
Charts, histories and home-screen elements are produced from your entries and preferences. They are neither a diagnosis nor medical advice.
On mobile, sign-in cookies and reminder and notification-registration records use the secure storage provided by the application; language is saved in device preferences. The application receives tracking data through the API to display it and prepare reminders. Sign-out includes cookie removal and reminder cancellation, without guaranteeing erasure of every local record, system copy or shared file.
Purposes and legal bases
- Manage and secure your account, verify your identity and enable sign-in.
- Store your observations, show changes, personalise your home page and send reminders you have enabled.
- Manage trials, subscriptions, payments, invoices and operations needed to close an account.
- Answer support requests, fix errors and prevent abuse.
For ordinary personal data, the envisaged grounds, depending on the processing, are performance of a contract, legal obligations and the legitimate interest in securing and maintaining the service, within applicable law. Their final legal classification still needs validation.
Health data requires a separate assessment. Where the GDPR applies, a condition under Article 9 must be established in addition to the Article 6 basis, for example valid explicit consent. The arrangements for obtaining, recording and withdrawing it must be confirmed; simply entering an observation is not presented here as explicit consent.
Recipients and processors
Access is limited to people and providers who need it for their tasks. The integrations identified in the service, when enabled, are:
Google: optional Google sign-in, exchanging authorised identity information. This option is not required to use email sign-in. When Google Play purchases are enabled, this flow verifies purchases with Google using a pseudonymous account identifier. Menolia sends neither health observations nor an email address in this flow.
Stripe: customer creation, payments, subscriptions and billing, receiving the information necessary for these operations. Health observations do not appear in the payment flows examined.
Infomaniak: the SMTP mail service configured for sign-in, welcome and support emails. Web Push reminders use the browser’s notification service, which may be provided by Google, Mozilla, Apple or Microsoft. A treatment reminder may carry the medicine name, dose and time; a consultation reminder uses generic text. Web Push content is encrypted in transit but may be displayed on the device.
Local mobile reminders are scheduled on the phone from profile, treatment, dose and consultation data. System notifications use generic text and a technical reference; the open application may display the name and dose. The server also supports native notifications: their generic envelope contains event, installation and session identifiers, not the medicine name. This technical link can then retrieve information within the account. Availability of this journey in a distributed mobile version remains to be confirmed.
The Firebase Messaging (FCM) mobile journey established so far is limited to a test environment. It initialises Firebase with messaging auto-initialisation disabled; the application makes token reading and association conditional on a session, system permission and enabled reminders. Refusing permission does not prove that no SDK initialisation or technical communication with Google’s Firebase Installations occurs. The Firebase installation identifier, FCM token and Menolia installation identifier are distinct. Provider countries and retention still need confirmation.
Google Fonts: loading the site’s fonts requires a connection to Google servers, which receive the technical information necessary for that request, including the IP address.
Infomaniak hosts the Menolia application; the database is stored in Switzerland. Photos use private server storage; encrypted daily backups are directed to Infomaniak’s Swiss Backup service. Each service’s contracting entities, other processing and access countries and contracts still need confirmation. These facts do not guarantee that all processing remains in Switzerland.
International transfers
External sign-in, payment, font, email or notification services may involve processing outside Switzerland. The countries actually involved depend on the providers and configuration used.
The list of countries, any adequacy decisions and applicable contractual safeguards must be confirmed for each flow. This version does not guarantee that all data remains in Switzerland or the EEA.
Retention periods
Account and tracking data are kept to provide your personal space while the account is active. Removing a symptom from tracking keeps its history; removing an intensity does not necessarily erase its note. Deleting a treatment or consultation may be refused because of a reminder’s delivery state. Technical response copies may retain earlier health content after an observation is deleted; their retention periods remain to be defined.
Account deletion removes associated tracking data, photo, sessions and application notification registrations. It requires fresh access proof and may be suspended during a payment operation or an ongoing delivery. The Stripe journey may request your agreement to cancel the subscription and end remaining access. It does not delete the customer at Stripe. Some invoices, metadata and operation evidence remain locally or at Stripe; their periods and justification still need clarification, without treating health data as accounting records. Google Play subscriptions are managed at Google: account deletion may require prior cancellation and your agreement to end remaining access. It neither cancels nor refunds the purchase. Pseudonymous binding evidence is retained to prevent transfer after closure; its retention period remains to be clarified.
Some sign-in and delivery records have targeted purge rules, not one universal deadline. Google journey records, messages and logs may remain after account closure. Effective support, log and other technical-copy retention periods still need confirmation; size-based log rotation is not a retention period.
Disabling reminders initiates local cancellation and deactivation of the association at Menolia, not immediate erasure of every technical row. A permission withdrawn on the phone is detected when the application checks it; sign-out makes the session ineligible for delivery. This does not erase data held by Google: this journey does not establish deletion of the FCM token or Firebase installation. Retention of local records, native logs and provider data still needs clarification.
Deleting active data does not immediately erase backups. A daily backup does not define its retention period: that period and reapplication of deletions after recovery remain to be documented. Account deletion alone cannot erase downloaded copies, data in another browser or files shared with another application.
Security and confidentiality
Access to tracking data is tied to the signed-in account. The flows include identity checks, access controls and request limits. Account deletion requires fresh proof of access.
Server sessions are configured with Secure, HttpOnly and SameSite=Lax cookies. Public communications use HTTPS and Web Push content is encrypted in transit. These measures do not mean all stored data is encrypted or all operator access is excluded; access permissions and incident procedures still need confirmation.
No system can guarantee absolute security. Protect your device and sign-in methods; notifications may be visible on a locked screen depending on your device settings. Contact us if you suspect unauthorised access.
Your rights
Depending on applicable law and your situation, you may request access, correction, erasure or delivery of your data, object to certain processing, request its restriction and withdraw consent for the future. You may also contact the competent authority, including the FDPIC in Switzerland or the competent authority in the EEA.
In your profile you can change your information, download an export and initiate account deletion. Reminders can be disabled in preferences and browser or phone notification settings. Notification permission and your statistics choice are not consent to health-data processing.
The export downloads your personal data; a consultation PDF is produced on request, without being sent automatically to a doctor. The available export does not include all logs and technical identifiers: contact us for a broader access request. Android mobile sharing uses a private temporary file with access limited to 15 minutes; this does not limit retention of shared copies or copies saved by recipient applications. You choose recipients and should protect these files.
For another request or if you encounter difficulties, email contact@menolia.ch. Proportionate identity verification may be necessary. Withdrawing consent does not affect the lawfulness of earlier processing.
Changes to this policy
This policy may change when service features, providers or applicable obligations change. The revision date is updated when the text is actually revised.
Important changes must be brought to your attention through an appropriate means. The notification channel and, where necessary, obtaining fresh consent still need to be defined; no automatic notification is guaranteed here.