Privacy Policy

The application Bolus Famille (displayed under the iPhone icon as "Gabriete") is published by:

Marmites, SAS with share capital of €5,000
3 Esplanade Augustin Aussedat, 74000 Annecy, France
Annecy Trade & Companies Register 852 698 034 · SIRET 852 698 034 00034
Email: contact@marmites.app

Data controller: Marmites.
Data Protection Officer (DPO): Cédric Laurent, reachable at dpo@marmites.app.

We collect only the data strictly necessary for the application to work.

2.1 Identification data

• Email address — account creation and access (contractual basis, kept while account active + 12 months)
• Firebase identifier (UID) — technical account identification

2.2 Application data

• Child's first name (free text)
• Meals, meal photos, carb amounts
• Bolus entries (value, timestamp)
• Care events (infusion set, sensor, hypoglycemia)
• Favourite foods

Legal basis: consent. Duration: until deleted by the user.

2.3 Technical data

• Anonymized error logs — legitimate interest, 30 days.
• Push notification token — consent, while notifications are enabled.

2.4 What we DO NOT collect

• No advertising, no ad SDK
• No third-party tracker (Facebook Pixel, Google Analytics, etc.)
• No biometric data
• No geolocation
• No access to your contacts, calendar, or photos (beyond what you attach to meals)
• No data resale

3.1 Local storage

The app works offline. Data is stored locally on your iPhone via native mechanisms (IndexedDB / WKWebView cache).

3.2 Cloud storage (sync)

To enable sync between devices in the same family, your data is stored on Google Firebase servers, in the europe-west region (Belgium).

Processor: Google Ireland Limited. A GDPR-compliant Data Processing Addendum is in place.

Transfers outside the EU: framed by the Standard Contractual Clauses approved by the European Commission (decision 2021/914).

The marmites.app website uses no tracking cookies. Only strictly necessary cookies (e.g. language preference) may be set, which do not require consent.

The iOS app uses no cookies.

Under the GDPR, you have the following rights at any time:

• Right of access
• Right to rectification
• Right to erasure ("right to be forgotten")
• Right to restriction
• Right to portability (JSON export)
• Right to object
• Right to withdraw consent

How to exercise your rights

• Delete your account: directly in the app → Settings → Delete my account.
• Export: email dpo@marmites.app, reply within 30 days.
• Other requests: dpo@marmites.app.

Complaints

If you believe your rights are not respected, you may file a complaint with the French CNIL (our supervisory authority) or with the data protection authority in your country.

Commission nationale de l'informatique et des libertés
3 place de Fontenoy — TSA 80715 — 75334 PARIS CEDEX 07, France
cnil.fr/en/plaintes

• Encryption in transit (TLS 1.3, HTTPS-only, HSTS preload on .app)
• Encryption at rest (Firebase Firestore + Auth)
• Strong authentication (password, future 2FA support)
• Firestore rules: each user only accesses their own data
• Server access limited to authorized personnel

In case of a data breach likely to cause risk to your rights, we commit to inform you without undue delay, per GDPR art. 33.

The app is intended for family use, where a parent manages the food tracking of a child. The account is created and managed by an adult.

No minor data can be entered without a parent account having previously consented to this policy.

Any material change will be notified by email to active account holders and on next app launch. The date at the top of this page indicates the current version.

Bolus Famille is not a medical device. The application is a food tracking and logbook tool. It provides no insulin dosage recommendation, diagnoses no condition, and never replaces your care team's advice.

Always consult your diabetologist or any qualified health professional for treatment decisions.

• General questions: contact@marmites.app
• Privacy / DPO: dpo@marmites.app
• Technical support: support@marmites.app