Privacy
This site has one public page, a sign-in window, and private materials behind
them. Here is everything it does with your information.
Who is responsible
Staila Health is being formed as a company in Delaware. Until it exists, its founder,
Pierre Lorthiois, is responsible for your information (the “controller”, in the GDPR's
words). Write to info@stailahealth.com about
anything on this page.
When you ask for access
- We receive the email address you type. If it is on our list, we email you a sign-in link.
If it is not, we keep the address and the dates you asked, so we can answer you and decide
on access. When we give an address access, we email it once to say so.
- Every request is logged with its time, the address, what we did with it, and the
connection details listed under “What we record”, so we can stop abuse and know who
asked.
- We do not sell or share your address, and we do not add it to any mailing list.
Checking you are a person
The sign-in window uses Cloudflare Turnstile. It runs invisibly in your browser and sends
Cloudflare information about your browser and connection, so it can tell people from
automated traffic. Cloudflare's handling of that information is described in its
Turnstile Privacy Addendum
and its privacy policy.
When you sign in
We set one cookie, which keeps you signed in. The site needs it to work. It ends after seven
days, after three days without use, or when you log out, whichever comes first. We store a
fingerprint of it, never the cookie itself, together with your address and when you last
used it.
The confidentiality agreement
Before you see the materials, you sign a confidentiality agreement; without it they stay
closed. We keep the name and organisation you type, your address, the exact text you signed
and its fingerprint, the time, your IP address and its approximate place, and your browser,
and we email you a copy.
What we record
What is behind the sign-in is private, so we keep a record of who sees it.
- On this page: each time it is opened, and each request for access.
- Once you are signed in: your address, with each page and document you
open, each file you download, each time you sign in or out, and your signature.
- With each of these: the time, your IP address, the approximate place
and network it belongs to (country, region, city, postcode, time zone and provider, as
Cloudflare reports them), and the name and version of your browser.
We do not record your clicks, your scrolling, what you type anywhere else, or what is on
your screen. The record is ours alone: no analytics service, no advertising and no
third-party cookies, and no cookie beyond the one that keeps you signed in. The site's fonts
are served from the site itself.
Why, and on what basis
- To answer your request and let you in: because you asked (GDPR
article 6(1)(b): steps you ask for before an agreement).
- To check you are a person, and to stop abuse: our legitimate interest in
keeping the site secure (article 6(1)(f)).
- To record access to the materials: our legitimate interest in protecting
confidential information and in knowing who received it, and the confidentiality agreement
itself (articles 6(1)(f) and 6(1)(b)).
- To keep your signed agreement: to make the agreement and, if it comes to
that, to establish or defend a legal claim (articles 6(1)(b) and 6(1)(f)).
We do not use your information for advertising, sell it, or make automated decisions about
you.
How long we keep it
- If you signed in: your activity record and your signed agreement, until
six years after your last visit: the three years for which the agreement protects what you
saw, and three more to settle any claim.
- Everything else: visits to this page, requests for access and the log
of them, three years.
- Sign-in links are deleted a day after they expire, and
sessions when they end.
Who handles it for us
- Cloudflare hosts the site and its database, which is kept in North
America, and runs Turnstile. Like any host, it keeps short-lived technical logs of
requests.
- Postmark sends the sign-in and confirmation emails, and your copy of the
agreement. Open and click tracking are turned off.
- Proton hosts our mailbox, which receives a note of each request and each
signature.
Cloudflare and Postmark are in the United States. Where the GDPR applies, sending your
information there relies on the EU–US Data Privacy Framework or on the European Commission's
standard contractual clauses. Proton is in Switzerland, which the European Commission
recognises as protecting personal data adequately.
Your rights
You can ask to see the information we hold about you, to correct or delete it, to restrict
or object to how we use it, and to receive it in a common format. Write to
info@stailahealth.com; we answer within a month.
We may keep what we need to show what you signed, or to establish or defend a legal claim.
If you are in the European Union, the United Kingdom or Switzerland, you can also complain to
your data protection authority.
Staila Health · last updated 1 October 2026