Privacy policy

1. Data controller (English translation for information only; the French version prevails.)

This website is published by the company ELAN, a French private limited company (SARL) with share capital of €30,000, registered under SIREN 931 514 905, whose registered office is at 7 rue Saint-Pierre, 91220 Brétigny-sur-Orge.

The controller of the personal data collected on this website is Sarah Dehan, company manager (gérante).

Contact: contact@elan-neurotherapie.fr — +33 6 46 20 84 82.

The company has not appointed a data protection officer (DPO), as this is not mandatory given the nature and size of its business. Any request concerning your data is handled directly by Sarah Dehan.

2. Data collected on this website

Contact form

When you fill in the contact form, we collect your name, email address, telephone number and the content of your message.

  • Purpose: to respond to your request for information or for an appointment.
  • Legal basis: taking steps at your request prior to entering into a contract (Article 6(1)(b) GDPR).
  • Mandatory: this information is needed for us to reply. Without it, we cannot follow up on your request.

Messages received are stored in the website’s administration area and forwarded to our professional email account.

Self-regulation questionnaire (sending your results)

The online questionnaire is scored in your browser: your answers are not sent to us unless you choose to send them. If you click “Send my results to the centre”, we receive the first name, surname and age of the person concerned, your email address, your telephone number, your results, any comment you add and any reports you attach.

  • Purpose: to prepare a conversation about the situation of the person concerned. A copy of your results is sent to you by email.
  • Legal basis: your explicit consent, given by ticking the box on the form (Articles 6(1)(a) and 9(2)(a) GDPR), as this information may relate to health.
  • Optional: sending your results is entirely up to you. You can use the questionnaire without sending anything, and withdraw your consent at any time by writing to us.

The information you send is stored in the website’s administration area, which is access-protected, and forwarded to our professional email account. It is never transferred to third parties or used for any other purpose.

Newsletter

If you sign up to our newsletter, we collect your email address and, where applicable, your first name.

  • Purpose: to send you our news, content and resources on neurotherapy.
  • Legal basis: your consent (Article 6(1)(a) GDPR).
  • You can withdraw your consent at any time using the unsubscribe link included in every email, or by writing to us.

Browsing and technical logs

Our hosting provider automatically records connection logs (IP address, date and time, pages viewed, browser type) for the security and proper functioning of the website.

  • Legal basis: our legitimate interest in ensuring the security and availability of the website (Article 6(1)(f) GDPR).

3. What this website does not collect

Apart from the self-regulation questionnaire described above, which you send only if you choose to and with your explicit consent, this website does not collect health data. Please do not send detailed medical information — diagnoses, reports, assessment results — through the contact form, which is not a suitable channel for this kind of exchange.

Information gathered as part of support at the centre (in-depth initial interview, questionnaires, qEEG recordings, reports) is processed outside this website, on dedicated systems, and is covered by a specific privacy notice given to you at the first appointment.

4. Retention periods

  • Contact form messages: 3 years from the last contact.
  • Results sent via the questionnaire, and attachments: 3 years from the last contact if no support programme is started; if a programme is started, they are added to the client file and follow its retention period.
  • Newsletter subscriptions: until you unsubscribe, then for a maximum of 3 years.
  • Proof of cookie consent: 6 months.
  • Connection logs: 12 months maximum.

5. Who has access to your data

Only Sarah Dehan has access to the messages and data collected on this website. Your data is never sold, rented or transferred to third parties for commercial purposes.

The following service providers act as data processors for technical purposes:

  • o2switch — website hosting, with servers located in France;
  • our email hosting and email delivery provider, for receiving requests and sending the newsletter;
  • YouTube (Google) — playback of videos embedded in some pages. These videos are only loaded after you consent; without your consent, no data is sent to Google.

Some of these providers may transfer data outside the European Union. Such transfers are governed by the safeguards provided for in the GDPR, in particular the European Commission’s standard contractual clauses.

6. Cookies and trackers

The website sets technical cookies that it needs in order to work and, only with your agreement, cookies linked to embedded content. You can accept, refuse or change your choices at any time, and it is just as easy to withdraw your consent as to give it.

Details of the cookies used are given in our cookie policy.

7. Your rights

Under the General Data Protection Regulation (GDPR) and the French Data Protection Act (loi Informatique et Libertés), you have the right to access, rectify and erase your data, to restrict and object to its processing, and to data portability, as well as the right to withdraw your consent at any time and to set instructions regarding what happens to your data after your death.

To exercise these rights, write to contact@elan-neurotherapie.fr, or by post to ELAN, 7 rue Saint-Pierre, 91220 Brétigny-sur-Orge, France. We will reply within one month. We may ask for a copy of an identity document if there is reasonable doubt about your identity.

If, after contacting us, you consider that your rights have not been respected, you can lodge a complaint with the CNIL (French data protection authority): 3 place de Fontenoy, TSA 80715, 75334 Paris Cedex 07 — www.cnil.fr.

8. Security

The website is served over HTTPS, which encrypts exchanges between your browser and our servers. Access to the website’s administration is restricted to authorised persons and password-protected, and the website’s components are kept up to date.

9. Changes to this policy

This policy may be amended to reflect changes to the website, our tools or the regulations. The date of the last update is shown below.

Last updated: 5 September 2026.