Last updated : Aug. 29, 2026

Privacy policy

This policy explains how Carl processes personal data in connection with its website, application, and related services.

Data controller

The data controller is Yohan Attal EI, a French sole trader (micro-entrepreneur) operating the Carl service, registered under SIREN 933 786 535 (SIRET 933 786 535 00015), whose business address is 24 rue Léon Frot, 75011 Paris, France.

For general questions: contact@hicarl.com. To exercise your rights or contact the data protection contact, use the contact form.

Data collected

Carl may process the following categories of data:

• practitioner account and identification data: last name, first name, email, avatar, authentication information, and preferences;

• professional information: profession, practices, specialties, chosen terminology, session types, duration, price, practice location, contact details, professional identifiers, and information useful for billing;

• calendar and follow-up information: sessions, dates, statuses, payments, notes, session preparations, transcripts, summaries, and observations;

• data relating to contacts followed by the user: first name, last name, gender, age, current city, city of origin, profession, phone number, email, presentation, preparation notes, avatar, and session history;

• technical data: connection logs, technical identifiers, security data, information about the device, browser, and use of the service;

• audience measurement and product improvement data, including through PostHog when configured.

Audio recordings are used to enable transcription and the processing requested by the user. They are not retained permanently by Carl after this processing.

Purposes

Data is processed to provide the service, create and secure accounts, enable management of contacts, sessions, notes, the calendar, session types and billing, generate AI-assisted transcripts or summaries, provide support, prevent abuse, measure product usage, and improve the user experience.

Legal bases

Depending on the processing, Carl relies on performance of the contract, legitimate interest in securing and improving the service, compliance with legal obligations, and consent when required.

Health data and user responsibility

Carl is intended for professionals. The user determines the information they enter in the application and remains responsible for the lawfulness of that entry, informing the persons concerned, and complying with their own professional obligations.

Carl is not a medical device and does not replace the practitioner's clinical or professional judgment.

Artificial intelligence

Some features use artificial intelligence providers, including OpenAI and Anthropic, to transcribe, structure, or summarize content submitted by the user. These providers act as processors with contractual data protection commitments.

Service providers

Carl relies in particular on Supabase for the database, authentication, and storage, Vercel for hosting certain interfaces, Render for backend hosting, Resend for sending emails, OpenAI and Anthropic for certain AI features, Google for sign-in and calendar synchronisation, LiveKit for video calls, Stripe for payments, Cloudflare Turnstile for abuse prevention, and PostHog for product usage measurement.

Meta may also receive data relating to visits to the website when the Meta Pixel is enabled, and Google may receive technical data when embedded YouTube content is loaded. These optional services are described in more detail in the section on cookies and other trackers.

Carl's main infrastructure is hosted in the European Union. Some service providers may nevertheless process data from countries outside the European Economic Area. Where necessary, Carl safeguards these transfers using the mechanisms provided by applicable law, including standard contractual clauses or an adequacy decision.

Access to Google data

When the user connects their Google account, Carl accesses their Google Calendar through the Google Calendar permissions calendar.readonly and calendar.events, solely to synchronize their personal calendar with the appointments and sessions displayed or managed in the application. Carl reads existing events and creates, modifies, or deletes only events displayed or managed in the application. This data is not used for advertising, sold, or transferred to third parties except for processors strictly necessary to provide the service.

Carl's use of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements.

Cookies and audience measurement

The term “trackers” includes cookies and other mechanisms that read or write information on the user's device, including the local storage of the browser or application.

• Necessary trackers: Carl uses trackers required for authentication, security, session continuity, and interface preferences, including through Supabase. The language cookie, local drafts, and display preferences also fall within this category. Cloudflare Turnstile may protect certain forms, and Stripe may secure a payment flow expressly requested by the user.

• Product usage measurement: when PostHog is enabled, it helps Carl understand product usage, identify navigation difficulties, and improve the service. It may process a technical identifier, device information, and events relating to use of the application.

• Advertising measurement: when the Meta Pixel is enabled on the website, Meta Platforms Ireland Limited may receive information such as pages visited, the referring website, and technical identifiers, including the _fbp cookie, to measure the effectiveness of Carl's campaigns.

• External content: when an embedded YouTube video is loaded, Google may read or set trackers and receive technical information about the viewing of that content.

Product usage measurement, advertising measurement, and external-content trackers are not required for Carl to operate. They rely on consent when they involve reading or writing information on the user's device. Refusing them must not prevent access to the website or application. Consent may be withdrawn at any time as easily as it was given.

Choices are stored for no longer than six months in a preference cookie shared between the highcarl.com website and the app.highcarl.com web app. The cookie icon displayed on these services can be used to reopen the settings, change the authorised purposes, or withdraw consent at any time.

Retention

Data is retained for the duration of account use, then deleted or archived according to applicable technical, contractual, accounting, legal, or security constraints. Billing data may be retained for legally required periods.

Data subject rights

In accordance with the GDPR, data subjects may request access, rectification, erasure, restriction, or objection to the processing of their data, as well as portability when applicable.

Requests may be sent through the contact form. The user may also delete their account from the application when this option is available.

Security

Carl implements technical and organizational measures designed to protect data against unauthorized access, loss, alteration, or unintended disclosure. Because no online service can guarantee absolute security, the user must also protect their credentials and limit the information entered to what is necessary.

Complaint

If you encounter a difficulty, you can contact Carl through the contact form. You also have the right to lodge a complaint with the competent supervisory authority, including the CNIL in France.

Changes to this policy

Carl may modify this policy to reflect changes to the service, its processors, or the applicable legal framework. The update date indicates the applicable version.