Alan - Privacy Policy
A privacy policy is often a big, intimidating block of text that is supposed to reassure you but you don't read.
We have written ours to be as clear and accessible as possible, so that you understand exactly how your personal data is used by Alan.
Enjoy your reading.

Table of contents
In the course of its activity as an health insurer and as a health and management services provider, Alan is required to process your personal data, including sensitive data. We attach the utmost importance to the security and confidentiality of the data of Alan's services’ users, whether on the alan.com website or on the mobile application made available to them.
The purpose of this privacy policy is to help you understand how we treat the personal data you provide us with, in accordance with the GDPR.
This privacy policy may be updated regularly, to enrich it, according to Alan's needs, circumstances or if required by law. We therefore invite you to check for updates on a regular basis, although we will always notify you of any significant changes affecting the way your data is processed.
Version dated February 16th, 2026
Above all, we have set ourselves two key principles which are also included in our contracts:
Furthermore, in accordance with the regulations and particularly the GDPR, we undertake to collect and process only the data that is strictly necessary for their purpose. Similarly, we undertake to ensure that the data collected is kept in a form that allows your identification for a period that does not exceed the time required for the purposes for which the data is collected and processed.
Image caption.
Alan, including all of its affiliates (Alan Insurance, Alan Services, Alan Tech, Alan CA, Marmot BE and Marmot Iberia) is a health insurer and does not mainly act as a data processor for our clients but as a data controller in the sense of article 4 of the GDPR on all operations relating to its insurance and health services described in this policy :
However, Alan can also process personal data on behalf of its client companies, within the scope of certain services provided on the Alan platform, in particular administrative management assistance services for human resources. Alan acts as a "data processor" of the company, and the processing of personal data is done under the responsibility of the company, which then acts as the data controller. The General Conditions governing the relationship between Alan and the client companies include a data processing agreement (DPA) reflecting this distribution. You can take a look at the privacy policies of the client companies directly for more details on how they process your personal data. If your insurance contract is with a third party insurer who gives you access to Alan's applications, Alan may also act as a management agent.
If you have any questions regarding security and personal data, or to exercise your rights of access, correction, deletion, withdrawal of consent, limitation of processing, opposition to processing or portability, you may contact us and our Data Protection Officer (DPO) at [email protected]. Alan will ensure that you receive a response promptly.
For any complaint concerning your personal data, you can either contact our DPO or contact the Commission Nationale Informatique et Liberté (CNIL) directly at https://www.cnil.fr.
Insurance services
Care and support
Health services
Alan features
Statistic and performance
This data is used for the electronic signature of the contract, any communication with the company's representatives, and for access to the account used to manage the contract. In the case of delegated contracts, this data is also received from the contract insurer.
We use your ID to perform consistency check between the ID document and the signatory of the company contract.
From the Alan dashboard
Only if the contract has not been signed. Otherwise we are required to keep the data.
The company contract administrators are led to send us data concerning their employees, including those who have left the company for less than a year ( as part of the portability of health insurance rights):
This is a legal obligation of the employer from which employees cannot escape, even when they do not wish to benefit from health coverage (exemption mechanism).
Certain data is automatically sent to us every month by URSSAF and its partners in the context of the déclaration sociale nominative (DSN), in particular:
We may also collect from France Travail the information on unemployment insurance beneficiary status necessary for the settlement of portability rights.
Alan processes this data on the basis of pre-contractual measures and the execution of the insurance contract between Alan and its members.
This data is used in order to invite (by email) employees to register on alan.com or on our mobile application and choose to be insured or exempted.
Contract administrators can do this directly from their Alan dashboard. In some cases, an intervention of our customer service is necessary (for example for certain retroactive modifications).
No, Alan has to keep it for 5 years after the end of the coverage.
Pre-contractual measures and execution of the contract binding them to Alan, as well as, in the absence of a signature, Alan's legitimate interest in following his prospects.
We also have a legal obligation to ask you for this information in order to comply with the regulations that apply to our insurance activities.
This data is used for the electronic signature of the contract, any communication with the contract holder, and for access to the account allowing to manage the contract. The list of individual members is also shared with the subscribing association to which the individual members automatically adhere by virtue of their contract.
We use your ID to perform consistency check between the ID document and the signatory of the contract.
From the Alan Dashboard.
Only if the contract has not been signed. Otherwise we are obliged to keep the data.
Personal data is transmitted to us directly by or on behalf of the insured members with their explicit consent (e.g. to automate the retrieval of receipts from a third party site), in particular :
Certain data are transmitted to us directly by the Social Security and its partners within the framework of télétransmission, in particular :
We also generate individual policy numbers.
Finally, we may also gather information from your previous insurer about your latest claim relating to glasses purchase.
This data is required for the execution of the contract concluded with Alan (or with your insurer that delegates your contract to Alan), either by your employer or by you as an insured member. They are therefore not subject to prior consent. We also have a legal obligation to ask you for this information in order to comply with the regulations that apply to our insurance activities and to our health and management service providers activities.
In addition, we use it for some of the secondary purposes listed below on the basis of our legitimate interest in managing our insurance activities.
We use this data mainly to process requests for reimbursement of expenses according to the guarantees of the contract (health and/or prévoyance / Disability contract) which covers the insured members and any declared beneficiaries. In particular, this involves receiving and processing the health documents and information provided to justify the care received, determine coverage, generate payments and manage the recovery of undue payments.
Your documents are analyzed within the European Union and, as part of a test, in Tunisia. These transfers are adequately covered by binding corporate rules (BCR) validated by the CNIL and its European counterparts. They are also used for :
Finally, your phone number may also be used to protect your health in situations that pose a risk to your physical safety when using our health services.
No, because we are obliged to keep this data. However, you have the possibility to ask us not to use them for purposes based on our legitimate interest, by sending an email to [email protected].
When the possibility is offered to him/her and an insured member declares a beneficiary (spouse or child) to his/her contract, he/she vouches that the beneficiary agrees to become a party to its insurance contract (or gives consent as a parent of a minor). Alan treats the personal data of the beneficiaries in the same way as those of any other user insured member in this capacity.
Our insured members and their beneficiaries share a single Alan account. By default, both the insured members and the beneficiaries (if they are of legal age and choose to access Alan's online insurance or management services themselves) will be able to view all account information related to the insurance services, without separation. Information about health services (such as private chat as part of Alan Clinic) is not shared. Members with an Alan account can also choose to restrict visibility of their care acts to other members covered under the same policy.
Through the "Privacy and security" section on your member profile.
We use personal data you provide us with in the context of our health insurance and prévoyance services (including your health data) in order to detect and fight insurance fraud.
For certain reimbursement requests, we may ask you for additional supporting documents necessary to verify them (e.g., medical prescriptions, delivery slips, detailed quotes, proof of payment, photos of the medical equipment received showing that it was indeed delivered to you, etc.). Data extracted from these documents and previously hashed may be used to enhance the technological means of fraud prevention that we develop. In this case, we will use them exclusively for the purpose of processing aimed at combating fraud.
We may also process personal data of health professionals (such as their identification details, practice information and billing patterns) to detect fraudulent activities and ensure the legitimacy of reimbursement claims.
We maintain a list containing information about individuals or entities that have been identified as presenting a potential fraud risk based on previous fraudulent activities or suspicious patterns.
Finally, we may also use the following connexion data to identify fraudulent behavior:
On the basis of our legitimate interest in preventing and fighting against fraud.
Your health data is processed for the purposes of fraud prevention on the basis of the performance of the obligations of your insurance contract and the exercise of Alan's rights.
We use this data for the prevention of fraud, in particular to monitor and detect suspicious patterns or activities and to manage alerts and procedures following a case of fraud.
Data related to health and provident insurance services used to develop technological means of combating fraud is kept for the same durations as all of your insurance data.
Data used specifically to train our fraud detection models is kept for 2 years.
Regarding fraud alerts, data related to them is kept:
Information on the fraud risk list is retained up to 5 years from the last fraudulent activity.
Data you provide us in the context of your health insurance serves multiple purposes. If there is a specific reason you would like to oppose Alan processing your personal data for the purpose of fraud fighting, you can send an email to [email protected], we will consider your request.
We process member data in an anonymized form to provide company administrators with dashboards and analytics about their employees' interactions with of our services, including:
On the basis of our legitimate interest in providing anonymous usage metrics of our services to our clients.
All data is anonymized before being included in dashboards. This data is only displayed when there are sufficient employees to prevent individual identification.
This data is used to create usage dashboards and analytics reports for company administrators to help them understand and monitor their employees' engagement with our services.
2 years
Since this data is processed in anonymized form, individual deletion requests are not applicable.
In order to provide assistance abroad and allow you to be covered in case of problems while traveling abroad, we transmit the following information to our partner EuropAssistance:
On the basis of a contract between the insured and us (you ask us to provide a service that we pay for) as well as on the basis of our legitimate interest in measuring the use of this service.
This data is used to authenticate members in order to provide them with travel assistance abroad.
5 years after the end of the contract.
No, Alan must keep it for 5 years after the end of the coverage.
In order to answer questions or resolve problems raised by our members, admins or prospects when they contact Alan we collect the following information:
We may thus collect the following personal data:
We use it on the basis of the performance of the contract entered into with Alan, either by your employer or by you as an insured member, or pre-contractual steps to enter it. We also have a legal obligation to store this information in order to comply with the regulations that apply to our insurance and health and management service providers activities. In addition, we use it on the basis of our legitimate interest in assessing and improving the quality of our customer and support services.
We use your data to analyze and answer your questions, provide guidance, manage complaints and disputes, and improve our services and products. In order to do so we:
In addition, your data will also be anonymized to enable research and statistical learning.
We are obliged to keep the data relating to your insurance contract and demonstrating legal compliance. However, you can request the deletion of data collected for our legitimate interest by emailing [email protected].
When we provide a hotline in the context of our insurance contract, or in the exceptional case a member, administrator or healthcare professional can be called back, we collect the following data (that may be transmitted to us directly by your employer):
We may record the telephone conversation unless you object. However, if you give us instructions entailing changes on your contract or member profile, we are required to record the conversation for probationary purposes. As part of the recording of this exchange, we may collect personal data about you in order to answer your questions or solve a problem you are experiencing.
We may thus process the following personal data:
Depending on the nature of the request, we may process personal data for purposes and legal bases relating to the execution of your request such as:
We record the call only when you do not object to it or when we are required to for probationary purposes. We process this data on the basis of your contract and on our legitimate interests in order to keep track of your instructions as well as for training and quality purposes.
This data is used for the following purposes:
Recordings can be kept for up to six months. Analysis documents can be kept for up to one year.
We retain your instructions for 5 years after your health insurance contract ends and for 10 years after your disability contract ends.
We are obliged to keep the data relating to your insurance contract and demonstrating legal compliance. However, you can request the deletion of data collected for our legitimate interest by emailing [email protected].
Alan offers artificial intelligence generated services to answer your coverage questions and assist you with certain account actions.
When you use the automated coverage assistance service, we collect the following data:
When our AI assistant performs actions on your account with your explicit approval, the following data may be processed:
We process this data based on your prior consent: this service can only be used with your explicit agreement and each action requires your explicit approval before execution.
Additionally, we process this data to fulfill our contractual obligations as your insurer and use it based on our legitimate interest in evaluating and improving the quality of our automated assistance service and contacting you again if an error in the answer provided is detected.
We use your data to authenticate you, analyze and answer your questions regarding your coverage and perform certain actions on your account with your approval. To do so, we:
The transcript and audio recording of the conversation are used for quality control and service improvement purposes. Quality control of the response also allows us to get back to you and provide you with the correct information in case of an error.
You can escalate your request to the User Care Experts at any time, and all actions performed by the AI agent are reversible.
We are obliged to keep the data relating to your insurance contract and demonstrating legal compliance. However, you can request the deletion of data collected for our legitimate interest by emailing [email protected].
Alan offers a screen sharing assistance service to help complete online subscription. When you use this service, we can collect the following data:
Your social security number and IBAN are automatically masked and not visible to our sales team during the screen sharing session.
The screen sharing and control assistance is only activated based on your prior consent. We also have a legal obligation store this information in order to comply with the regulations that apply to our insurance activities. In addition, we use it based on our legitimate interest in assessing and improving the quality of our support services.
We use your data to help you navigate and complete your subscription journey. Our sales team can view your screen and guide you through the process and take control of your screen to help you navigate (critical actions like selecting offers and signing contracts remain blocked and can only be performed by you).
Session recordings are used for evidentiary purposes to verify who performed which actions during the subscription process. Call recordings are used for training and quality improvement purposes.
We are obliged to keep the data relating to your insurance contract and demonstrating legal compliance. However, you can request the deletion of data collected for our legitimate interest by emailing [email protected].
In the context of a consultation with a doctor or psychologist, we collect information such as:
In addition, for doctor consultations we also collect your social security number and phone number as well as the information whether a prescription was issued (but not its content). Also, for sessions with our psychologists we also collect information regarding your time zone, the name of the consulted expert, your country location and your language preferences. We never collect your communication with the Practitioner. We have implemented safeguards, such as end-to-end encryption to fully secure your communication and ensure your privacy is respected.
For orientation calls, if the member accepts, orientation psychologist will share the reason for consultation and situation with the psychologist booked. This information is deleted once shared.
Note that the Alan attributed e-mail address of the Practitioner is solely for communicating on administrative matters with you and/or your employer. This emailing address shall not contain any health related information. We collect the full name, photo, specialty details of the health expert as well as access to their Google calendar, in order to facilitate communication with the Member.
On the basis of the contract we have with you (you ask us to provide a service, which we pay for) as well as on the basis of our legitimate interest in measuring the use of these services or for as long as the health expert is employed with Alan.
This data is used to enable the processing of reimbursements related to doctor consultations as well as improving the service. It is also used to schedule and enable sessions with our psychologists, as well as improving the service.
2 years for doctor consultations. For as long as you benefit from Alan services and meet legal retention requirements for health professionals for mental health sessions.
Absolutely, on the part based on legitimate interest. You just have to send a request to [email protected].
In some situations, we may use personal information you knowingly provide to recommend features, products, and services that might be of interest to you, identify your preferences, and personalize your experience. In short, we may take information you provide to tailor the services further to your needs. To give some examples, answers you provide in the daily check-in impact the recommended exercises you will receive and answers you provide in the prevention assessment give place to personalisation of content, health check-up reminders, specific programs etc.”
We collect such data only on the basis of either contract performance, our legitimate interest and/or your explicit consent.
We keep your data for as long as you benefit from Alan services, to meet legal retention requirements for health professionals medical responsibility and/or until you withdraw your consent.
Bear in mind that if you do not want to receive personalized recommendations you simply have to skip answering such questionnaires.
Absolutely, on the part based on legitimate interest. You just have to send a request to [email protected].
When you exchange messages with Alan health team members for a question relating to your health (excluding video consultation), we use the following data:
To deliver more personalized and contextualized care to members, health team members will also have access to:
Health team members will not have your full name or access to your history as an insured member without your consent.
Your consent is collected before the access to the service from the Alan mobile app.
Alan respects medical secrecy: the content of your exchanges within the Alan Clinic is accessible only to members of the Alan medical team, they many not be consulted or used by anyone else at Alan. The Alan medical team is composed of the health professionals and employees of Alan strictly necessary for the proper running of the Clinic, in accordance with the recommendations of the French Medical Council (Conseil de l'Ordre des Médecins) and other applicable codes of ethics. Alan medical team’s access is specific, dedicated and segregated from the usual access of Alan's employees to our tools.
Medical conversations and documents are encrypted under the sole control of health professionals, who are the only ones with access to the content of encrypted information. This enables us to guarantee that medical confidentiality is respected where applicable, and that Alan will never re-use this information for its health insurance services. In addition, when you have had an inspiring health experience with the Alan Clinic, we may contact you to create a fully anonymized educational health story for the benefit of as many people as possible. These health stories will only be created with your prior and specific consent, and in a non-identifying manner.
During the duration of the limitation period for medical responsibility of health professionals.
You can request the erasure of messages from your interface, simply send a request to [email protected]. This will erase the messages for your messaging space. However, we will keep a secure archive of them on our side, in accordance with the recommendations of the French Medical Council (Conseil de l'Ordre des Médecins).
Your consent is required before interacting with Mo. In any case, interacting with Mo is optional and on a voluntary basis.
The content of your messages is analyzed:
Your health profile allows Mo to provide you with increasingly personalized and relevant responses, without you having to repeat information you have already shared.
Each of Mo's responses is automatically analyzed by a specialized AI agent, trained to detect conversations requiring review by a healthcare professional. When a conversation is flagged, it is forwarded to an Alan Clinic physician for medical review. Physicians can correct incorrect responses from Mo and contact the member if their physical integrity is at risk. A random sample of non-flagged conversations is also reviewed daily to ensure the quality and safety of the service.
A limited number of Alan team members may also access pseudonymized conversations, strictly for the purpose of improving the Mo service, updating medical recommendations, and fixing technical issues.
Access by the technical team to pseudonymized conversations is granted on demand, without dedicated storage, with a specific logged purpose (e.g. "to debug the conversation"). Ad hoc exports are deleted after 30 days.
For these purposes only, your data is hosted within the European Union on HDS-certified infrastructures provided by our AI model suppliers, Azure and Google Cloud Platform. These suppliers are prohibited from using member conversations to train their own models or from sharing this data with third parties.
Alan does not train, retrain, or modify the weights or parameters of these suppliers' foundational artificial intelligence models using member conversations or data.
You can request the deletion of your messages directly from your interface (long press on a message, then "Delete") within the app, or by sending a request to [email protected].
This will erase the messages from your space. However, we will keep a secure archive of them, in accordance with the recommendations of the French Medical Council.
Alan provides you with prevention recommendations only upon your explicit consent.
Alan allows you to benefit from preventive reminders concerning your health (such as an annual reminder to make a dental appointment). When you consent, Alan uses information about your health care to issue its prevention recommendations.
As long as our member benefit from this service, or until they withdraw their consent.
Yes, you just have to send a request to [email protected] or choose to delete your history when withdrawing your consent from your member profile.
Alan allows you to evaluate your health and well-being with a survey composed by our team of health professionals. Based on your answers, we compose a health and wellbeing score, provide you with customised advice, and put you in contact with the most relevant health professionals to accompany you.
Alan provides you with a personalised health and wellbeing plan only upon your explicit consent. To withdraw it, request it at [email protected].
This data is used to provide a personalized experience for each user by calculating a wellness score, displaying personalized messages and proposing a contact with a health professional whose specialty depends on the result of the survey.
As long as the service is useful to our members or until they withdraw their consent. We update them regularly.
Yes, you just have to send a request to [email protected].
Alan processes the data of health professionals to provide its members with the ability to find a doctor's contact details, estimate their health expenses and the reimbursement to which they will be entitled, and book an appointment. Alan also allows its members to build up an address book of their doctors to make it easier to find them.
When you use the Alan Map feature, we collect your GPS location (provided by your smartphone's operating system) to recommend nearby healthcare professionals and services.
Alan processes doctors' contact data on the basis of its legitimate interests in facilitating access to the health care system and predictability of its members' expenses.
GPS location data is collected based on your consent.
The identification and contact data, the rates charged per act, and the level of conventionnement of health professionals are obtained from the health directory provided by Ameli.fr.
Contact details and online appointment booking are enriched directly through a classic search engine (Bing).
Your location data is used to center the Map search around your position, calculate the distance between you and healthcare professionals, and suggest the closest available options.
Yes, by sending a request to [email protected].
Alan offers a service which allow you to easily order glasses and contact lenses.
Alan processes the following data:
Our provider FittingBox offers a virtual try on solution, so you can try your future glasses on you directly online. Your image is not retained by FittingBox and only temporarily used to position the virtual glasses. More information here.
When purchasing glasses and contact lenses, we share your name, address, and phone number with our partners to process your order. For glasses, we also share your prescription with our optician partner Le Petit Lunetier.
We only collect your vision correction data with your consent. Then, the data is processed to enable you to obtain the contractual service you have requested, and in accordance with our legal obligations as an insurer in this respect.
In addition, we use it for some of the secondary purposes listed in this policy, based on our legitimate interest in running our insurance business.
This data is used for :
For the same length of time as your other insurance data, i.e., 5 years after the end of your health insurance contract, except for the shipping details which are retained for 3 months since the last order.
Absolutely, simply send a request to [email protected].
The in-app eyesight survey collects information from the member about their eyesight and conditions related to eyesight.
The survey collects members information concerning their eyecare medical history and condition. Such data is securily stored on HDS certified servers as for other health data.
Completion of the questionnaire is subject to your prior consent.
The purpose of this survey is to provide tailored proactive care notifications (PCN) around eye care (i.e. reminders to see the ophtalmologist) and to identify members for future eyesight services.
We keep the data collected until proactive care notifications are scheduled or consent is withdrawn.
Yes, simply send a request to [email protected].
Alan offer insured members an in-app visual acuity test. The visual acuity test is an optional feature offered to Members who want to check their eye sight and whether their visual correction is up to date. During the course of a visual acuity test, Alan collect the following data:
The visual acuity test is purely optional and its completion is offered on a voluntary basis. Alan also process this data to pursue its legitimate interests for auditing purposes in order to assess the performance and quality of the test and to improve it.
It is in Alan's legitimate interest to process the aforementioned data. Alan uses the data in order to evaluate if the visual acuity test is performing within acceptable levels of accuracy and ultimately to ensure the test is providing a safe and effective outcomes for its members. Alan processes such data only when you consented in taking the test. Alan also uses the data to identity future quality improvements to the test.
Alan uses the visual acuity test data so you can check if your visual acuity evolved and whether your current visual corrections is up to date.
In addition, Alan uses the audio data to audit the performance of the voice recognition software as well as to assess and improve its design and implementation.
1 year.
Yes, simply send a request to [email protected].
The Alan Play feature uses your data to allow participation in healthy games and activities like daily step counts, challenges and leaderboards with your friends and colleagues, meditation and mindful breathing exercises as well as health events. Based on your participation data, you earn berries that can be exchanged on the Alan app for charitable donations, discount vouchers for the Alan shop, avatars and streak freeze. We may therefore collect the following data:
More information on the how Alan Plays works can be found in the Rules of Play.
Your consent is requested:
You data is required to allow you to participate in these healthy games and activities as displayed in the Rules of Play.
Alan also processes this data to pursue its legitimate interests to monitor the performance of this feature and conduct statistical study and research.
This allows us to:
We may also draw statistics from anonymized and aggregated usage data (including on past step data), and share these non-identifying usage statistics with employers to measure Alan Play’s success in improving their employee well-being.
Your step data is retained for 6 months from the termination of the service usage (withdrawal of your consent or termination of your participation) to allow reactivated users to benefit from the experience. Aggregated and anonymized usage data may be retained longer for statistical study and research purposes.
Yes, you just have to send a request to [email protected].
Your consent is requested when you first use this feature.
Your messages are used to provide personalized automatic conversations and tailored advices. For this exclusive purpose, we receive and analyze the information you enter in the journal on the HDS certified infrastructure of Azure. Your exchanges with the virtual assistant are not retained by Alan and are only stored locally on your device.
We may also draw statistics from anonymized and aggregated usage data.
Aggregated usage data is stored for two years.
For usage data, you just have to send a request to [email protected]. Conversations can be removed directly in the app, Alan does not store them.
When you purchase a product on the Alan online shop, we process the following data:
We send our suppliers your name and surname, postal address and phone number in order to process your order.
We also collect and display ratings and feedback that we receive.
This data is required for the execution of the sale contract concluded with Alan.
Ratings and feedback are processed on the basis of our legitimate interest to improve and provide information on our products and services.
We use this data to pre-fill your order form with your information, process your order, ship the purchase and process the payment.
We display the average rating of each product and the text feedback when available.
Yes for your ratings and feedback, you just have to send a request to [email protected]. We are required to keep the other data.
Workshops are interactive training sessions on a specific mental health topic, involving one of our psychologists and administrators and/or managers. Alan collects information gathered during a pre-workshop briefing held between the psychologist and administrator. Alan later sends invites to administrators and/or managers. After the workshop, Alan sends feedback forms as well as related follow-up content to the participants.
Participants may consent to participating in the workshop or be obliged to participate in the context of mandatory workshops organized by their employer.
This allows us to tailor the workshops as much as possible to the company’s needs and to send feedback forms to the participants.
For as long as you benefit from Alan services.
Yes, you just have to send a request to [email protected].
It is in Alan's legitimate interest to improve its services based on member satisfaction.
We use the NPS to monitor our performance with our members, through the Metabase tool. In concrete terms, this allows us to identify factors of dissatisfaction that may allow us to improve our services or, conversely, things that need to be reinforced because they are highly appreciated.
We keep them for the time needed to carry out analyses and measure their evolution over several development cycles. We then anonymise or delete them.
Yes, simply send a request to [email protected].
On the basis of Alan’s legitimate interest to assess and improve our products based on product usage analysis and feedback.
We track and analyze user interactions with our products to understand user usage and identify improvements.
We conduct user research calls and interviews to gather in-depth insights about user needs and experiences. We collect and assess user and member feedback to manage opinions or recommendations for improvement of the products, services or contents shared on our app and website.
We keep them for two years. We then anonymize or delete them.
Yes, simply send a request to [email protected].
Certain data is collected automatically when you visit alan.com (including other websites published by Alan such as blog.alan.com and map.alan.com) and when you use our mobile app. The data collected includes :
Where applicable, the collection is subject to the explicit consent of the user (cookie banner on our website and mobile). This consent is valid for 13 months from the date of registration.
Otherwise, it is in our legitimate interest to analyse the use of our site and mobile app in order to improve it or strictly required to provide our services.
This data is used for the following purposes:
Absolutely (with the exception of data collected in the framework of a legal obligation or strictly required to provide our services), simply make a request to [email protected].
To build our audience and client basis, Alan may reach out to prospects by emails and organize online advertising campaigns before sending them mails or emails. In this context, Alan handles email addresses available online (such as on Linkedin) but also from providers already used by Alan (Societeinfo.com, Kaspr) for audience-building purposes on social networks.
On the basis of Alan legitimate interests to fulfill our marketing and growth needs, in compliance with direct marketing regulatory requirements.
We are reaching prospects via online ads before sending mails or emails. To do so, we import prospects database into the audience of different platforms. The email addresses is the only data import on the ads platform. We import only prospect data and we do not bring in any customer data or leads who have unsubscribed from any previous campaign. To do so, we ensure and remove our customers data in our ads audience before any data import. In addition, users can opt-out and unsubscribe from seeing Alan’s ads directly on the ads platform.
When reaching out by email, Alan provides easy-way to opt-out notably through unsubscription links in each communication and honor prospects opt-out in the future.
We keep this data for 2 years, in line with CNIL’s recommendation.
A purge of the database to remove any inaccurate is carried out on a monthly basis.
Une purge de la base de données pour supprimer les données inexactes est effectuée chaque mois.
Yes, you can opt-out from marketing communications at any time. You can exercise any of your rights simply in making a request to [email protected].
Data collected by Alan in the performance of our services, may be further used in a way compatible with the original purpose for which it was collected. Only aggregated and/or anonymized data may become subject to scientific research and/or for statistical studies, including for statistical learning. It could for instance be used in the selection and creation of relevant health stories to improve our services and Members' health, create aggregated usage reports or to streamline and improve the management of exchanges with Alan medical team.
On the basis of our legitimate interest.
Contact the referred prospect for an intro on our products.
We keep this data for 3 years from the last contact with the prospect, in line with CNIL’s recommendation. A purge of the database to remove any inaccurate data is carried out on a monthly basis.
Yes, simply send a request to [email protected].
We record the call only when you do not object to it. We process this data on the basis of our legitimate interests for training and quality purposes.
This data is used for the following purposes:
Records are kept for up to six months.
Yes, just send a request to [email protected].
Data security is an extremely important issue for Alan: we do our utmost to be worthy of the trust you place in us. Here are a few examples of the measures we have taken. If you have any questions on a specific point, we will be happy to answer them at [email protected].
Alan achieved ISO27001:2022 certification with SGS (certification body), validating our information security management system and our data protection measures. This certification covers all of Alan’s activities.
We use Datadog App Security to detect and block in real time attacks such as XSS, SQL injection, account theft, etc.
We also use Cloudflare to protect us from Distributed Denial of Service (DDoS) attacks.
All HTTP traffic to and from alan.com and api.alan.com is encrypted (HTTPS / TLS). You can evaluate our configuration here.
The first time a user logs on, we tell their browser (via the HSTS mechanism) that all subsequent connections must be encrypted (HTTPS), including when a link to alan.com starts with http:// instead of https://.
When using the Alan Clinic services, your questions to our medical team, answers and attached documents are secured by an additional layer of application encryption entirely and exclusively under the control of our medical team. No one other than the Alan medical team is technically able to consult these exchanges.
We use PostgreSQL databases. The data is encrypted using the AES-256 standard and the encryption keys are managed by AWS.
The backup archives are also encrypted.
We use the open-source zxcvbn-ts library to let users know the strength of the password they choose. The minimum size is 16 characters, including alphanumeric characters and symbols and the minimum score is 4.
We do not store these passwords: we only store a non-reversible hash calculated by the open-source bcrypt library, with the following parameters :
All Alan employees receive mandatory training in security (including social engineering) and data privacy. They use complex and unique passwords and strong authentication (2FA) whenever possible. The use of a password manager such as 1Password is also mandatory.
Our computers are automatically updated and have their hard disk encrypted (in case of theft). Our screens lock automatically.
Access to our internal administration tools requires individual access from an authorised IP address and all data modifications (by an Alan employee or by a user himself) are audited.
We organise intrusion tests by independent companies.
All Alan services and applications are developed in-house. Our code is validated by automated tools (static analysis, security, etc.) and manually by a second pair of eyes.
In order to protect your data on your computer or mobile phone, you can take a few simple measures:
You can also consult the official recommendations on good IT security practices.
The data collected may be communicated as required to Alan's partners, reinsurers, subcontractors, legal and financial advisors, and service providers. These data transfers are carried out solely within the framework of the operations mentioned above and to the extent necessary for the performance of the tasks we entrust to third parties. These third parties are fully informed by Alan of the confidentiality of the data communicated to them in this context, and these partners have an obligation to ensure the protection of this data. They are also bound by their own confidentiality and privacy policies, which can be consulted on their websites. When the nature of the operation carried out allows it, the data is subject to prior anonymisation before being communicated to third parties.
We maintain at all times a list of the main people and tools that receive data as part of our processing through this link.
Furthermore, in order to meet legal and regulatory obligations, we may be required to communicate personal information to administrative or judicial authorities at their request. In this case, we ensure that only the data strictly required by the authorities is transmitted.
In order to fulfill all the purposes for which we collect your data, we may transfer some of your data to third parties, who host it in data centers located outside the European Union.
In this case, we make sure that hosting is subject to European data protection standards (for example, by including standard contractual clauses in our contracts with such third parties). We have provided a summary of potential data transfers through this link.
As part of insurance referral partnerships, we may share with our partners the following information for each health insurance product purchased by the prospects they refer to us:
For information on how our partners process your data, please refer directly to their privacy policy:
In addition to being a delicious biscuit, a cookie is a file on your device that contains data we may collect when you visit our website or mobile app. We obtain your consent before using cookies where it is required. You can delete or limit the storage of these files at any time in the settings of your internet browser (see below).
Third-party cookies used only on our public website based on user choice:
Third-party cookies used on our public website and dashboard (member and administrator) based on user choice:
Third-party cookies when viewing or interacting with third-party content embedded on our public site, based on the user’s choice:
Third-party cookies used on our mobile app based on user choice:

You can find more information about the data Alan collects through these third-party cookies via this link 😉
Of course you can! During your first visit on our website (or if you use your browser's private or incognito browsing) or mobile app, a banner (called a cookie banner) will be displayed asking you for permission to use optional cookies. Simply refuse and no cookies (other than those we need to operate the site and allow you to use our online chat) will be set. If you accept, your consent will be valid for 13 months from the date of registration.
Simply put, no.
You will receive emails from us, but in the vast majority of cases it will be in the context of the execution of our contract, for example to invite you to register, to ask you for additional information to enable a refund or to inform you of contractual modifications or changes related to your account. There is no escaping this, but it is for your own good.
A small minority of emails are not directly related to our contract with you or your employer, but are still for a legitimate interest (e.g. to offer to sponsor a relative with a financial reward, to send you a quote, or to announce new services similar to those you currently enjoy).
If you are an administrator, you may also receive commercial offers from us. In these cases, you always have the possibility of unsubscribing from this type of message by following the link in each of our emails (opt-out).
You can also choose to subscribe to our newsletter or to our waiting lists to be notified of the availability of our new services (opt-in).
As for push notifications, we will ask for your permission directly in the mobile application and you will be able to deactivate or reactivate them from your phone.
Table of contents
Get started with Alan now


Preview