Last updated: July 2026

This policy describes how EM/SFC processes your personal data on em-sfc.org and on the messaging service app.em-sfc.org.

It does not constitute legal advice.

1. Who we are

The website https://em-sfc.org is dedicated to information and support around myalgic encephalomyelitis / chronic fatigue syndrome (ME/CFS).

2. Scope of this policy

This privacy policy applies to:

  • the website em-sfc.org (information pages, member accounts, comments, testimonials, etc.);
  • the community messaging service at https://app.em-sfc.org, reserved for registered members.

3. What data we collect

Depending on how you use the site, we may process the following data.

When you create an account

  • username, first name, last name, email address;
  • password (stored in encrypted form);
  • date and content of your consent to the processing described below.

When you browse em-sfc.org

  • technical data: IP address, browser type, pages visited;
  • cookies required for operation and, where applicable, audience measurement cookies.

When you contribute content

  • comments, testimonials, and media you publish;
  • profile information you choose to make visible (display name, photo, biography, etc.).

When you use the messaging service (app.em-sfc.org)

  • account identifier and name displayed in the chat room;
  • content of messages you send;
  • language selected for reading messages;
  • community / chat room joined (members or scientific & medical);
  • date and time messages are sent;
  • technical data related to the connection (logging, security).

Important: in your messages, you may voluntarily mention information about your health, medical history, experience of the illness, or that of someone close to you. This information is considered sensitive data, in particular health data within the meaning of the GDPR.

4. Why we use your data

We use your data only to:

  • create and manage your member account;
  • allow you to sign in to the website and messaging service;
  • ensure operation, security, and maintenance of the services;
  • moderate content and prevent abuse;
  • enable exchange between members in the messaging service;
  • automatically translate messages into each participant’s chosen language;
  • respond to your requests (contact, exercise of your rights);
  • measure site traffic, where applicable;
  • comply with legal obligations.

We do not sell your personal data.

5. Legal bases for processing

Processing Legal basis
Account management, sign-in, website operation Performance of a contract / pre-contractual measures
Security, technical logging, moderation Legitimate interest
Messaging and health data you voluntarily share there Explicit consent (Article 9(2)(a) GDPR)
Audience statistics (if enabled) Consent or legitimate interest depending on the tool
Handling requests to exercise your rights Legal obligation

Access to the messaging service requires your explicit consent, obtained at registration through a dedicated checkbox, separate from other acceptances.

6. Community messaging and health data

6.1. Principle

EM/SFC messaging allows registered members to exchange messages in separate spaces:

  • Members community (people affected, carers, loved ones);
  • Scientific & medical community (researchers, clinicians, healthcare professionals).

Messages posted in a chat room are visible to other participants in that room. They are not public on the internet, but they are not private in the sense of a confidential medical consultation.

6.2. Health data and sensitive information

On your own initiative, you may mention in your messages:

  • your symptoms;
  • your diagnosis or medical history;
  • your treatments;
  • your experience of the illness or that of someone close to you.

This content may constitute health data or other sensitive data. By creating an account and checking the consent box at registration, you expressly authorise EM/SFC to collect, store, and process this data solely within the messaging service and related features (translation, moderation, security).

6.3. Our recommendations

  • Share only information you are willing to have read by other members of the chat room.
  • Avoid posting identifying details unless necessary (full name of a doctor, national insurance number, address, etc.).
  • The messaging service does not replace medical advice and does not constitute medical guidance.
  • Automatically translated messages may contain inaccuracies: do not base medical decisions on a translation alone.

6.4. Automatic translation

To enable multilingual exchange, messages may be sent to an automatic translation service (DeepL). Only the message text is involved, to the extent necessary for translation.

DeepL may temporarily process the content of your messages. Caching may be used to limit repeated translation requests.

DeepL privacy policy: https://www.deepl.com/en/privacy

6.5. Signing in to messaging (SSO)

If you are already signed in on em-sfc.org, you can access messaging without re-entering your password. A secure authentication token is then passed between em-sfc.org and app.em-sfc.org.

6.6. Message retention

Messages are retained:

  • while your account is active;
  • then, if your account is deleted or you request deletion, for up to 12 months, unless a legal obligation or a need for security, moderation, or legal defence requires longer retention.

You may request deletion of messages concerning you where possible (see section 13).

7. Comments

When you leave a comment on the site, we collect form data (name, email, content) as well as your IP address and browser user agent to help detect unwanted comments.

An anonymised identifier derived from your email address may be sent to Gravatar to check whether you have a Gravatar account. Gravatar privacy policy: https://automattic.com/privacy/

After approval, your Gravatar profile picture may be displayed publicly next to your comment.

8. Media

If you upload images (forums, testimonials, profile), avoid files containing EXIF geolocation metadata. Other users may be able to extract location information from them.

9. Cookies and local storage

On em-sfc.org

  • session and sign-in cookies;
  • display preference cookies;
  • audience measurement cookies, where applicable.

On app.em-sfc.org

  • browser local storage (sign-in token, language and community preferences) to keep your session without asking for your credentials on every visit.

You can clear this data in your browser settings or by signing out. Signing out of messaging removes the local token, but your WordPress session on em-sfc.org may remain active.

10. Recipients and processors

Your data may be accessible, strictly within the scope of their tasks, to:

  • other members of the messaging room you join;
  • site administrators, for management, moderation, and security;
  • our technical service providers, acting on our behalf:
    • WordPress site hosting;
    • messaging service hosting (dedicated server);
    • DeepL translation service;
    • anti-spam, analytics, or backup tools, where applicable.

We require our providers to respect confidentiality and data security.

11. Transfers outside the European Union

Where possible, we prefer providers located in the European Union or European Economic Area.

If processing involves a transfer outside the EU/EEA, we ensure it is covered by safeguards provided under the GDPR (adequacy decision, standard contractual clauses, or equivalent measures).

12. Retention periods (summary)

Data Period
Member account and profile While the account is active
Messaging / health consent Timestamped and stored with the account
Messaging messages Active account + up to 12 months after account deletion
Public comments Retained for site operation
Technical / security logs Limited duration, proportionate to purpose
Cookies Depending on type (session to 13 months maximum, as applicable)

13. Your rights

Under the GDPR, you have the following rights:

  • right of access to your data;
  • right to rectification;
  • right to erasure;
  • right to restriction of processing;
  • right to object (in cases provided by law);
  • right to data portability (for data you provided and that is processed automatically);
  • right to withdraw your consent at any time for processing based on consent (in particular messaging and health data you share there).

Please note: withdrawing your consent to messaging means you will no longer be able to use that service.

To exercise your rights: contact@em-sfc.org

We may ask for proof of identity if there is reasonable doubt.

If, after contacting us, you believe your rights are not being respected, you may lodge a complaint with a supervisory authority. In France: CNIL — https://www.cnil.fr. In other countries: your local data protection authority.

14. Security

We implement reasonable technical and organisational measures to protect your data (authentication, restricted access, backups, HTTPS encryption, etc.).

However, no transmission over the internet is completely risk-free.

15. Embedded content from other sites

Some pages may embed external content (videos, audio players, etc.). These services may collect data, use cookies, or track your interactions under their own policies.

16. Minors

The site and messaging service are intended for adults, or for minors with the consent and under the responsibility of their legal guardian.

17. Changes to this policy

We may update this policy to reflect changes to the site, messaging service, or applicable law. The last updated date is shown at the top of the page. Material changes may be announced on the site.

18. Contact

For any questions about this policy or your personal data:

contact@em-sfc.org

Scroll to Top