Last updated: August 2026

1. Who are we?

The website https://em-sfc.org is dedicated to information and support around myalgic encephalomyelitis / chronic fatigue syndrome (ME/CFS).

• Data controller: Philippe N.
• Contact: contact@em-sfc.org

2. Scope of this policy

This policy applies to:

• the em-sfc.org website (information pages, member accounts, comments, testimonials, etc.);
• the community messaging service available at https://app.em-sfc.org, reserved for registered members.

3. What data do we collect?

Depending on how you use the site, we may process the following data.

When creating an account

• username, first name, last name, email address;
• password (stored in encrypted form);
• date and content of your consent to the processing described below.

When browsing em-sfc.org

• technical data: IP address, browser type, pages viewed;
• cookies necessary for operation and, where applicable, audience measurement cookies.

When you contribute content

• comments, testimonials, and media you publish;
• profile information you choose to make visible (display name, photo, biography, etc.).

When using the messaging service (app.em-sfc.org)

• account identifier and display name in the chat room;
• content of messages you send;
• language chosen for reading messages;
• community / room joined (members or scientific & medical);
• date and time messages are sent;
• technical data related to the connection (logging, security);
• audio recordings where applicable, if you use the voice dictation feature (processed locally to produce the message text, then deleted).

4. What purposes do we use your data for?

We use your data only to:

• create and manage your member account;
• allow you to sign in to the site and the messaging service;
• ensure the operation, security, and maintenance of the services;
• moderate content and prevent abuse;
• enable exchanges between members in the messaging service;
• automatically translate messages into the language chosen by each participant;
• transcribe your voice to text if you use voice dictation;
• respond to your requests (contact, exercise of your rights);
• measure site traffic, where applicable;
• comply with our legal obligations.

We do not sell your personal data and do not use it for advertising purposes.

5. Legal bases for processing

Access to the messaging service is subject to your explicit consent, collected at registration via a dedicated checkbox, separate from other acceptances.

6. Community messaging and health data

6.1. Principle

The EM/SFC messaging service allows registered members to exchange with one another in separate spaces:

• Members community (patients, carers, loved ones);
• Scientific & medical community (researchers, clinicians, healthcare professionals).

Messages posted in a room are visible to other participants in that room. They are not public on the Internet, but they are not private in the sense of a confidential medical conversation.

6.2. Health data and sensitive information

You may, on your own initiative, mention in your messages:

• your symptoms;
• your diagnosis or medical history;
• your treatments;
• your experience of the illness or that of someone close to you.

This content may constitute health data or other sensitive data. By creating an account and checking the consent box at registration, you expressly authorise EM/SFC to collect, store, and process this data solely within the messaging service and associated services (translation, moderation, voice dictation, security).

6.3. What we recommend

• Share only information you accept being read by other members of the room.
• Avoid posting data that could identify you or a third party without necessity (full name of a doctor, social security number, address, etc.).
• The messaging service does not replace a medical consultation and does not constitute medical advice.
• Automatically translated exchanges may contain inaccuracies: do not base medical decisions on a translation alone.

6.4. Local processing — technical architecture

The EM/SFC messaging service is designed not to rely on third-party cloud services for its core operation (moderation, translation, voice dictation). These processes run on EM/SFC infrastructure, hosted on our servers — and not with an external provider such as OpenAI, Google, or DeepL for everyday use.

Your messages are not resold or used for advertising purposes. They serve only the operation of the messaging service, community moderation, and, where applicable, the translation or voice transcription you request.

In summary: moderation (Llama 3.2 via Ollama), translation (LibreTranslate, self-hosted), and voice dictation (Whisper, self-hosted) run on EM/SFC infrastructure. No data is transmitted to external third parties for these services in the standard operation of the messaging service.

6.5. Automatic translation

To enable multilingual exchanges, messages may be translated on the fly into 20 languages (French, English, German, Spanish, Portuguese, Italian, Dutch, Polish, Russian, Ukrainian, Turkish, Swedish, Danish, Norwegian, Finnish, Chinese, Japanese, Korean, Arabic, Hindi).

Translation relies on LibreTranslate, a self-hosted engine on the same EM/SFC infrastructure: only the message text is processed, to the extent necessary for translation, without recourse to an external commercial translation service for standard operation.

6.6. Assisted moderation

In the members community, each message may be analysed by local artificial intelligence: Llama 3.2, run via Ollama on our servers. No transmission to an external moderation API is required for this operation.

The messaging service is still in its early stages: the moderation system needs operating time to improve (learning from examples and administrator feedback). As a result, some harmless messages may be wrongly rejected, and some problematic messages may occasionally pass the filter. You can use the Report button to help us correct these errors.

6.7. Voice dictation

If you enable voice dictation to enter a message, an audio recording is transmitted from your browser to our servers, where it is transcribed by the Whisper engine (self-hosted on EM/SFC infrastructure). The audio is processed locally and not retained beyond transcription. Only the resulting text is used as message content, subject to the same rules as manual entry.

6.8. Encryption of communications

All communications between your browser and the messaging service are encrypted in transit via TLS 1.2 or higher (HTTPS connection and secure WebSocket — WSS to app.em-sfc.org).

This is in-transit encryption between your device and our servers, not end-to-end encryption of the kind used in private messaging. Messages are then processed and stored on EM/SFC servers for display, translation, and moderation — always within our infrastructure.

6.9. Messaging sign-in (SSO)

If you are already signed in on em-sfc.org, you can access the messaging service without re-entering your password. A secure authentication token is then transmitted between em-sfc.org and app.em-sfc.org.

6.10. Message retention period

Messages are retained:

• while your account is active;
• then, in the event of account deletion or a deletion request, for up to 12 months maximum, unless a contrary legal obligation applies or retention is necessary for security, moderation, or the defence of legal rights.

You may request deletion of messages concerning you to the extent possible (see section 13).

7. Comments

When you leave a comment on the site, we collect the form data (name, email address, content), as well as your IP address and browser user agent, in order to combat unwanted comments.

An anonymised hash of your email address may be transmitted to the Gravatar service to check whether you have a Gravatar account. Gravatar policy: https://automattic.com/privacy/

After approval, your Gravatar profile picture may appear publicly next to your comment.

8. Media

If you upload images (forums, testimonials, profile), avoid sending files containing EXIF geolocation metadata. Other users could extract location information from them.

9. Cookies and local storage

On em-sfc.org

• session and sign-in cookies;
• display preference cookies;
• audience measurement cookies, where applicable.

On app.em-sfc.org

• browser local storage (sign-in token, language and community preferences) to maintain your session without asking for your credentials on every visit.

You can clear this data via your browser settings or by signing out. Signing out of the messaging service removes the local token, but your WordPress session on em-sfc.org may remain active.

10. Recipients and processors

Your data may be accessible, strictly within the limits of their roles, to:

• other members of the messaging room you join;
• site administrators, for management, moderation, and security;
• our technical providers, acting on our behalf:
  • WordPress site hosting provider;
  • messaging service hosting provider (dedicated EM/SFC server);
  • anti-spam, analytics, or backup tools, where applicable.

Moderation (Llama 3.2 / Ollama), translation (LibreTranslate), and voice dictation (Whisper) processing runs on EM/SFC infrastructure: in standard operation, it does not involve transmitting your messages to a third-party cloud processor (OpenAI, Google, DeepL, etc.).

We require our providers to respect the confidentiality and security of the data processed.

11. Transfers of data outside the European Union

Where possible, we prioritise providers located in the European Union or the European Economic Area.

The core operation of the messaging service (moderation, translation, voice dictation, message storage) is hosted and processed on our infrastructure, without recourse to third-party cloud services for these operations in standard use.

If processing involves a transfer outside the EU/EEA (for example, certain WordPress site tools or embedded content), we ensure it is governed by the safeguards provided for under the GDPR (adequacy decision, standard contractual clauses, or equivalent measures).

12. Retention periods (summary)

13. Your rights

Under the GDPR, you have the following rights:

• right of access to your data;
• right to rectification;
• right to erasure;
• right to restriction of processing;
• right to object (in cases provided for by law);
• right to data portability (data provided and processed in an automated manner);
• right to withdraw your consent at any time for processing based on consent (in particular the messaging service and health data you share there).

To exercise your rights: contact@em-sfc.org

We may ask for proof of identity in case of reasonable doubt.

If, after contacting us, you believe your rights are not being respected, you may lodge a complaint. In France: CNIL — https://www.cnil.fr. In other countries: your local data protection authority.

14. Security

We implement reasonable technical and organisational measures to protect your data:

• secure authentication and restricted access to servers;
• encryption of communications in transit via HTTPS and TLS 1.2 or higher (including secure WebSocket WSS for the messaging service);
• passwords stored in encrypted form;
• backups and technical logging proportionate to the purpose;
• sensitive messaging processing (moderation, translation, dictation) executed on dedicated EM/SFC infrastructure.

No transmission over the Internet is entirely free of risk. The messaging service is not an end-to-end encrypted communication service.

15. Embedded content from other sites

Some pages may include external content (videos, audio players, etc.). These third-party services may collect data, use cookies, or track your interactions according to their own policies.

16. Minors

The site and messaging service are intended for adults, or for minors with the agreement and under the responsibility of their legal guardian.

17. Changes to this policy

We may update this policy to reflect changes to the site, the messaging service, or applicable regulations. The last updated date will be shown at the top of the page. In the event of a substantial change, a notice may be published on the site.

18. Contact

For any question relating to this policy or your personal data:

contact@em-sfc.org