Coach Drépano
Thirteen short points, to read before using Trévor: every sentence matches a mechanism in the code, limits included.
Trévor is your everyday companion. It helps you track your day, know what to do in a crisis, keep your emergency card at hand and forget nothing thanks to reminders.
It also teaches you to live better with your condition, with short therapeutic education modules, and on top of that it is free!
Trévor is not a medical device, a diagnosis or medical advice. It complements your care and does not replace your care team. Its regulatory status is being examined with lawyers; until then, its risk features stay indicative.
In an emergency, call 144 in Switzerland, 112 in Europe, or your own country's emergency number elsewhere. Trévor spots certain emergency or distress words in your messages and shows these numbers at once, without artificial intelligence; this keyword detection stays partial.
Calculations made from your measurements (crisis risk, calculated daily form, camera measurements) are at the research stage. They stay off and only open in a study authorized by the ethics committee.
Your database is hosted in Switzerland (Infomaniak, Geneva, a virtual private server reserved for the project), under the Swiss Federal Act on Data Protection. It is closed to the Internet: only the Trévor server reaches it.
It holds your first name, your messaging profile name, your messaging ID (with WhatsApp, your number), your answers and emergency card, your free-text conversation (twelve months), your follow-up (pain, crises, treatments, scores), your watch measurements if you connect it, the contacts you register, your care network (professionals, services, pharmacies and relatives, with their contact details and your next appointment), and your position rounded to one kilometre if you share it. Medical photos and documents are read then discarded; only the values you confirm are kept. A prescription file is kept only if you ask, encrypted. The location of a crisis alert is never kept.
Nothing is sold, there are no ads and no third-party analytics, and nothing is passed to an insurer or an employer. Your data is pseudonymised, not anonymous: in analyses and research exports, a code replaces your name; the clinicians you authorise see your first name.
In transit, everything goes over HTTPS (TLS, Let's Encrypt certificates, HSTS). At rest, the application itself encrypts more than 170 fields with AES-256-GCM before they reach the database: messaging ID, first name, profile name, condition, sex, country, messages, answers and scores, pain, emergency card, treatments, rescue painkiller, crises, watch measurements, location, contacts, notes, access tokens, attachments, IP addresses in the access log. The key lives outside the database; without it, the server refuses to start.
Stay in clear, because the server needs them to look up, date or count: the internal numbers of your rows, dates and times, yes/no answers (consent, reminders on), catalogue keys (which questionnaire, which training module, which study), your language, your role (patient, relative or clinician) and your care centre, the state of pending requests, the link between you and a clinician (who is linked to whom, with nothing from your record), the usage log (which feature is opened, without the text you write) and random codes unrelated to you (study pseudonym, household code, emergency code on your card). Clinician accounts (name, work address) are also in clear: they are used to sign in. Your messaging ID is encrypted; the server recognises you through a keyed fingerprint (HMAC), like a locker whose number is known without your name written on it. Backups are encrypted every night (AES-256) and destroyed after thirty days; they sit on the same server, an off-site copy is being prepared.
Technical logs contain neither the text of your messages, nor personal links, nor any key: they are filtered before being written. Personal links (seven days) and pairing codes (ten minutes) are kept only as fingerprints. On your phone, the Coach Drépano app encrypts your token and the data received with an Android Keystore key, blocks screenshots outside the emergency card and can lock with fingerprint or face.
You, with your personal link. A named clinician or coach only if you authorised them in Trévor, and you withdraw that authorisation whenever you want; a coach sees your health data only if you share it with them. Nobody on the staff reads your conversation with Trévor.
Two accesses without your prior authorisation exist, and both are announced to you in Trévor as soon as they happen: a clinician's emergency access through the QR on your card (declared identity and reason, read-only, four hours) and a staff member's exceptional access with a written reason (24 hours). Trévor's technical administrators can open any record for maintenance and support; every opening is recorded.
Every consultation of your record is written to a hash-chained access log (an altered line shows). You read your last ten accesses in /donnees. Staff accounts sign in with a single-use link or with a password and a six-digit code; a deactivated account loses its session at once.
To find the cause of a reported problem, the server keeps a technical log: pseudonym (never your name or your ID), screen or menu opened, key of the button pressed, message type (text, photo, voice, file: size and duration only), duration of each step, number of language-model tokens, send error codes (for example Telegram “bot blocked”, WhatsApp “24-hour window”), reminders sent or missed. It never contains the text of your messages, health data, names, lab values, location, tokens or phone numbers. It is kept for 90 days and then deleted, erased with your account, and only administrators read it (every reading is written to the access log). The Android app also keeps on your phone the last 500 technical events (screen opened, call to the server and its code, duration, error, version, phone model) and sends them to the server when a call fails, after a crash, or when you tap “Send the diagnostic”; you can turn this log off in Settings. A usage ledger counts, per pseudonym and per day, the resources used (tokens, pages read, seconds of voice, messages) to estimate costs; it is also erased with your account, and only anonymous totals per profile group remain.
Your messaging app (Telegram, or WhatsApp and Messenger at Meta) carries the whole exchange, as for any bot. The path is encrypted from your phone to Telegram's or Meta's servers, then from those servers to the Trévor server in Switzerland (HTTPS, every incoming message is checked by signature). On their servers, Telegram and Meta read the content and keep it under their own rules; a chat with a bot is never end-to-end encrypted, and WhatsApp says so at the top of the conversation. This is the same level as a customer service on these apps.
The real risk for you is your account: a copied SIM card or a phone without a screen lock is enough to read Trévor in your place. Turn on your messaging app's two-step verification and a screen lock (Trévor shows you how in “Protect my account”). For your diary, treatments and card, the Coach Drépano app talks directly to the Swiss server, with no messaging app in between.
For your free-text questions, the Claude language model (Anthropic, United States) reads your text, the recent history, a summary of your follow-up without your first name or ID, and the photos or documents you send, stripped of their metadata (location, device). The travel guide, the translation of your treatments and the reading of your prescriptions also go through Claude, with a warning before sending and without your name. For translations, your first name and numbers are replaced by placeholders before sending. Under its terms, Anthropic does not train its models on this data and deletes it within 30 days.
Other services receive little and only if you use the feature: Open-Meteo (your rounded position, for the health weather), OpenStreetMap and its mirrors, OSRM and transport.opendata.ch (start and end coordinates for nearby places and routes), QuickChart (the values of a score chart), Google (voice, only as a fallback when a key is set, and Google Wallet, if configured), Stripe (online payment), CareWatch (anonymous report). Your voice messages and the spoken reading of answers are processed on the Swiss server. The site and dashboard fonts are served by Trévor itself: no request goes to Google when you read this page.
You can withdraw at any time, without giving a reason and with no effect on your care.
/supprimer immediately and permanently erases all your rows in the database and your files on the server. An encrypted copy remains in the backups for up to thirty days, then disappears. Outside services erase on their own schedule (Anthropic: within 30 days). /etude quitter test takes you out of the test programme; your data stays until /supprimer.
/donnees shows your whole inventory and opens the export (CSV, JSON, FHIR); the export holds your follow-up, not the text of your conversation. An account silent for eighteen months is warned, then erased thirty days later.
Your Trévor account is your messaging account: turn on two-step verification on Telegram or WhatsApp, a screen lock on your phone, and the Coach Drépano app lock. Trévor guides you step by step in “My data”, “Protect my account”.
Lost phone? From another device, /supprimer erases everything, or write to us via /contact: we block your account, which answers nobody until you are back. An app linking link is valid for ten minutes and once only.
If a leak or an unauthorised access is found, we cut the access concerned, we measure its extent, we tell you in Trévor and through the study channels, and we report the incident to the Swiss Federal Data Protection Commissioner (FDPIC) without delay, then we write a report that is kept. An access you do not recognise in /donnees can be reported to the address below.
This section concerns physicians invited to rate, blind, answers written by software assistants, on the /evaluation page of the Trévor server. No patient data enters this evaluation. The database keeps your name, email address, institution, role, experience with sickle cell disease, any link with the project, the date of your consent, your ratings, your comments and the time spent on each question. These fields are encrypted like the rest; your personal link and the invitation code are kept only as a SHA-256 fingerprint.
A button on your personal page erases at any time your name, address, institution, role and comments; your ratings stay anonymous unless you tick the deletion of ratings. Contact details are also erased at the end of the study by the investigator, who has a button for it: no automatic purge exists for this table. Encrypted backups keep a copy for thirty days. Results are published in aggregate and anonymous form.
Trévor is still under construction: everyone who uses it takes part in the test programme. You get every feature, including the newest, and your feedback (/contact) helps us improve it. Every version passes a suite of more than 1,600 automated tests before being published.
New features stay confidential until their official release.
This programme is separate from the TREVOR-PILOTE clinical study at HUG, which is awaiting authorisation from the Geneva ethics committee and will start only afterwards. The test programme falls under service improvement and data-protection law; its status under the research act will be confirmed with the committee.
Prof. Dr. David-Z. Issom, Geneva University Hospitals. david.issom@hug.ch
Text version: 1.6 of 12 November 2026