Your personal information is retained for as long as your account exists. You can ask for it to be deleted at any time, in your account settings. That deletion does not erase everything in the same way, and the difference matters:

Erased: your profile — first name and surname, email address, and photo where there is one — along with your message preferences, your access to the site, and the link to your Google account if there is one. Your reviews and your waiting-list signup are erased in the same way.
Made anonymous: your past appointments. The record remains, with its date, the treatment and the amount, because our accounting has to be able to account for them; everything that names you is removed from it — the link to your account, your first name and surname, your email address and your phone number. Once that is done, nothing in that record leads back to you. The same applies to a training application that never resulted in a payment.
Kept in your name: your invoices, and the file for the training you attended and paid for. For ten years from the close of the accounting year concerned, under article L123-22 of the French commercial code and the obligations specific to training organisations: an invoice must name its customer, and that legal obligation prevails over the right to erasure, as article 17(3)(b) of the GDPR provides. Those documents serve no other purpose.
Language cookie: Retained for 1 year.
Theme cookie: Stored in localStorage with no expiry.
Audience-measurement consent choice: Stored in localStorage (with its date) until you change it.
Session memory for where your visit came from: erased when you close the tab.
Audience-measurement data (Google Analytics 4): Anonymised statistics retained for at most 14 months.
Waiting list: 3 years from the last contact, in line with the CNIL's recommendation for prospect data. After that, it is deleted.
After an unsubscribe: we keep only your email address and the fact that you no longer wish to be contacted, so that we never approach you again. Your phone number and where your visit came from, campaign parameters and landing page included, are erased immediately.
Protection against automated submissions: a counter tied to your IP address, deleted automatically after one hour.
Rights-request register: when you exercise one of your rights we record which one, the date it reached us and the date we answered, so that we can show we replied within the one-month deadline. Your address and your message are held only for as long as the request is open: they are erased the moment it is closed. What remains names nobody, and is deleted after a year.
List of people who no longer wish to be contacted: kept with no time limit, since erasing it would mean approaching you again. It holds only your email address and the type of message you declined.