Privacy Policy

1.Data controller

The Service is published and operated by SafiDoctor ("we").

For any question about this policy or your personal data, write to us at [email protected] or on WhatsApp at +213 560 42 81 38 (messages only).

2.Data we collect

We only collect the data needed to run the Service:

• Account data: first and last name, email address, password (hashed), phone number, and the professional information you provide (specialty, practice details, prescription letterhead, photo).
• Patient data: the information practitioners enter in their records (identity, contact details, medical history, clinical notes, prescriptions, appointments, billing). See sections 3 and 4.
• Organization data: team members, roles, and permissions when you use the Service as a team.
• Technical data: connection logs, IP address, device and browser type, display preferences (language, theme).

If you choose to sign in with Google, we receive your name and email address from Google. The Service also uses reCAPTCHA to protect authentication forms.

3.Health data and encryption

Health data is sensitive data within the meaning of Law No. 18-07. Its processing through the Service falls within preventive medicine, diagnosis, and care, under the responsibility of health professionals bound by medical secrecy, in accordance with Article 18 of that law.

Clinical notes, diagnoses, medical history, and prescriptions are encrypted on the practitioner's device before being sent: the medical servers only ever store encrypted data. The encryption keys are kept separately, by our authentication service, and are delivered over an encrypted connection only to the account holder and to the team members they have authorized. Every key retrieval is logged.

Non-medical staff of a practice (secretaries, assistants) never have access to clinical notes, diagnoses, or prescriptions.

4.Roles and responsibilities

For their patients' data, the practitioner is the data controller: they decide what data is entered and how it is used in their practice. SafiDoctor acts as a technical service provider and only processes this data to deliver the Service, on the practitioner's instructions.

Practitioners undertake to comply with their own obligations, in particular informing their patients, medical secrecy, and the rules of the code of medical ethics and of Law No. 18-11 of 2 July 2018 on health.

5.Purposes and legal bases

We process account and technical data to:

• create and manage your account and provide the Service's features (calendar, records, prescriptions, stock, billing);
• keep the Service secure (authentication, abuse prevention, logs);
• answer your support requests;
• comply with our legal obligations;
• where applicable, manage subscription billing.

These operations are based on the consent you give when creating your account, on the performance of our contract with you, and on our legal obligations. We do not use your data for marketing without your consent.

6.Data sharing

We never sell or rent personal data. Data is only shared with:

• the technical providers strictly required to run the Service (hosting, file storage, email delivery): [providers and server locations — to be completed];
• competent authorities where the law requires it;
• the members of your organization, according to the roles and permissions you define.

7.Transfers outside Algeria

Where processing involves transferring data abroad, it is carried out in compliance with Articles 44 et seq. of Law No. 18-07, where applicable after authorization from the national personal data protection authority (ANPDP).

Because clinical data is encrypted on the practitioner's device before it is sent, only encrypted content is transferred to and stored on the medical servers.

8.Data retention

Account data is kept for as long as the account is active, then deleted or anonymized within a reasonable period after closure, subject to legal archiving obligations.

Patient records are kept for as long as the practitioner needs them; their retention is the practitioner's responsibility, in line with the rules applicable to medical archiving.

Technical logs are kept for a limited period, for security purposes.

9.Security

We implement appropriate technical and organizational measures, including:

• encryption of clinical data on the practitioner's device (libsodium authenticated encryption), with keys stored separately from the medical data;
• encryption in transit (TLS);
• role-based access control within organizations;
• protection of authentication forms (reCAPTCHA);
• regular backups.

10.Your rights

Under Law No. 18-07, you have the following rights over your data:

• right of access and information;
• right of rectification;
• right to object on legitimate grounds;
• right to withdraw consent and to erasure.

You can exercise these rights by writing to [email protected]. We will reply as promptly as possible. You also have the right to lodge a complaint with the ANPDP.

If you are the patient of a practitioner who uses the Service, please address your request to your practitioner first, as the controller of your record; we will give them all necessary assistance.

11.Cookies and local storage

The Service uses no advertising cookies. We only use what is technically necessary: a session token to keep you signed in, and language and theme preferences.

Google's third-party services (reCAPTCHA, Google sign-in) may set their own cookies, governed by Google's privacy policy.

12.Changes to this policy

We may update this policy. The current version is published on this page with its revision date; in the event of a substantial change, we will inform you through the Service or by email.

13.Contact

For any question: [email protected] or WhatsApp +213 560 42 81 38 (messages only).