Privacy policy
The data medi.tn controls itself: account, billing, support and security.
Version 1.0 — effective [TO COMPLETE: publication date]
This is a courtesy translation. The French version is the authoritative text and prevails in the event of any divergence. See Politique de confidentialité.
What this policy covers, and what it does not
This policy describes how medi.tn processes the data for which it is itself the controller: the practitioner's account, subscription billing, support, and browsing of the website.
It does not cover your patients' medical records. That data is processed by the physician, who is its controller under organic law no. 2004-63 of 27 July 2004. medi.tn acts on that data only as a processor, on the physician's sole instruction and under the conditions of the data processing agreement.
A patient wishing to exercise rights over their medical record must contact their physician, not medi.tn. See the patient notice template.
1. Controller
[TO COMPLETE: company name], [TO COMPLETE: registered office address], Tunisia.
Data protection officer (DPO): [TO COMPLETE: name and email address].
2. Data processed
Practitioner account — surname, first name, email address, telephone number, speciality, Order registration number, CNAM physician code where applicable, practice address.
Sign-in and security — sign-in timestamps, IP address, authentication outcome, second factor where enabled.
Subscription and billing — plan subscribed, invoices, payments, transaction references supplied by the payment provider. We neither receive nor store any bank card number.
Support — the content of assistance requests you send us.
Browsing — pages viewed and technical data strictly necessary to the operation and security of the site.
Online appointment booking. Data entered by a patient on the public booking page is collected on behalf of and on the instruction of the physician concerned, who is its controller. medi.tn passes it to the practice and uses it for no other purpose.
3. Purposes
| Purpose | Basis |
|---|---|
| Create and manage your account, give you access to the Service | Performance of the contract |
| Invoice the subscription and collect payment | Performance of the contract and accounting obligations |
| Secure the Service and detect abnormal access | Legitimate interest and security obligation |
| Answer your support requests | Performance of the contract |
| Send you information about the Service | Performance of the contract |
| Meet our legal, accounting and tax obligations | Legal obligation |
We sell no data. We do not use your data, or your patients' data, for advertising, resale, or the training of automated systems.
4. Recipients
Data is accessible only to members of our team who need it and who are bound by a confidentiality obligation.
Our processors are:
| Processor | Role | Location |
|---|---|---|
| [TO COMPLETE: hosting provider] | Hosting of the application and database | Tunisia |
| ClicToPay (Société Monétique Tunisie) | Card payment processing | Tunisia |
| [TO COMPLETE: email provider] | Transactional email | [TO COMPLETE] |
| [TO COMPLETE: SMS gateway, if any] | SMS notifications | [TO COMPLETE] |
This list is kept up to date. We add no processor with access to health data without the prior written authorisation of the physician concerned.
We may also disclose data upon requisition by a competent judicial or administrative authority.
5. Location and transfers
All data is hosted on Tunisian territory.
We make no transfer of personal data outside Tunisia. Should such a transfer ever be contemplated, it would be implemented only after prior notice to the persons concerned and the INPDP authorisation required by articles 51 and 52 of law no. 2004-63, the destination country having to provide an adequate level of protection.
6. Retention periods
| Data | Period |
|---|---|
| Practitioner account | Duration of the subscription, then [TO COMPLETE: e.g. 90] days |
| Sign-in and security logs | [TO COMPLETE: e.g. 12 months] |
| Invoices and accounting records | The period required by accounting and tax regulations [TO COMPLETE: to be confirmed by your accountant] |
| Support requests | [TO COMPLETE: e.g. 24 months] after closure |
7. Security
We implement in particular:
- personal accounts, credential sharing being prohibited;
- encryption of traffic between your browser and our servers;
- strict partitioning between practices: one practice's data is not accessible from any other;
- restricted access for our support team, which does not access the clinical content of records;
- a periodic security audit in accordance with law no. 2004-5 of 3 February 2004 and decree no. 2004-1250 of 25 May 2004.
8. Your rights
Under law no. 2004-63 you have a right of access, of rectification, and of objection on legitimate grounds regarding data concerning you.
To exercise them: [TO COMPLETE: DPO email address], or by post to [TO COMPLETE: registered office address]. Proof of identity may be requested. We respond within one month.
You may also refer the matter to the National Authority for the Protection of Personal Data:
INPDP — 1, rue Mohamed Moalla, 1002 Mutuelleville, Tunis, B.P. 525 Telephone: 71 799 853 / 71 799 711 — inpdp@inpdp.tn
9. Cookies
We set only the cookies strictly necessary for the site to work: session persistence, language choice and security. [TO COMPLETE: extend if an analytics tool is added — its use would then require prior consent.]
10. Changes
Any substantial change to this policy is notified to account-holding practitioners before it takes effect.
11. Contact
contact@medi.tn — [TO COMPLETE: DPO email address]