Privacy policy

This policy explains what personal data DoctoNova processes, why, and where. It completes the terms of use. “We” means the publisher of the service, named at the bottom of this page.

1. Who is responsible for what

There are two cases.

• Your patients’ data. The practice is its data controller, within the meaning of Algerian law no. 18-07 of 10 June 2018. We host it on the practice’s behalf, as a processor, and do nothing else with it.
• Your own data (your account, your practice, your messages, your visit to our website). We are its data controller.

As a French company, we apply the European General Data Protection Regulation (GDPR) to both.

2. The data processed

Your account. First name, last name, specialty, phone, email address, language, and a profile picture if you add one. Your password is never stored in plain text: we keep only a hash of it. We also record the date on which you accepted the terms of use and the date of your last sign-in.

Your practice. Name, address, phone, the professional and tax identifiers you enter, and the logo, stamp and signature you add for your documents.

Your patients, on your behalf. What the practice enters: identity, contact details, medical history, consultations, measurements, prescriptions and other documents, appointments, payments.

The access log. Every time a record is opened, changed or printed, it is recorded with the account that did it and the date. Our servers also keep technical logs (IP address, date, browser), for security and troubleshooting.

The contact form of the website. Name, email address, phone, country, specialty and message.

Audience measurement on the website. Only if you accept it in the banner shown on your first visit: the pages viewed and how they are browsed, measured with Google Analytics and Microsoft Clarity. The application itself uses neither audience measurement nor advertising.

3. Why we process it

• To provide the service and keep it running: this is the purpose of the contract between us.
• To reach you, by email, by phone or on WhatsApp, to help you get started and for support.
• To protect the service and the data: to detect abnormal access, to trace the origin of an error.
• To answer messages sent through the contact form.
• To improve the website, if you accepted audience measurement.

We sell no data and pass none on to anyone for advertising.

4. Where the data is hosted

DoctoNova’s data is hosted in France, in the European Union. An encrypted backup copy is sent every night to a second hosting provider, also in France.

Your data and your patients’ data is therefore hosted outside Algeria. Law no. 18-07 regulates the transfer of personal data abroad: as the data controller for your patients’ records, take this into account in your formalities with the National Authority for the Protection of Personal Data (ANPDP). On request, we give you the information you need for these formalities.

5. The providers involved

• The hosting provider, named in the legal notice, and the backup hosting provider, both in France. The backup is encrypted before it leaves our servers.
• An email delivery provider, for welcome, invitation, address confirmation and forgotten-password messages. It receives the recipient’s email address, their first name and the name of the practice.
• Cloudflare Turnstile, to check at sign-up that the form is filled in by a person. It receives the IP address and technical information about the browser.
• Google Analytics and Microsoft Clarity, on the website only, and only if you accepted them.

The last three may process this data outside France, in particular in the United States. No patient data is passed on to them. The list of our providers by name is given on request.

6. How long it is kept

• Your account and your practice: for as long as the practice is open.
• Your patients’ records: the practice decides, according to its retention obligations.
• After a practice is closed: its data is deleted from our servers, and disappears from our backup copies no later than 12 months afterwards.
• Messages from the contact form: for the time needed to handle and follow up your request; they are deleted on request.

7. How it is protected

• Exchanges between your browser and the service are encrypted (HTTPS).
• A practice’s records are visible to that practice only, and each account sees only what its role allows. A confidential note can be read only by the doctor who wrote it.
• Every time a record is opened, changed or printed, it is logged.
• An encrypted copy is made every night with a second hosting provider.

No measure makes an incident impossible. If an incident affected your practice’s data, we would tell you without delay, with what we know of its nature and its consequences.

Security also depends on you: one password per person, and a session closed on a shared computer.

8. Your rights

You can ask to see the data concerning you, to receive a copy of it, to have it corrected or deleted, to have its processing restricted, and you can object to its processing on legitimate grounds. Write to the contact address below: we answer within the time the law sets. You can also refer the matter to the data protection authority: the CNIL in France, the ANPDP in Algeria.

If you are a patient, contact your doctor: they are responsible for your record. We help them answer you.

9. Cookies and browser storage

The website sets audience measurement cookies only if you accept them; your choice is kept in your browser, and you can change it by clearing the site’s data.

The application stores in your browser what it needs to work: your session, your language, your display and print settings, and the draft of the consultation in progress until it has been sent to the server. On a shared computer, sign out when you leave. The application sets no advertising tracker.

10. Changes to this policy

If this policy changes, you are told by email or in the application before it takes effect; the date of the text is shown at the top of this page.