Privacy policy
What data Clinoly processes, why, for how long, who it is shared with, and how to exercise your rights.
This translation is provided for information. Where it differs from the French version, the French version prevails.
This document is being finalised: some of the publisher’s legal details have still to be filled in.
1.Who is responsible for your data
Clinoly acts in two different capacities:
- As controller, Clinoly processes the data of people who use the Service on a clinic’s behalf, of the customers who subscribe, of site visitors and of people who contact it. This policy describes that processing.
- As processor, Clinoly processes patients’ data on behalf of the clinic that treats them. The clinic is responsible for that processing; its duties and Clinoly’s are set out in the Data processing agreement.
2.Data we process
| Category | Data | Source |
|---|---|---|
| Account | First and last name, email, phone, role, language; password (stored hashed, never in clear); two-factor secret (encrypted) | You, or the clinic that invites you |
| Clinic and billing | Registered name, address, legal and tax identifiers, plan, billing history | The clinic owner |
| Sign-in and security | IP address, browser type, sign-in times, log of actions taken, security events | Generated by use of the Service |
| Acceptances | Version of the legal documents accepted, date, time and IP address | Generated on acceptance |
| Contact and support requests | Name, email, clinic, phone, message content | You |
| Technical error reports | Technical information about the error, stripped of personal data before being sent | Generated automatically when an error occurs |
3.Why, and on what basis
In accordance with Article 4 of Law No. 09-08, each processing operation rests on one of the grounds the law provides:
| Purpose | Basis |
|---|---|
| Providing the Service, managing accounts and access rights | Performance of the contract with the clinic |
| Invoicing the subscription and keeping accounts | Performance of the contract and legal accounting and tax obligations |
| Securing the Service, preventing fraud, keeping the audit trail | Legal security obligations and legitimate interest |
| Keeping evidence of acceptance of the contractual documents | Legitimate interest and Law No. 53-05 |
| Answering contact and support requests | Pre-contractual steps or performance of the contract |
| Fixing technical errors | Legitimate interest in the proper operation of the Service |
We send no electronic marketing without your prior consent, in accordance with Article 10 of Law No. 09-08. We sell no data and use none for advertising.
4.Recipients
- the Publisher’s authorised staff, within the limits of their duties and under a duty of confidentiality;
- the providers acting on its behalf, listed under Subprocessors;
- administrative or judicial authorities, only on lawful request.
5.Transfers outside Morocco
Data is hosted in the following region: [to be completed]. Some providers may process data outside Morocco; their location appears in the list of Subprocessors. Any transfer to a third country is made in accordance with Articles 43 and 44 of Law No. 09-08: to a country ensuring an adequate level of protection, or with the CNDP’s authorisation.
6.How long we keep data
Data is kept for as long as its purpose requires, then deleted or anonymised. The periods that apply, category by category, are set out in Data retention.
7.Security
In accordance with Articles 23 and 24 of Law No. 09-08, the Publisher implements appropriate technical and organisational measures to protect data against destruction, loss, alteration, disclosure or unauthorised access. They are described on the Security page.
8.Your rights
Law No. 09-08 gives you the following rights over data about you:
- right to information about processing, which this policy is intended to meet;
- right of access: to confirm whether data about you is processed and to receive a copy;
- right of rectification: to have inaccurate or incomplete data, or data whose processing is not authorised, corrected, completed, updated or erased;
- right to object: to object on legitimate grounds to processing, and without giving a reason to any marketing.
To exercise them, write to privacy@clinoly.com with anything that lets us verify your identity. We answer as soon as possible and within thirty (30) days at the latest.
If you believe your rights are not being respected, you may refer the matter to the National Commission for the Control of Personal Data Protection (CNDP), www.cndp.ma.
10.Changes
This policy may change. Every version has a number and an effective date; after a substantial change, users are asked to read the new version at their next sign-in.