Privacy policy

2. Applicable legal framework

2.1. In Tunisia

• Organic Law No. 2004-63 of 27 July 2004 on the protection of personal data, in particular its Articles 62 to 65 specific to health data;
• Decree No. 2007-3004 of 27 November 2007 setting the conditions and procedures for declaration and authorisation for the processing of personal data, and the deliberations of the National Authority for the Protection of Personal Data (INPDP), in particular the deliberation relating to the processing of health-related data;
• Law No. 5-2004 of 3 February 2004 on computer security;
• Convention 108 of the Council of Europe and its Additional Protocol (Convention 108+), ratified by Tunisia;
• The Tunisian Medical Code of Ethics, insofar as it governs the medical confidentiality applicable to healthcare professionals using the Platform.

2.2. Internationally

• The General Data Protection Regulation (GDPR – Regulation (EU) 2016/679), in particular its Article 9 on health data, applicable when users are located in the European Union or the European Economic Area;
• The equivalent national legislation of the other jurisdictions in which DeePic is used, applied in accordance with the principle of the most favourable protection for the data subject;
• The principles of the conventions administered by the World Intellectual Property Organization (WIPO), in particular the Paris Convention and the Berne Convention, relevant for the protection of the "DEEP" trademark, its software, interfaces and databases as intellectual property assets.

3. General principles regarding data collection and processing

3.1. Lawfulness, fairness and minimisation

Personal data, and in particular health data, collected via the Platform is processed lawfully, fairly and transparently. In accordance with the principle of minimisation, only data that is adequate, relevant and strictly necessary for the purposes pursued is collected.

3.2. Purposes of processing

The collection and processing of your data serve the following explicit and legitimate purposes:

• Creating and securing your user account (patient, healthcare professional or establishment) and managing your authentication, including enhanced authentication (two-factor authentication);
• Enabling the secure sharing of medical documents and health data between the patient and the healthcare professionals he or she expressly authorises;
• Providing the subscribed features (personal space, history of shared documents, management of access permissions);
• Managing invoicing, payments and subscription tracking, where applicable;
• Managing the user relationship and providing technical support;
• Preventing and combating fraud, detecting unauthorised access to medical records, and preserving the security of the DeePic infrastructure;
• Sending service information communications or, subject to your prior, free and specific consent, promotional communications by SMS or email — this marketing consent is separate and never conditions access to the medical features of the service.

3.3. Confidentiality and medical secrecy

The Company formally undertakes never to sell, rent or disclose for commercial purposes the personal data and, a fortiori, the health data of users. This data may only be shared with the healthcare professionals expressly authorised by the patient, with our technical subcontractors strictly necessary for the performance of the service, or in the event of a legal obligation. Any person having access to health data in the course of his or her duties at DeePic is subject to a strict and permanent confidentiality obligation, akin to professional secrecy.

4. Nature of the personal data collected

4.1. Identification and contact data

• For patients (individuals): surname, first name, date of birth, email address, telephone number, and password (hashed);
• For healthcare professionals and establishments: surname, first name, professional email address, telephone number, speciality, registration number with the competent professional order, legal name of the establishment where applicable.

4.2. Health data

As part of its primary purpose, the Platform enables the sharing of medical documents and health data, in particular: medical imaging (CT scans, MRIs, X-rays, ultrasounds), medical reports, biological analysis results, prescriptions, medical history provided by the user or the healthcare professional, and any other data relating to the physical or mental state of health, past, present or future, of the data subject.

4.3. Usage data and service-related preferences

In order to provide an adapted experience, we retain certain preferences of your space (structure of your files, lists of authorised healthcare professionals, history of shares and document consultations, configured alerts).

4.4. Technical and browsing data

When you access the Platform, we automatically collect certain technical data strictly necessary for proper functioning, maintaining your session and securing the infrastructure: IP address and connection logs, browser type and version, operating system, session data via technical cookies. The details of these trackers are presented in our Cookie Policy, a separate and complementary document to this Policy.

4.5. Financial data and payment processing

When subscribing to a paid offer, transactions are processed directly by our partner and licensed payment provider (e.g. ClickToPay or others). DeePic does not collect, process or store your bank details or card numbers on its own servers. Only transaction metadata and invoices are retained for commercial management and legal obligations.

5. Special regime applicable to health data

5.1. Legal basis and reinforced consent

In accordance with Article 62 of Law No. 2004-63, the processing of health data is only possible when the data subject (or, for a minor or a protected person, his or her legal representative) has given express consent to this processing, or when the processing is necessary for the achievement of a purpose provided for by law or by an agreement to which the person is a party. This consent is collected separately from the general consent to use the Platform, and may be withdrawn at any time without affecting the lawfulness of processing already carried out.

5.2. Processing reserved for authorised professionals

In accordance with Article 63 of Law No. 2004-63, access to and processing of health data within DeePic is reserved for doctors and persons who, by reason of their function, are subject to an obligation of professional secrecy, as well as for the strictly authorised DeePic technical staff subject to a reinforced confidentiality obligation for the maintenance and security of the Platform.

5.3. Algorithmic processing and artificial intelligence

If DeePic offers features assisted by algorithmic or artificial intelligence tools (for example for the indexing, sorting or automatic structuring of uploaded medical documents), the following guarantees apply:

• These processing operations are configured to serve only the organisation and presentation of documents, without any purpose of automated diagnosis replacing a healthcare professional;
• No identifiable health data is used by a third-party provider to train or improve its own artificial intelligence models;
• Any processing involving a transfer of data to a third-party technical provider, including abroad, is strictly contractually framed and subject to the transfer guarantees described in Article 5.4;
• Human control (authorised healthcare professional) remains solely competent for any clinical interpretation of the shared documents.

5.4. International transfers of health data

DeePic hosts personal data in principle on infrastructures compliant with INPDP requirements. If, for the needs of the service (for example a healthcare professional located abroad, or an international technical provider), a transfer of health data outside Tunisia proves necessary, this transfer only takes place on the basis of an appropriate authorisation or legal basis in accordance with Article 52 of Law No. 2004-63 and, where the GDPR applies, on a recognised mechanism.

6. Hosting and security of personal data

6.1. Data location

In accordance with INPDP directives and Law No. 2004-63, DeePic hosts personal and health data by default on secure servers, except for a transfer framed in accordance with Article 5.4 for the needs strictly necessary to the service.

6.2. Technical and organisational security measures

DeePic, together with its hosts and subcontractors, deploys state-of-the-art security measures, including in particular:

• Systematic encryption of communication flows (SSL/TLS) and, for medical documents, reinforced encryption at rest;
• Cryptographic hashing of passwords and two-factor authentication for access to health data;
• Role-based access management (patient, healthcare professional, administrative staff), limiting access to the only authorised persons with a need to know;
• Logging and traceability of access to medical records, enabling the detection of any abnormal or unauthorised access;
• Regular security audits and an incident response plan, including the notification of any data breach in accordance with the applicable regulations.

7. Amendment of the Privacy Policy

7.1. Accessibility and right of amendment

This Policy is accessible at any time via a dedicated link at the bottom of the page of the DeePic website and application. The Company reserves the right to amend it, in particular to ensure its constant compliance with the evolution of applicable Tunisian and international legislation, or to reflect new features.

7.2. Notification and entry into force

Any substantial update affecting the rights of users or the processing of their health data will be subject to clear prior notice, by email or in-app notification, before its entry into force. For modifications specifically affecting the processing of health data, a new express consent may be sought where the law so requires.

8. Acceptance and express consent

Creating an account on DeePic requires reading and accepting this Policy. This acceptance, formalised by a dedicated tick box, constitutes express, free and informed consent to the processing of the personal data described in Article 4, to the exclusion of health data.

9. Definitions

• Platform (or DeePic): the HealthTech web application enabling the secure sharing of medical documents and health data, operated by STE Deepic;
• User: any natural or legal person having created an account on the Platform, whether a patient, a healthcare professional or a healthcare establishment;
• Personal data: any information relating to an identified or identifiable natural person;
• Health data: any information relating to the physical or mental state of health, past, present or future, of an identified or identifiable natural person, including the medical documents shared via the Platform;
• Healthcare professional: any natural or legal person legally authorised to practise a medical or paramedical profession and subject to an obligation of professional secrecy;
• Services: all the features of sharing, secure storage and access management of medical documents and health data offered by the Platform.