Privacy Policy & Data Security

Welcome to CorHexia. This policy explains how CorHexia SARL ("we", "us") handles data. For all Patient Health Information (PHI), CorHexia acts strictly as a Data Sub-Processor (Sous-traitant). The healthcare provider (your clinic or doctor) is the Data Controller. We process this data solely to provide the CorHexia Medical System to your healthcare provider.

To facilitate clinical operations, the platform processes: - Identity & Contact Information (Name, phone, email). - Medical Information (Diagnoses, prescriptions, allergies, session notes). - Financial Data (Billing and CNAM insurance details). - System Data (Audit logs for security and accountability).

Digital sovereignty is our priority. All platform data is hosted 100% locally on secure VPS clusters within the Republic of Tunisia. Data is protected via a Defense-in-Depth strategy, including At-Rest Encryption (LUKS), In-Transit Encryption (SSL/TLS), and enterprise-grade network defenses.

We enforce strict Role-Based Access Control (RBAC). Non-medical administrative staff cannot access clinical diagnosis notes or medical histories. Access to your medical file is strictly limited to authorized medical professionals using Multi-Factor Authentication (MFA).

The CorHexia mobile application may request access to your device's Camera or Photo Library for the sole purpose of uploading medical imagery to a patient's file via QR code. Images captured via the app are held in temporary memory and are permanently purged within 12 hours if not explicitly saved to the encrypted patient record.

Because your healthcare provider is the legal Data Controller, any requests to view, modify, or delete your medical data must be directed to them. CorHexia provides the technical tools for clinics to securely delete patient records upon request. We do not sell, share, or broker your data to any third parties.

The CorHexia platform allows users to manage medical profiles for their minor children or dependents. By creating a profile for a minor, you represent that you are the legal guardian and consent to the processing of their health data under the same strict security standards outlined in this policy.

To ensure platform stability, we may collect strictly necessary, anonymized technical data (such as crash reports and device types). We do not use third-party advertising trackers or sell analytics data.

We may update this Privacy Policy periodically to reflect technical or legal changes. The 'Last Updated' date at the top will reflect the most recent version. Continued use of the platform constitutes acceptance of any changes.

CorHexia SARL operates in accordance with the Tunisian Organic Law No. 2004-63 on the protection of personal data. For technical privacy inquiries, contact us at contact@corhexia.com.