Privacy policy

This privacy policy describes how SOS Nursing Marrakech collects, uses, stores and protects the personal and health data of users of its online platform and home nursing services.

By accessing our platform or using our services, you acknowledge that you have read this policy. If you do not accept these terms, please do not use our services.

The data controller is SOS Nursing Marrakech, a limited liability company (SARL) being registered with the Marrakech Trade Register, with its registered office in the Marrakech-Safi region, Kingdom of Morocco.

The company's director acts as data controller within the meaning of Article 1 of Law 09-08. They ensure compliance with legal obligations regarding the protection of personal data.

In the course of our services, we collect the following categories of data: identification data (name, date of birth, CIN or passport number), contact details (postal address, telephone number, email address, WhatsApp identifier), health data (medical history, allergies, vital signs, medical prescriptions, nursing care reports), and billing data (amounts, payment methods, transaction history).

Health data constitutes sensitive data within the meaning of Article 1 of Law 09-08. It is subject to enhanced protective measures and is only processed to the extent strictly necessary for the provision of care.

Your data is processed for the following purposes: managing and coordinating home nursing care, managing your patient file and clinical follow-up, billing and collection, communication regarding appointments and care follow-up, compliance with our legal and regulatory obligations, and the continuous improvement of our services.

No data is used for commercial prospecting, profiling or automated decision-making having legal effects on the individuals concerned.

The processing of your data is based on the following legal grounds: performance of the care service contract (Article 7 of Law 09-08), the vital interest of the patient and the necessity of care for health data (Article 12 of Law 09-08), compliance with legal obligations (retention of medical records, tax obligations), and your explicit consent where required by law.

You may withdraw your consent at any time, without affecting the lawfulness of processing based on consent given before the withdrawal.

SOS Nursing Marrakech uses WhatsApp Business and telephone as communication channels with patients and their families for scheduling appointments, confirming visits and sharing follow-up information.

No sensitive medical data (test results, diagnoses, prescriptions) is transmitted via WhatsApp without the explicit consent of the patient or their legal representative. WhatsApp exchanges are end-to-end encrypted by the Signal protocol integrated into the WhatsApp platform.

You may request at any time that our communications be conducted exclusively by telephone or in person.

Our website uses cookies strictly necessary for the operation of the platform (session, language preference, authentication). No advertising or profiling cookies are used.

We use an anonymised audience analytics tool that collects no personally identifiable data and places no tracking cookies on your device.

Your personal data is never sold, rented or transferred to third parties for commercial purposes.

It may be shared with: healthcare professionals involved in your care (nurses, treating physicians at your request), our technical sub-processors (hosting, online payment) bound by contractual confidentiality obligations of equivalent level, and competent authorities where required by law (health inspections, tax obligations).

Each sub-processor is selected for its level of data protection compliance and is bound by a sub-processing agreement in accordance with Article 21 of Law 09-08.

The SOS Nursing data infrastructure is hosted in the European Union, providing a level of protection in compliance with the GDPR.

In the event of data transfers to a third country, we ensure that appropriate safeguards are in place in accordance with Article 44 of Law 09-08, including the adoption of standard contractual clauses or the use of certified providers.

Data is hosted on servers located in the European Union, ISO 27001 certified and compliant with the most stringent security standards in the healthcare sector.

We implement the following security measures: encryption of data at rest (AES-256) and in transit (TLS 1.3), role-based access control (RBAC) with strong authentication, logging and auditing of health data access, regular encrypted backups with a business continuity plan, and periodic penetration testing.

In the event of a data breach likely to pose a risk to your rights and freedoms, we will notify you as soon as possible in accordance with Law 09-08.

Clinical data and the nursing care file are retained for 20 years from the last service, in compliance with Moroccan regulations on medical records.

Billing data is retained for 10 years in accordance with Moroccan accounting and tax obligations. Contact data is retained for the duration of the contractual relationship, then archived for 3 years for complaint management.

Upon expiry of the retention periods, data is securely deleted or irreversibly anonymised.

In accordance with Law 09-08 and the GDPR, you have the following rights over your personal data:

Right of access: to obtain confirmation that your data is being processed and to receive a copy. Right of rectification: to have any inaccurate or incomplete data corrected. Right to object: to object to the processing of your data on legitimate grounds. Right to erasure: to request the deletion of your data, subject to legal retention obligations. Right to restriction: to restrict processing in the cases provided for by law. Right to portability: to receive your data in a structured, machine-readable format.

To exercise these rights, send your request by post or email to the SOS Nursing Marrakech coordinator (contact details on the Contact page), enclosing a copy of an identity document. We undertake to respond within a maximum of 30 days.

All SOS Nursing Marrakech staff — nurses, coordinators and administrative personnel — are bound by medical professional secrecy in accordance with the Moroccan Nurses' Code of Ethics and the provisions of the Moroccan Penal Code (Articles 446 et seq.).

Access to health data is strictly limited to healthcare professionals directly involved in your care. Every access is logged and auditable.

In accordance with Law 09-08, the processing of personal data carried out by SOS Nursing Marrakech will be declared to the National Commission for the Control of the Protection of Personal Data (CNDP) prior to the platform's commercial launch.

The CNDP declaration number will be published on this page as soon as it is obtained. In the event of a complaint, you may also contact the CNDP directly (www.cndp.ma).

SOS Nursing Marrakech reserves the right to modify this privacy policy in order to adapt it to legal, regulatory or technical developments. Any substantial change will be brought to your attention by notification on the platform.

The date of the last update appears at the top of this document. We encourage you to consult this page regularly.

For any question regarding the protection of your personal data, you can contact the SOS Nursing Marrakech data protection officer via the contact details on our Contact page or by post to the registered office address.