Privacy
Medhexia Privacy Policy
Medhexia lets you find a clinic, book appointments for yourself and your family, and see the documents your clinics share with you. This policy explains what data we process to do that, who we share it with and how to exercise your rights. It applies to the Medhexia mobile app and the medhexia.tn website.
Last updated: October 1, 2026
1. Who is responsible for your data
Medhexia is published by SOCIETE CorHexia, a company based in Tunisia (“CorHexia”). CorHexia is the controller of the data tied to your Medhexia account: your account, the profiles you create, the medical information you enter and your appointment requests.
When you book an appointment, the clinic you choose becomes responsible for the information it receives and for the record it keeps about you (visits, prescriptions, invoices…). For that record, CorHexia acts only as the clinic's technical provider, so requests about it should go to the clinic.
2. The data we collect
- Account: first name, last name, date of birth, email address, phone number and password. Your password, and your PIN if you set one, are only stored hashed, never in plain text.
- Family profiles (up to 5 profiles in total): name, date of birth, sex and relationship, plus profession, national ID number and address if you fill them in.
- Medical information, optional: allergies, current treatments, medical and surgical history, autoimmune diseases, smoking, alcohol, pregnancy, clotting disorders and cold sores.
- Appointments: clinic, chosen treatments, date and time, and your appointment history.
- Documents shared by your clinics: visits, prescriptions, notes and care instructions, glasses or contact lens prescriptions, photos and invoices that the clinic chooses to share with you. The clinic creates them; Medhexia displays them.
- Location: only when you tap “Near me” or the map, and only if you allow it. Your position is sent to our server to work out how far away clinics are, and is not stored.
- Notifications: your device's notification token, if you turn notifications on.
- Verification: the codes sent by SMS or email to confirm your phone number or email address. They expire after 10 minutes.
- Technical data: like any online service, our servers receive technical information (IP address, device type, app version) needed to run and secure the service.
The camera is only used to scan the QR code when a profile is transferred, and the clipboard is only read when you tap “Paste”. Face ID and fingerprints are checked by your phone: we never receive your biometric data. The app contains no advertising and no analytics or tracking tools.
3. Why we use it
- To create and secure your account, and verify your phone number and email address.
- To find records that clinics using Corhexia already keep in your name, by matching your verified phone number and date of birth. A record only appears in your account once the link is verified.
- To let you search for clinics and book appointments for yourself or your family.
- To send the clinic the information it needs to see you.
- To send you appointment confirmations, reminders and changes by notification, SMS or email.
- To show you the documents your clinics share with you.
- To let you transfer a profile to the person it belongs to.
- To prevent abuse and fraud, keep the service secure and meet our legal obligations.
5. Hosting and transfers outside Tunisia
Our servers, which hold the database, documents and website, are located in Tunisia. Some providers (Twilio, Resend, Expo, Apple, Google) process data outside Tunisia, in particular in the United States, only to deliver their service: sending an SMS, an email or a notification. We only send them what is needed: for example, our push notifications contain neither your name nor your appointment details.
6. How long we keep it
We keep your data for as long as your account exists. Verification codes expire after 10 minutes and are masked once sent, and your location is never stored.
After a verified deletion request, within 30 days we delete:
- your account and login details;
- your personal information and that of your family profiles, including the medical information entered in the app;
- the links between your account and clinic records;
- your notification tokens and preferences.
What we keep:
- records held by clinics, including the copy sent when you booked and your appointment and reminder history: clinics are responsible for them and must keep them under Tunisian regulations, so contact them to exercise your rights over these records;
- technical and security logs, including the history of SMS and emails sent (without codes) and a record of your deletion request, for up to 12 months, to prevent fraud and show the request was handled;
- copies in encrypted backups, erased within 90 days of the deletion.
You can also delete a single family profile in the app without closing your account.
7. How we protect it
- Communication between the app, the website and our servers is encrypted (HTTPS/TLS).
- Our servers are hosted in Tunisia on encrypted disks, and backed up daily in encrypted form.
- Passwords and PINs are only stored hashed.
- Strict access rules apply: your medical information is visible only to you, and to a clinic only when you book there.
- Photos and invoices open through temporary links that expire.
- You can lock the app with a PIN, Face ID or your fingerprint.
8. Your rights
Under Tunisian Organic Law No. 2004-63 of 27 July 2004 on the protection of personal data, you can:
- access and correct your data, mostly directly in the app (profiles, Settings);
- delete your medical information, a profile or your whole account;
- withdraw your consent at any time, for example by turning off notifications or location access;
- get a copy of your data or object to its processing, by writing to us.
To delete your account, use Settings → Delete my account in the app, or the page below. You can also file a complaint with Tunisia's National Authority for the Protection of Personal Data (INPDP).
9. Children and family members
Medhexia accounts are meant for adults. You can manage the profile of a child or relative in your care: by creating it, you confirm that you are their legal guardian or are acting with their agreement. A profile can later be transferred to the person it belongs to, for example when a child comes of age and creates their own account.
11. Changes to this policy
We may update this policy as the service or the law changes. The date at the top of this page shows the current version. If we make an important change, we will let you know in the app or by email.
12. Contact us
For any question about this policy or your data, write to SOCIETE CorHexia: