Privacy policy

The controller of personal data is AivenNetwork, publisher of Sahha.ma. A processing register is kept in accordance with Moroccan Law 09-08 on the protection of natural persons regarding the processing of personal data, under the supervision of the CNDP.

We collect only the data strictly required to provide the service:

• Identity: first name, last name, date of birth, gender (optional)
• Contact: email, phone, city
• Health (if you choose to share it): booking data, reasons for consultation, prescriptions
• Usage: pages visited, favourites, preferences
• Technical: IP address, user-agent, strictly necessary cookies

Data is used to:

• Provide the services (booking, teleconsultation, health tools)
• Improve the user experience
• Send appointment confirmations and reminders by SMS, email or WhatsApp (with consent)
• Publish the weekly health newsletter (explicit opt-in)
• Combat fraud and ensure security
• Anonymised statistical analyses

Health data is subject to an enhanced level of protection. It is accessible only to healthcare professionals involved in your care and to authorised Sahha teams.

No health data is sold, shared with advertisers or used for advertising targeting.

Sahha never targets advertising based on a condition, treatment or individual symptomatology.

Account data: kept while the account is active, then for 3 years after the last login.

Booking data: 5 years.

Medical data: 10 years, unless a deletion request is made or a longer legal retention obligation applies.

Technical logs: 12 months.

Under Law 09-08, you have the following rights:

• Right of access to your data
• Right of rectification
• Right to erasure (subject to retention obligations)
• Right to object
• Right to portability
• Right to define post-mortem instructions

To exercise these rights, contact [email protected]. A claim may be filed with the CNDP.

Sahha uses only strictly necessary cookies (session, language preferences, Sahha Consult cart) and anonymised analytics cookies via Plausible.

We do not use intrusive third-party advertising cookies. See our dedicated cookies page for further details.

Data is encrypted in transit (HTTPS) and at rest. Passwords are hashed (bcrypt). Access to sensitive data is logged and limited to authorised staff.

Some processors (hosting, email delivery) are based in the European Union (Hetzner, Resend). All comply with GDPR and provide a level of protection at least equivalent to that required by Law 09-08.

For any question regarding privacy: [email protected]

CNDP compliance officer: [email protected]