Privacy Notice & Data Protection Policy
Transparency notice regarding personal and health data processing under Algerian Law
This notice documents the technical and organizational safeguards implemented by AAFIYA under Algerian Law 18-07 (as amended by Law 25-11) and Public Health Law 18-11. It provides operational transparency pending formal administrative certification by the National Authority (ANPDP).
1. Governance Roles (Article 32 of Law 18-07)
The platform infrastructure is provided by AAFIYA as a technical software provider (SaaS).
Licensed healthcare practitioners and medical centers act as Controllers for clinical data. AAFIYA acts as a technical Processor bound by strict confidentiality and professional medical secrecy (Law 18-07 Art. 41 and Health Law 18-11 Art. 67).
2. Data Categories & Lawful Bases
Identity & Credentials: Name, phone, email, professional license. Purpose: Account administration (Basis: Contractual necessity).
Health & Clinical Data: Medical records, diagnostic fulfilled orders, prescriptions administered under clinical supervision (Basis: Law 18-07 Art. 9 healthcare exemption & medical secrecy).
Voluntary Sharing: EMR views generated via patient share tokens (Basis: Explicit, revocable patient consent).
3. Technical Safeguards (Article 40 of Law 18-07)
End-to-end transport security (TLS) and AES-256-CBC backup encryption with PBKDF2 derived keys.
Mandatory PIN verification on external share links with automated lockout telemetry.
Immutable append-only audit trail logging for administrative and public access events in accordance with Law 25-11 requirements.
4. Data Retention Principles
Account credentials persist while active. Upon account deletion, personal identity identifiers are expunged while evidentiary consent and transaction audit trails are retained per statutory requirements.
5. Data Subject Rights & Contact
Under Articles 34 and 35 of Law 18-07, individuals have the right to access, rectify, and object to processing. Requests can be submitted via the account console or via privacy@aafiya.dz.