Privacy Policy

Nafsia Clinic respects your privacy. This policy explains what data we collect, why we use it, who we may share it with, and how you can exercise your rights.

This policy applies to the website, mobile app, and platform dashboards connected to Nafsia Clinic services.

The controller of your data is EURL Nafsia Clinic, a single-member limited liability company registered in Algeria, Quartier Salem, Route de l'Aéroport, BP 350, Office No. 04, Béchar, Algeria, Trade Register No. 23B0943323, Tax ID (NIF) 002308094332307.

We process your personal data in accordance with Algerian Law No. 18-07 of 10 June 2018 on the protection of natural persons in the processing of personal data, as amended and supplemented by Law No. 25-11 of 24 July 2025.

Depending on your account type and use of the platform, we may collect:

• Account data: name or display name, phone number, email, hashed password, language, country, and account status • Booking and session data: specialist, appointment time, session status, join times, duration, invoices, and payment status • Reviews: stars and an optional comment you write after the session • Payment data: amount, currency, payment method, order or reference number, and payment proof when needed • Platform communication data: messages, notes, and files shared through platform communication features • Specialist data: professional profile, documents, experience, specialties, languages, and payout information • Technical and operational data: device, IP address, technical logs, errors, and analytics data needed to improve the service

We use data to:

• Create, verify, and protect accounts • Enable booking, payment, sessions, rescheduling, cancellation, and support • Connect clients with specialists and show information needed for booking • Send account, session, and payment notifications • Prevent fraud, handle disputes, and protect users and the platform • Improve the service, fix issues, and understand usage in aggregate • Meet legal, accounting, and tax obligations

We do not sell your data to third parties.

We process data only when needed to provide the service you requested, perform the platform terms, meet legal or accounting obligations, protect users and the platform, or based on your consent when consent is required.

Because of the nature of the service, some booking data, messages, or files you choose to share may reveal sensitive or mental-health-related information. We process that data only to the extent needed for service delivery, account management, support, safety, billing, or dispute handling.

By creating your account and accepting this policy, you give your explicit consent to the processing of this data, including health-related data, for these purposes only, under Articles 7 and 18 of Law No. 18-07. You can withdraw your consent at any time by requesting deletion of your account; this ends the service and does not affect processing carried out before the withdrawal.

Nafsia Clinic is not an emergency service. If there is an immediate risk of harm to self or others, contact local emergency services immediately.

Nafsia Clinic does not record or listen to video session content.

Sessions use a secure encrypted video connection through the platform. We keep operational data such as appointment time, status, and join data needed for booking, billing, support, and dispute handling.

Specialists are bound by professional confidentiality, subject to limited legal exceptions such as risk of harm to self or others, a binding legal request, or a minor at risk of abuse.

We share data only when needed and only to the necessary extent:

• With specialists: booking and communication information needed to provide the session • With visitors of the specialist's page: your review under your short name, after you confirm publishing it • With payment providers: information needed to process or verify payment, such as CIB or Edahabia card payment through the SATIM gateway, PayPal Checkout, Baridi Mob, CCP transfer, or bank deposit depending on what is available inside the app • With technical infrastructure providers: such as server hosting, video connection, storage, email, SMS, and notifications • With analytics and error-reporting providers: to measure usage, detect crashes, and improve the app while minimizing data where possible • With support staff: to handle requests, technical issues, disputes, or rights requests • With authorities or legal parties: only when legally required or necessary to protect rights and safety

PayPal and Microsoft (Clarity) use the data they receive under their own privacy policies, as independent controllers: • PayPal: https://www.paypal.com/myaccount/privacy/privacyhub • Microsoft: https://www.microsoft.com/privacy/privacystatement

We use appropriate security measures, including:

• HTTPS/TLS encrypted connections • Encryption of sensitive personal data in the database where needed • Passwords stored as hashes, not plain text • Role-based and need-based access controls • Operational logs for audit and security • Deletion or hiding of sensitive files on account deletion according to the deletion policy

No digital service can guarantee absolute security, but we work to reduce risk and protect data appropriately for the nature of the service.

We keep data only as long as needed to provide the service, comply with law, maintain accounting records, protect security, or handle disputes.

The periods we apply:

• Your account: until you delete it • Session history: 5 years after the account is deleted, for billing and disputes • Invoices, payments and accounting records: 10 years • Specialist contracts and documents: 5 years after the contract ends • Notes between sessions: 2 years • Support messages and call notes: 2 years • Server logs: 1 year • Backups: replaced within 7 days • Measurement tools: according to each tool's own settings

Notes between sessions, support messages, call notes and server logs are deleted automatically when their period ends.

When an account is deleted, not every record is immediately erased if it is linked to legal or financial obligations. Instead, personal data is hidden, anonymized, or nullified where possible, while necessary records such as invoices, payments, session history, and contracts may be retained when legally or operationally required.

See the Account and Data Deletion page for more detail about what is deleted, anonymized, or retained.

Users under 18 cannot create an account or book by themselves.

If the beneficiary is a minor, the booking must be made by the guardian, and the guardian must be present at the start of the session. We may request additional information to assess suitability and protect the minor.

We use a small number of cookies and similar tools.

Necessary, always on:

• Login and secure sessions • Your language, basic preferences and your choice on the consent banner

Measurement, only with your consent:

On the website, we ask for your choice on your first visit. Google Analytics and Microsoft Clarity work only if you click Accept. If you click Refuse, they do not work, and the service stays fully available.

In the app, Firebase Analytics and Microsoft Clarity are on, and you can turn them off at any time in "My personal data".

These tools receive neither your name, nor your phone number, nor any information about your health.

To change your choice or withdraw your consent on the website, click "Manage cookies" at the bottom of the page. You can also write to contact@nafsiaclinic.com

The platform's servers and database are hosted by OVH in France. Some data is also processed outside Algeria when needed for services such as PayPal Checkout, app stores, notifications, analytics, crash reporting, email, or technical infrastructure.

When data is transferred, we use the safeguards available to us, such as encryption, data minimization, access limits, and provider service agreements. We do not claim any special regulatory approval or authorization unless it has been officially obtained and clearly published.

By creating your account, you explicitly agree that your data may be hosted or processed by these providers, including outside Algeria, under Article 45 of Law No. 18-07.

You may request:

• Access to your data • Correction of inaccurate data • Account deletion or anonymization of your data, subject to legal and operational limits • Objection to certain types of processing • Withdrawal of consent for marketing messages

These rights are granted by Articles 32 (information), 34 (access), 35 (rectification), and 36 (objection) of Law No. 18-07.

For privacy rights requests: 📧 contact@nafsiaclinic.com

If you believe your rights have not been respected, you can file a complaint with the National Authority for the Protection of Personal Data (ANPDP): https://plaintes.anpdp.dz

We may update this policy when needed. The version published on the website and app is the applicable version.

For privacy questions: 📧 contact@nafsiaclinic.com