Privacy Policy

Digital Era Solutions SARL, a limited liability company under Moroccan law, with share capital of MAD 100,000. Registered office: Résidence Al Aziza, Boulevard Royaume Arabie Saoudite, 3rd floor No. 20, Tangier, Morocco. Trade Register (RC) Tangier No. 107627 · IF No. 45953907 · ICE No. 002594794000073. (“Calendify”, “we”). Data Protection Officer: privacy@calendify.ma.

This Policy is governed first and foremost by Moroccan Law No. 09-08 on the protection of individuals with regard to the processing of personal data, and by the decisions and authorizations of the National Commission for the Control of Personal Data Protection (CNDP). For individuals located in the European Union, the General Data Protection Regulation (GDPR) applies in addition, where relevant.

Calendify is the controller for the account, booking, and billing data we collect to operate the Service. When you book with a Professional, that Professional is a separate, independent controller for the clinical and care data they collect about you; for that data, Calendify acts as a processor (we host and process it on their behalf and on their instructions).

For any question about your data, our Data Protection Officer is reachable at privacy@calendify.ma.

Account information

• First name, last name, email address, phone number.
• A hashed password (we never see or store your password in plain text).
• For Professionals: clinic name, address, city, profession, registration/authorization number, bio, profile photo.
• For Patients: city (optional) and national ID number (CIN) only where a Professional needs to link you to an in-person walk-in record. CIN processing is limited to this purpose and included in the scope declared to the CNDP.

Appointment and health data

• Bookings (date, time, service, status, completion notes), queue positions and wait estimates, reviews you post.
• Health data: the health-related information you or the Practitioner enter as part of a consultation (reason, clinical notes) constitutes sensitive data, processed under the conditions of Section 6.

AMO coverage (optional)

To pre-fill your CNSS or CNOPS care sheet, you, your doctor or their front desk may record your health-insurance scheme, your registration number (and affiliation number for CNOPS), your relationship to the insured person (yourself, spouse or child), the insured person's name and national ID number, and your address. This data is used only to print the care sheet. It is available to you and to the doctors, and their front desk, you have an appointment with; every time a professional views it, the access is logged. You can change or delete it at any time from your profile.

Technical data

• Device type, operating system, browser, app version; push-notification tokens, so we can send you queue updates and reminders.

Payment data

• For Professionals: your billing details (business name, ICE, IF, address), your invoices and their payment status, and the history of card payments (amount, status, date, references from our Payment Service Provider). Card data is entered and processed directly by our Payment Service Provider, Payzone; Calendify never collects or stores your card number (see Section 8).

• Run the Service: authenticate you, show your appointments, send reminders, show your queue position, and let Professionals pay their Calendify invoices.
• Communicate with you: account emails, booking confirmations, changes to our Terms, and — only if you opt in — product news.
• Improve the Service: aggregated, anonymized statistics on feature usage.
• Keep things safe: detect fraud, spam, abuse, and unauthorized access.
• Meet legal obligations: retain billing records, respond to lawful requests, and comply with tax, accounting, and data-protection law.

Under Law 09-08 (and the GDPR where it applies), we rely on:

• Performance of the contract: for data needed to provide the Service (create bookings, send reminders, enable payment).
• Legitimate interest: security, fraud prevention, and Service improvement, balanced against your rights and freedoms.
• Consent: for optional marketing communications and, where required, certain analytics.
• Legal obligation: retention of fiscal and billing records, and responses to valid requests from authorities.

For health data (sensitive data), the legal basis is your explicit consent and/or the provision of medical care by a healthcare professional bound by professional secrecy, under the conditions of Section 6.

Data relating to your health is sensitive data within the meaning of Law 09-08. Its processing by Calendify is subject to a prior authorization, which is currently under review by the CNDP. This data is processed only to enable booking, the performance of the consultation by the Practitioner, and the resulting follow-up.

The Practitioner is the controller for the health data collected in the course of care; Calendify acts as a technical processor, on their instructions, and applies enhanced security measures (Section 11). Access to this data is strictly limited to the Patient concerned, the Practitioner they consulted, and, where applicable, the staff authorized by that Practitioner.

We never sell your data. We share it strictly with:

• Your Professional: they access the information needed to provide the service (name, contact details, appointment history, and what you share).
• Clinic staff: if the Professional has granted them access, within the same limits.
• Our service providers: infrastructure partners processing data on our instructions, currently Supabase (database and authentication), Apple / Google (push notifications), a transactional email provider, and Payzone (Vantage Payment Systems), our Payment Service Provider, for card payments (see Section 8). Each is bound by a written data-processing agreement.
• Authorities: only where the law requires it (subpoena, court order, or request from authorities under Law 09-08 or the CNDP).

Professionals may pay their Calendify invoices by card through a payment service provider licensed in Morocco, Payzone (Vantage Payment Systems). Card data is entered on Payzone’s secure payment page, and Payzone acts as controller for that data; Calendify does not collect, see, or store your card number. If you turn on automatic payment, your card is saved by Payzone, not by Calendify. Calendify keeps only what is needed to track payments and for billing: the amount, status, date and invoice concerned, Payzone’s references, the card type (for example Visa) and, if you turn on automatic payment, Payzone’s reference for the saved card and your consent (its wording and language, when it was given and by whom). Processing by Payzone is governed by its own privacy policy.

Some data is hosted in data centers located in the European Union (see Section 10). The transfer authorization required for this transfer outside Morocco, to a country ensuring an adequate level of protection, is currently under review by the CNDP. Other occasional transfers (for example push notifications routed through Apple’s or Google’s global infrastructure) rely on appropriate safeguards. No data is transferred outside Morocco without the legal basis required by Law 09-08.

Personal data is stored on managed database infrastructure operated by Supabase, in data centers located in the European Union, under the transfer conditions of Section 9.

• Encryption in transit: all traffic is served over HTTPS (TLS 1.2+).
• Encryption at rest: the database is encrypted at rest using AES-256.
• Row-level security: every table enforces access rules at the database layer, so a user only sees the data they are authorized to see.
• Password hashing: passwords are hashed (bcrypt); we never see the originals.
• IP hashing: we never store raw IP addresses, only a salted SHA-256 hash.
• Least-privilege access: only a small number of staff can access production data, with logged and audited access.

• Account data: as long as your account is active, plus 30 days after closure (to allow reactivation).
• Appointment data: kept while your relationship with the Professional is active; after closure, the Professional may be required to retain clinical records longer, independently of Calendify.
• Billing and invoices: kept for 10 years, as required by Moroccan accounting law.
• Analytics events: up to 24 months, in anonymized form.
• Backups: Calendify keeps no backup copies, so deleted data does not remain in a backup.

Under Law 09-08 (and the GDPR where it applies), you have the rights of access, rectification, erasure (subject to legal retention obligations), portability, restriction, and objection, as well as the right to withdraw your consent at any time. To exercise them, email privacy@calendify.ma from the address associated with your account; we respond within 30 days.

You may also lodge a complaint with the CNDP, or with your local supervisory authority if you are in the EU.

We have measures in place to detect, contain, and address any data breach. In the event of a breach likely to affect your rights, we undertake to notify the CNDP and the individuals concerned as soon as possible, and to describe the measures taken to address it.

The Service is reserved for adults (18 years). Appointments for a minor are booked and managed by their legal representative, from that representative’s account, who is responsible for the information shared on the minor’s behalf. We do not knowingly collect data about a minor outside this framework.

• Session cookies: to keep you logged in.
• Preference storage: language, sidebar state, and other interface preferences.
• Anonymous session ID: a random identifier stored in your browser, used to stitch analytics events from the same session together; it contains no identifying information.

We do not use third-party advertising cookies and do not track you across other sites. For details, see our Cookies page.

Product analytics events are recorded in our own infrastructure (hosted on Supabase, in the EU) and are not sent to third parties such as Google Analytics or Facebook. They contain the event name, a few properties, the anonymous session ID, a coarse geo hint (country), and a hashed IP. To be excluded from analytics entirely, email privacy@calendify.ma.

We update this Policy when our practices or regulations change. When we do, we update the date at the top of the page and, for material changes, notify you by email or in-app. Continuing to use the Service after a change takes effect constitutes acceptance.

For any question, concern, or request to exercise your rights:

• Data protection / DPO: privacy@calendify.ma
• Security: security@calendify.ma
• General questions: hello@calendify.ma