Privacy policy

1. Who is responsible for your data

Depending on the situation, either the medical practice or Nexum Technologies decides how data is used.

MedBot is a service of Nexum Technologies, a simplified joint-stock company, 28 boulevard National, 13001 Marseille, France (RCS Marseille 921 532 453). We process personal data in accordance with the General Data Protection Regulation (GDPR) and the French Data Protection Act.

Data of a practice’s patients. When a patient calls a practice equipped with MedBot, writes to it or receives a message from it, the practice (the practitioner or the practice entity) is the controller. Nexum Technologies acts as a processor, solely on its instructions, under the data processing agreement required by Article 28 GDPR.

Data of practitioners, staff and visitors. For MedBot Pro accounts, the business relationship with practices and visits to the website, Nexum Technologies is the controller.

Contact. contact@nexum-technologies.fr, or by post to Nexum Technologies, 28 boulevard National, 13001 Marseille, France. Data protection officer: [to be confirmed]; in the meantime, use the same address.

2. The data we process

Only what is needed to answer patients and keep the practice running.

Patients (on behalf of the practice)

• identity and contact details: surname, first name, phone number, and where the practice needs them for the appointment, date of birth or e-mail address;
• appointments: reason, practitioner, date and time, status (confirmed, moved, cancelled), practical information sent;
• calls: calling number, date, duration and, depending on the practice’s settings, the call recording and its transcript;
• voicemails: recording, transcript and the priority level assigned;
• messages exchanged on WhatsApp, by text message, by e-mail or in the connected chat;
• with the NexumPharma journey, at the patient’s request: sending their prescription to the pharmacy of their choice and tracking the delivery.

Where this information reveals a person’s health (reason for the visit, test requested, content of a message), it is health data within the meaning of Article 9 GDPR. It benefits from the protections described in sections 5 and 7.

Practitioners and practice staff

• MedBot Pro account data: name, work e-mail address, role, access rights;
• practice settings: opening hours, appointment reasons, booking rules, forwarding numbers;
• activity logs: sign-ins and actions taken (approving a message, calling a patient back), for security and traceability;
• subscription billing data: company name, address, payment method (handled by our payment provider, see section 6).

Website visitors

The marketing website asks for no data to be browsed. It sets no cookie, uses no analytics tool and loads no third-party script. The demo request form sends nothing for now: nothing you type into it is transmitted or stored. The technical logs of the website’s hosting server will be described here when the site goes live [to be confirmed].

3. Why we process it, and on what basis

Each use has a specific purpose and a legal basis.

• Answering patients’ calls and messages, managing appointments, sending confirmations, reminders and practical information: on behalf of the practice, which sets the legal basis (usually the provision of care and steps requested by the patient; Article 9(2)(h) GDPR for health data).
• Transcribing and sorting voicemails, preparing replies for approval: same purpose, on behalf of the practice.
• Recall campaigns and review requests: at the practice’s decision; the practice ensures their legal basis and respects the patient’s right to object.
• Providing MedBot Pro, managing accounts and security: performance of the contract with the practice and Nexum Technologies’ legitimate interest in securing the service.
• Billing the subscription: performance of the contract and accounting obligations.
• Improving the service: aggregated usage statistics, without identifying health data.

MedBot gives no medical advice and makes no medical decision: any health question is passed on to the practice team.

4. Who can access it

The practice, and only the people and providers who need it.

• The practice: authorised team members, through MedBot Pro, according to the rights the practice grants them.
• Nexum Technologies: team members who run, support and secure the service, only as far as necessary, with logged access.
• Processors listed by category in section 6.
• Third parties chosen by the patient or the practice: the practice’s calendar (for example Doctolib) when the practice connects it; the pharmacy chosen by the patient in the NexumPharma journey.

No data is sold, rented or used for advertising.

5. Health data: certified HDS hosting

Health data stays with a certified HDS host.

Health data processed by MedBot is hosted by a certified HDS host (Hébergeur de Données de Santé, the French health-data hosting certification), in accordance with Article L. 1111-8 of the French Public Health Code. Name of the host: [to be confirmed].

Access to this data is restricted to authorised people, authenticated and logged. Exchanges are encrypted in transit.

6. Processors

Specialised providers, chosen for their guarantees, under contract.

To provide the service, Nexum Technologies relies on the following categories of processors. Each is bound by a contract that includes the obligations of Article 28 GDPR. The list of named processors is provided to each practice with its contract, and the practice is informed of any change.

• Health-data hosting: certified HDS host.
• Telephony: telephony and SIP line operator routing calls to MedBot.
• Messaging: WhatsApp Business (Meta), text message and e-mail delivery providers.
• Transcription and language processing: speech recognition and artificial intelligence services used to understand requests and to transcribe and sort messages.
• Payment: payment provider for practices’ subscriptions (card, SEPA direct debit); it processes no patient data.
• Calendar connectors: calendars used by the practice, such as Doctolib, at the practice’s request.

Transfers outside the European Union. Where a processor handles data outside the European Union, the transfer is framed by the safeguards provided for by the GDPR, in particular the European Commission’s standard contractual clauses or an adequacy decision.

7. Security

Technical and organisational measures in proportion to the sensitivity of the data.

• certified HDS hosting for health data;
• encryption of exchanges in transit (HTTPS / TLS);
• named accounts, role-based access rights, logging of access and actions;
• secure configuration of lines and call forwarding;
• Nexum team access limited to what is strictly necessary, and logged;
• incident procedure: in the event of a data breach, the practice is informed within the time limits set by the data processing agreement, so it can notify the CNIL and, where required, the people concerned.

8. Retention periods

Nothing is kept longer than necessary.

• Patient data: periods agreed with each practice in the data processing agreement, according to its needs and obligations; at the end of the contract, the data is returned to the practice or deleted, as it chooses.
• Call recordings and transcripts, voicemails: period set with the practice [to be confirmed].
• MedBot Pro accounts: for the duration of the contract, then deleted.
• Security logs: limited period needed to secure the service [to be confirmed].
• Billing data: ten years, under accounting obligations (Article L. 123-22 of the French Commercial Code).

9. Your rights

Access, rectification, erasure, restriction, objection, portability, instructions after death.

Under the conditions laid down by the GDPR, you have the following rights: access to your data, rectification, erasure, restriction of processing, objection, portability, and the right to set instructions regarding your data after your death.

You are a practice’s patient. Contact your practice first, as the controller. You can also write to contact@nexum-technologies.fr: we forward your request to the practice and help it respond.

You are a practitioner, a member of a practice or a visitor. Write to contact@nexum-technologies.fr or to Nexum Technologies, 28 boulevard National, 13001 Marseille, France. We reply within one month, which may be extended by two months for complex requests; proof of identity may be requested where there is reasonable doubt.

If, after contacting us, you believe your rights have not been respected, you can lodge a complaint with the CNIL, the French data protection authority (3 place de Fontenoy, TSA 80715, 75334 Paris Cedex 07, France, cnil.fr).

10. Updates to this policy

The date at the top of the page shows the latest version.

This policy may change, in particular when the website goes live and when new features are added. The date of the latest update appears at the top of the page; practices are informed of any significant change.