Courtesy translation — the French version prevails.
1. Data controller
1.1. Nexum Technologies, a société par actions simplifiée whose registered office is at 28 boulevard National, 13001 Marseille, France, acts as the controller of the personal data collected on this website and in the course of the commercial relationship with pharmacies. We collect and process your information in accordance with the General Data Protection Regulation (GDPR) and the French Data Protection Act (loi Informatique et Libertés).
1.2. For customers’ health data processed by the Nexum services (uploaded documents, calls to the voice assistant), the customer pharmacy is the data controller and Nexum Technologies acts as processor, under the contract concluded with it.
1.3. Contact: contact@nexum-technologies.fr. Data protection officer: Imri Balourd, reachable at the same address (subject “DPO”) or by post at the registered office.
2. Data collected and purposes
2.1. On the website: the data entered in the demo, contact and subscription forms (name, e-mail, telephone, pharmacy, département, pharmacy management software, number of counters, SIREN, pharmacy identifier, address), in order to respond to your request, prepare set-up and manage the commercial relationship.
2.2. In the services: account information, usage data and the technical information needed to provide, maintain and improve the services. We use your data solely to provide our services and never share it with third parties for commercial purposes without your explicit consent.
2.3. Health data: documents sent by customers and, where applicable, call recordings and transcriptions are processed on behalf of the pharmacy, hosted in France by OVHcloud (OVH GROUPE), on HDS servers, kept in separate storage, with restricted and time-stamped access. Call recording is an option that each pharmacy switches on or off; when it is on, an information message is played at the start of every call, before any recording. Recordings are kept for ninety days, then deleted. They can be consulted only by authorised members of the pharmacy’s team, from Nexum Pro. Where their content relates to health, they are treated as health data.
2.4. Connection to the pharmacy management software: when the pharmacy activates the stock connection, an agent installed on a workstation in the pharmacy reads the stock, prices and catalogue from its management software. This reading covers neither patient records, nor the pharmaceutical record, nor the dispensing history. It is carried out on the basis of the access mandate signed by the pharmacy owner, who remains the data controller for the pharmacy’s data; Nexum Technologies acts as a processor within the meaning of Article 28 GDPR. The names of the management software mentioned belong to their respective owners.
2.5. Job applications: the information sent by applicants (name, contact details, portfolio link, availability, location and message) is processed in order to review the application, on the basis of Nexum Technologies’ legitimate interest in recruiting and of pre-contractual steps taken at the applicant’s request. It is kept for two years after the last contact, unless deletion is requested earlier.
2.6. Couriers: the information sent by people wishing to carry out deliveries (name, telephone number, city, vehicle, status) is processed in order to review the request and to arrange introductions to pharmacies. It is kept for three years after the last contact.
2.7. The pharmacy’s WhatsApp messaging: a pharmacy may connect its own WhatsApp Business number to the Nexum services through Meta’s official connection (Embedded Signup, in coexistence mode: the pharmacy keeps the WhatsApp Business app on its phone). The services then receive messages from its patients and reply to them on its behalf, on its own line.
- Roles. For messages exchanged between the pharmacy and its patients, the pharmacy is the data controller and Nexum Technologies acts as processor, as in Article 1.2. Meta Platforms Ireland Ltd provides the messaging service (WhatsApp Business Platform).
- Data processed. The patient’s WhatsApp number and profile name; the content of messages (text, attachments, location if the patient shares it); delivery and read statuses; message templates and the information of the pharmacy’s WhatsApp Business account.
- Purposes. Replying to patients on behalf of the pharmacy: follow-up of orders and reservations, product availability, pickup reminders, routine questions. Anything that falls within pharmaceutical advice is passed on to the pharmacist, who may also reply in person. The assistant gives no medical advice.
- No other use. This data is used solely for this service. It is neither resold nor used for advertising purposes, and is not used to train artificial intelligence models.
- Retention. Messages are kept for the period set by the pharmacy, as data controller, and failing that for twelve months after the last exchange in the conversation, then deleted: they are kept only as long as the service requires, in line with the storage-limitation principle (Article 5 GDPR).
- Disconnection. The pharmacy may disconnect its number at any time. Nexum Technologies then immediately stops accessing its messages; the data is returned to the pharmacy or deleted, according to its contract, in accordance with Article 28 GDPR.
- Your rights. Patients exercise their rights with their pharmacy, as data controller, or by writing to contact@nexum-technologies.fr, which forwards the request to the pharmacy.
- WhatsApp rules. The use of WhatsApp is also subject to Meta’s rules: WhatsApp Business Policy and WhatsApp Privacy Policy (European Economic Area).
3. Retention and updating
3.1. We keep your personal data for as long as your account is active. When you delete your account, your personal data is deleted from our servers within 30 days, with the exception of data we are required by law to retain: accounting records and invoices (ten years, Article L. 123-22 of the French Commercial Code), data required for tax purposes, and material needed to establish or defend a legal claim. Such data is then archived with restricted access and is not used for any other purpose. Prospect data is kept for three years from the last contact. Health data processed on behalf of a pharmacy is kept for the period set by that pharmacy, as data controller; at the end of the contract it is returned to the pharmacy or deleted, in accordance with Article 28 GDPR.
3.2. You have the right to view, amend or update your personal information at any time by writing to us at contact@nexum-technologies.fr. We will handle your request as soon as possible.
4. Recipients, processors and transfers
4.1. Nexum Technologies does not sell, rent or share your personal data with third parties for marketing purposes without your explicit consent. We may share your information only to provide our services, comply with our legal obligations or protect our rights.
4.2. We work with providers (hosting, telephony, payment, support) who access data only in the course of their services and under strict confidentiality agreements. Their categories appear on the Processors page; the named list, with their role and country, is provided to each client pharmacy with the processing agreement required by article 28 of the GDPR.
4.3. Some data may be transferred outside the European Union; in that case, appropriate safeguards (standard contractual clauses) are put in place.
5. Data security
5.1. Nexum Technologies implements appropriate technical and organisational measures: encryption of data in transit and at rest, strict access controls, access logging, regular security audits and continuous monitoring of our systems. Our team is trained in data protection best practices and bound by strict confidentiality obligations.
5.2. In the event of a data breach likely to affect your rights and freedoms, we will inform you without undue delay, in accordance with Article 34 GDPR, and will notify the CNIL within the 72 hours provided for by Article 33; we will provide recommendations to protect your information. As no method of transmission or storage is entirely secure, we cannot guarantee absolute security.
6. Your rights
6.1. In accordance with the GDPR, you have the right of access, rectification, erasure, restriction, objection and portability of your data. To exercise them, contact us at the address given in Article 1 with proof of identity for verification; we will reply within one month at most.
6.2. If you consider that your rights are not being respected, you may lodge a complaint with the CNIL (the French data protection authority).
7. Deleting your data
7.1. You are a patient of a pharmacy: write to your pharmacy, as data controller, or to contact@nexum-technologies.fr, stating the pharmacy concerned and the telephone number used. The request is forwarded to the pharmacy and handled within one month at most.
7.2. You are a customer pharmacy: disconnect your WhatsApp number or close your account from Nexum Pro, or write to contact@nexum-technologies.fr. Your data is deleted within thirty days, or returned if your contract so provides, subject to the data that the law requires to be kept (Article 3.1).
7.3. You filled in a form on the website (demo, contact, job application, delivery): write to contact@nexum-technologies.fr; the data is deleted within one month at most.
8. Changes to this policy
8.1. We may update this policy to reflect changes in our practices or in the regulations. Any significant change will be notified to you by e-mail; the most recent version is always available on this page, with its date.