Privacy Policy — Tournée Facile

Last updated: 14/09/2026

1. Introduction

This Privacy Policy describes how Hakimon Solutions, a SAS with a share capital of €1000, located at 200 rue de la Croix Nivert, 75015 Paris, (hereinafter “We”) collects, uses, protects, and processes personal data when using the Tournée Facile application.

The application is intended exclusively for healthcare professionals. It involves the processing of health data, considered sensitive data under the General Data Protection Regulation (GDPR).

2. Who is responsible for what

Two processing activities coexist, and they do not have the same controller.

Your patients' data. You, the healthcare professional, are the controller: you decide which patients to follow and what to record. Hakimon Solutions acts only as a processor, on your instructions, under the Data Processing Agreement (Article 28 GDPR).

Service data. User account, subscription, technical logs, support: Hakimon Solutions is the controller, and it is that data this policy describes.

2.1 Identity of the controller for the service

Hakimon Solutions — SAS
200 rue de la Croix Nivert, 75015 Paris
SIRET: 992 080 192 00014
GDPR / DPO Contact Email: simon@hakimon.com
Data Protection Officer: Simon DEFRETIN

3. Personal Data Collected

We only collect the data necessary for the functioning of the application.

3.1 User Account Data

First and last name
Email address
Phone number
Professional address
Professional identifiers (e.g., ADELI, RPPS)
Password (hashed and never stored in plain text)

3.2 Health Data (Sensitive Data)

Patient information used during rounds
Therapeutic notes or clinical observations
Medical documents or photos
Appointment and intervention information
Follow-up data (vital signs, symptoms, etc., depending on usage)

3.3 Technical Data

IP address
Technical logs
Application usage data
Cookies and trackers (see dedicated section)

3.4 Geolocation Data

Occasional geolocation for managing rounds
Route history when necessary for the app to function

3.5 Administrative Data

Billing data
Purchase or payment history

4. Purposes of Processing

The collected data is processed for:

Creating and managing the user account
Managing care rounds
Monitoring patient records
Internal messaging between professionals
Synchronizing data across devices
Hosting medical documents
Continuous improvement of the app (anonymized analytics)
Billing management and user support

5. Legal Basis for Processing

In accordance with the GDPR, processing is based on:

Article 6.1.b: performance of a contract (use of the application)
Article 6.1.c: compliance with legal obligations applicable to healthcare professionals
Article 9.2.h: processing of health data for healthcare and health system management purposes

6. Data Hosting and Security

6.1 Hosting

The website is hosted by OVHcloud (2 Rue Kellermann, 59100 Roubaix, France).

The application and its data are hosted in France by AZNETWORK (40 Rue André Ampère, 61000 Alençon, France) on HDS-certified (Health Data Hosting) infrastructure, in accordance with regulations applicable to health data.

6.2 Security Measures

We implement the following measures:

Encryption of data in transit (HTTPS/TLS 1.2+)
Encryption of data at rest (AES-256 or equivalent)
Automatic backup systems
Access control and role-based access management (RBAC)
Access logs and security audits
Incident management and notification procedures

7. Subcontractors and Third Parties

We rely on the following service providers. This list is the same as the one in the Terms of Use (§6.5) and in the Data Processing Agreement (§7).

7.1 Hosting

AZNETWORK — hosting of the application and its data, on servers certified as a French Health Data Host (Hébergeur de Données de Santé, HDS). France.
OVHcloud — hosting of the marketing website, no patient data. France.

7.2 Subscriptions

Apple — billing of subscriptions purchased through the App Store. Ireland and United States.
Google — billing of subscriptions purchased through Google Play. Ireland and United States.
Stripe (Stripe Payments Europe, Limited) — payment of subscriptions bought on the web. Ireland and United States.

None of the three receives any patient or health data: they only process the subscription identifier and what the transaction requires. Stripe also receives the account's email address and identifier, and collects card data itself on its payment page: that data never passes through our servers.

7.3 Mapping

Google Maps (Google LLC) — turning an address into coordinates and computing round itineraries. United States.

Only a postal address is sent, with no name, no identifier and no associated health data. How this transfer is governed is described in §10.

7.4 Audience Analytics — no third party

Matomo, self-hosted on our own infrastructure, on the website only. Measurement is cookieless, IP addresses are anonymised, and no data is shared with any third party.

7.5 Messaging and Contact

Transactional email delivery
Internal contact form

7.6 Form Protection — no third party

The website forms are protected against automated submissions by a solution we host ourselves. No third-party service is involved, no cookie is set, and no data is shared with anyone for that purpose.

8. Cookies and Trackers

On the website:

A single strictly necessary cookie, remembering that you dismissed the language-switch suggestion. It does not require consent.
Cookieless audience measurement: Matomo runs in “cookieless” mode and sets no cookie and no persistent identifier. No consent is therefore required, and no consent banner is displayed.
No advertising or cross-site tracking cookies are set.

No non-essential cookies are used in the mobile application.

9. Data Retention Period

Data is retained according to the following durations:

Account data: as long as the user maintains their account
Health data: time required for app functionality + legal obligations of healthcare professionals
Technical logs: up to 12 months
Strictly necessary cookies: session duration, or 12 months at most
Audience measurement: aggregated data, no cookie is set

10. Transfer Outside the European Union

Your health and account data never leave the European Union. The application and its database are hosted in France by an HDS-certified provider, the website is hosted in the European Union, and audience measurement runs on a Matomo instance we host ourselves: no audience data is shared with any third party.

The website performs no transfer outside the EU: neither audience measurement, nor form protection, nor any other component calls a third-party service.

One processing operation still involves a transfer to Google LLC (United States):

Google Maps / geocoding, used by the application to turn an address into coordinates and to compute tour itineraries.

This transfer relies on the European Commission’s Standard Contractual Clauses and on the EU–US Data Privacy Framework, to which Google LLC adheres.

Its scope is strictly limited: geocoding transmits a postal address only — no name, no identifier and no associated health information. No transmission content, no document and no health data is ever shared with a third party.

11. User Rights

In accordance with the GDPR, you have the following rights:

Right of access
Right to rectification
Right to erasure (within the legal limits applicable to health data)
Right to restrict processing
Right to object
Right to data portability

To exercise your rights: Email: simon@hakimon.com Contact form: https://tourneefacile.com/contact

11 bis. Deleting Your Account and Your Data

You can delete your account directly from the app: Settings → Delete my account. The app first tells you what will be deleted and what will happen to your practices.

Deleted immediately: your account, your patients and their records (vital readings, documents, pill organizers), your rounds, your calendar, your handover notes and their attachments.

What happens to your practices: if you are the last owner of a practice that still has other members, ownership is transferred automatically to the longest-standing member, so the practice is never left without one. If you are its only member, the practice is deleted along with your account.

What is kept: data the law requires us to keep, in particular the retention obligations that apply to healthcare professionals and the accounting records attached to a subscription. It is kept for no longer than required, then erased.

Without using the app, write to contact@tourneefacile.com: your request is handled within 30 days.

12. Application-Specific Features

The application includes:

Internal messaging
Therapeutic follow-up system
Appointment management
Data sharing between professionals
Multi-device synchronization
An API enabling certain external integrations

13. Changes to the Privacy Policy

This policy may be updated to reflect regulatory or functional changes. In the event of a significant change, users will be notified.

14. Contact

For any questions regarding this Privacy Policy: Hakimon Solutions — SAS 200 rue de la Croix Nivert, 75015 Paris
Email: simon@hakimon.com