Last updated: 28 May 2026
Preamble
Dr Khalil El Cadhi attaches the utmost importance to the confidentiality and security of the personal data entrusted to him in the course of his hair restoration surgery practice.
The purpose of this policy is to inform anyone who visits the drelcadhi.com website, uses the associated online services (contact forms, online assessment, quotes, Mimi conversational assistant, ForceHT application) or attends the practice, of the conditions under which their personal data is collected, used and protected.
This policy applies jointly with Regulation (EU) 2016/679 (“GDPR”) (applicable to visitors residing in the European Union and the European Economic Area) and with Tunisian Organic Law no. 2004-63 of 27 July 2004 on the protection of personal data (applicable to Dr El Cadhi’s practice in Djerba).
1. Identity of the data controller
The personal data controller is:
- Dr Khalil El Cadhi — specialist surgeon in hair restoration
- Practice: Dar el Hakim, Djerba, Tunisia — [full postal address to be completed]
- Tunisian Medical Association registration no.: [to be completed]
- Phone / WhatsApp Business: +216 21 933 000
- GDPR contact e-mail: drelcadhi@gmail.com
2. Data Protection Officer
Given the size of the practice, Dr El Cadhi is not legally required to appoint a Data Protection Officer (DPO). For any question regarding your personal data, you may nonetheless contact him directly using the details in section 1.
3. Personal data collected
Depending on your interaction with the site and online services, Dr El Cadhi may collect the following categories of data:
3.1 Identification and contact data
- Surname, first name
- Age or date of birth
- Sex
- Country of residence
- E-mail address
- Phone number (used for WhatsApp Business)
- Preferred language of communication (FR, EN, AR)
3.2 Medical data — exclusively related to hair restoration
- Relevant medical history (alopecia, previous treatments, any prior transplants)
- Scalp photographs (front, profiles, crown, donor area) submitted for preliminary assessment
- Stage of alopecia progression (Norwood classification for men, Ludwig for women)
- Follicular reserve characteristics (visual estimate or via ScanScalp.ai analysis)
- Current medications and treatments relevant to the procedure
- Known allergies
- Where applicable: assessment elements for repair surgery
3.3 Browsing data
- IP address
- Browser type and operating system
- Pages viewed, duration and path on the site
- Source (search engine, social network, direct access)
- Data collected via cookies (see section 12)
3.4 Data from interactions with the Mimi conversational assistant
- Content of messages exchanged with Mimi before WhatsApp redirection
- Origin page that triggered the conversation
- Time and duration of the conversation
- Answers provided by the visitor to the guiding questions
3.5 Data from the ForceHT application (pre-transplant 3D simulation)
- Scalp photographs submitted on the platform
photo.forceht.com/fr/clinics/drelcadhi - Result of the generated 3D simulation
- Treatment plan proposed following the consultation
This list corresponds to the data strictly necessary for the intended purpose (minimisation principle, Article 5 GDPR).
4. Purposes of processing
Your personal data is collected and processed for the following purposes:
| Purpose | Data concerned | Legal basis |
|---|---|---|
| Respond to a contact or consultation request | Identification, contact, preliminary medical data | Pre-contractual measures at the person’s request (Art. 6.1.b GDPR) |
| Prepare a personalised quote | Identification, contact, photographs, history | Pre-contractual measures (Art. 6.1.b GDPR) |
| Carry out a preliminary remote assessment | Preliminary medical data, photographs | Explicit consent (Art. 9.2.a GDPR for health data) |
| Prepare and perform the surgical procedure | All medical and photographic data | Performance of the care contract + legal obligations (Art. 6.1.b + 9.2.h GDPR) |
| Provide post-operative follow-up (M+1, M+3, M+6, M+12) | Medical data, follow-up photographs | Performance of the care contract (Art. 6.1.b + 9.2.h GDPR) |
| Guide the visitor (Mimi) to the right resource | Conversation data | Legitimate interest + implied consent through use |
| Improve the site and measure audience | Browsing data | Legitimate interest (Art. 6.1.f GDPR) + consent for non-essential cookies |
| Comply with a legal obligation or request from a competent authority | As requested | Legal obligation (Art. 6.1.c GDPR) |
No data is used for commercial, advertising or resale purposes.
5. Mandatory or optional nature of provision
Data marked with an asterisk in the online forms is essential to process your request. Without it, Dr El Cadhi will not be able to respond to you or offer a consultation. The other fields are optional.
6. Recipients and processors
Your personal data is strictly reserved for:
- Dr Khalil El Cadhi and his medical team bound by professional secrecy
- the technical processors strictly necessary for the operation of the site and associated services, listed below
List of processors
| Processor | Service provided | Hosting country | GDPR status |
|---|---|---|---|
| [to be completed — WordPress host] | Site hosting | [to be completed — France or EU] | GDPR compliant |
| Force HT (3D simulation technology) | Processing of photographs for pre-transplant 3D simulation — platform photo.forceht.com | [to be confirmed] | [to be validated] |
| Google LLC (Google Analytics 4, Search Console) | Anonymised audience measurement and indexing | USA (EU-US Data Privacy Framework) | Compliant via DPF |
| Meta Platforms Ireland (Facebook pixel if enabled) | Advertising conversion measurement | Ireland / USA | [to be validated] |
| [to be completed — form solution] | Processing of contact forms | Depending on hosting | GDPR compliant |
| WhatsApp Business (Meta) | Exchanges after redirection from Mimi | Ireland / USA | GDPR compliant |
Each processor is bound by a data processing agreement (DPA) imposing the same security and confidentiality guarantees as those set out in this policy.
7. Data transfers outside the European Union
Some data may be transferred to Tunisia (Dr El Cadhi’s practice) or to processors located outside the EU (notably the United States for Force HT, Google and Meta).
These transfers are governed by the following safeguards:
- To Tunisia: Tunisia does not currently benefit from an adequacy decision by the European Commission. The transfer is nonetheless lawful on the basis of the explicit consent of the data subject (Article 49.1.a GDPR) when you initiate a consultation or quote request, Dr El Cadhi’s practice being the natural final recipient of the data.
- To the United States: transfers are governed by the Standard Contractual Clauses approved by the European Commission and, where the processor has adhered to it, by the EU-US Data Privacy Framework.
8. Retention period
| Data | Retention period | Basis |
|---|---|---|
| Patient file medical data | 30 years from the last procedure | Article 16 of Tunisian law no. 91-21 on the practice of medicine + French HAS recommendation for international patients |
| Pre-operative and follow-up photographs | 30 years from the procedure | Same as previous row |
| Contact requests without follow-up (consultation not carried out) | 3 years from the last contact | French commercial limitation period (Art. L.110-4 Commercial Code) |
| Mimi conversations without follow-up | 12 months maximum | Legitimate interest |
| Browsing data and cookies | Per cookie settings (see section 12), maximum 13 months | CNIL recommendation |
9. Security
Dr El Cadhi implements the following technical and organisational measures to protect your data:
- Site hosting on a secure server with an SSL/TLS certificate (all communications are encrypted via HTTPS)
- WordPress back-office access protected by strong authentication
- Regular, encrypted backups
- Storage of medical photographs in secure, restricted-access spaces, outside the public web server
- Professional secrecy commitment of all medical staff
- Regular updates of plugins and the WordPress core
- Incident response plan (notification to the CNIL and data subjects within 72 hours in the event of a breach, in accordance with Article 33 GDPR)
10. Rights of individuals (GDPR — EU/EEA)
In accordance with Articles 15 to 22 of the GDPR, you have the following rights over your personal data:
- Right of access: obtain confirmation that your data is processed and receive a copy
- Right to rectification: correct inaccurate or incomplete data
- Right to erasure (“right to be forgotten”): subject to legal obligations to retain the medical record
- Right to restriction of processing
- Right to portability: retrieve your data in a structured, machine-readable format
- Right to object: notably to processing for marketing purposes (where applicable)
- Right to withdraw your consent at any time, without affecting the lawfulness of processing carried out beforehand
- Right to define guidelines on the fate of your data after your death
To exercise these rights, send your request to Dr Khalil El Cadhi by e-mail at drelcadhi@gmail.com or by post to the practice address, enclosing a copy of an identity document. A response will be sent to you within one month (Article 12.3 GDPR).
In the event of a persistent disagreement, you may lodge a complaint with the competent supervisory authority:
- For EU residents: CNIL (www.cnil.fr)
- For Tunisian residents: INPDP (www.inpdp.nat.tn)
11. Tunisia specificity — INPDP compliance
As Dr El Cadhi’s practice is established in Tunisia, data processing is also subject to Organic Law no. 2004-63 of 27 July 2004 on the protection of personal data, as amended and supplemented.
Accordingly: – The processing [is subject to a declaration / prior authorisation] with the INPDP — [to be validated: current INPDP status and number where applicable] – Health data is classified as sensitive data and benefits from enhanced protection – You have the same rights of access, rectification and objection with Dr El Cadhi as those provided by the GDPR – You may lodge a complaint with the INPDP: www.inpdp.nat.tn
12. Cookies and trackers
The drelcadhi.com website uses cookies and trackers to ensure its proper functioning, measure its audience and improve your experience.
12.1 Strictly necessary cookies
Essential for the operation of the site (Polylang session for language, security, load balancing). They do not require your consent.
12.2 Audience measurement cookies
Used by Google Analytics 4 and Hotjar to understand site usage in an anonymised, aggregated form. Subject to your consent via the cookie banner.
12.3 Personalisation cookies
Allow your preferences (language, etc.) to be remembered. Subject to your consent.
12.4 Managing your consent
A banner is presented to you on your first visit. You can change your preferences at any time via the “Manage my cookies” link in the footer.
13. Specific clause — Mimi conversational assistant (AI)
The site integrates Mimi, a conversational assistant based on artificial intelligence, accessible via the floating chat widget. Mimi’s sole mission is to guide you to the resources suited to your request (consultation, online assessment, quote, partner travel agencies for logistics).
13.1 Data processed by Mimi
During a conversation with Mimi, the following elements are collected: – Content of the messages you type – Origin page from which the conversation is initiated – Timestamp and duration of the conversation – Answers to the guiding questions (up to 5 questions maximum)
13.2 What Mimi does not do
- Mimi does not make a definitive medical diagnosis
- Mimi makes no promise of results
- Mimi carries out no financial transaction
- Mimi does not store your sensitive medical data
13.3 Redirection to WhatsApp Business
At the end of the guiding conversation, Mimi offers to continue the exchange on WhatsApp Business (+216 21 933 000), a single line managed by Dr El Cadhi’s team. From this redirection, exchanges are subject to WhatsApp’s terms and privacy policy (Meta Platforms Ireland).
13.4 Redirection to partner travel agencies
When your request concerns the logistics of the stay (flights, hotels, transfers), Mimi directs you to a partner travel agency. From this handover, the data you transmit to the agency is governed by that agency’s privacy policy, for which Dr El Cadhi is not responsible. The list of current partners is available on request.
13.5 Your rights regarding Mimi
You can at any time: – Refuse to engage in a conversation with Mimi (the widget closes) – Request the deletion of exchanges concerning you by writing to drelcadhi@gmail.com
14. Specific clause — ForceHT application (pre-transplant 3D simulation)
Dr El Cadhi provides you with the ForceHT platform, accessible via photo.forceht.com/fr/clinics/drelcadhi, which lets you visualise the future result of your procedure in 3D.
14.1 Data processed
- Scalp photographs uploaded by you according to the indicated shooting protocol
- Result of the 3D simulation generated by the ForceHT algorithm
- Treatment plan proposed following the consultation
14.2 Transfer security
Your photographs are transferred to ForceHT via an encrypted channel (HTTPS/TLS). They are then stored locally in the space dedicated to Dr El Cadhi’s practice on the ForceHT platform, with restricted access.
14.3 Purpose
The photographs are used exclusively to: – Present you with a 3D simulation of your future result during the consultation – Establish the surgical plan and the planning of the hairline
They are in no case used for public communication purposes without your separate written consent (see section 15).
14.4 Retention
The photographs are kept for the duration of the patient file (30 years), like all medical data (see section 8).
14.5 Your rights
You can at any time request the deletion of your photographs from the ForceHT platform, subject to the medical record retention obligations applicable to procedures already carried out.
15. Communication photographs (gallery, before/after, social media)
The use of your photographs for communication purposes (public site gallery, social media, scientific presentations) is subject to separate written consent, revocable at any time, distinct from the medical consultation.
No photograph is published without your prior signature of the consent form.
You can withdraw this consent at any time by e-mail to drelcadhi@gmail.com. The photographs will then be removed from the site and social media within a maximum of 30 days.
16. Minors
The site and associated services are not intended for minors. No consultation or procedure is carried out on a minor patient without written parental authorisation and the presence of a legal representative.
If you are a minor, do not use the online forms without the agreement of a parent or legal guardian.
17. Modifications to the policy
Dr El Cadhi reserves the right to modify this policy to reflect legislative, regulatory, case-law or technical developments. The date of the last update is shown at the top of the page.
In the event of a substantial change, you will be informed by a visible notice on the site on your next visit.
18. Contact
For any question regarding this policy or your personal data:
- E-mail: drelcadhi@gmail.com
- WhatsApp Business: +216 21 933 000
- Postal address: Dr Khalil El Cadhi — Dar el Hakim, Djerba, Tunisia