Privacy Policy

Privacy Policy

This policy describes how TOUREX ECOM SARL ("we"), publisher of the Delemed CRM service, a limited liability company with a share capital of 1,000,000 FCFA, registered with the Abidjan Trade and Personal Property Credit Register (RCCM) under number B13-13473, with its registered office in Abidjan, Yopougon (Côte d'Ivoire), collects, uses and protects personal data processed through the Delemed CRM service, in accordance with Ivorian Law No. 2013-450 of 19 June 2013 on the protection of personal data. For data that agencies and laboratories enter into the service, including that of their delegates and the healthcare professionals visited, the agency is the data controller and TOUREX ECOM SARL acts as data processor. For account, billing and audience measurement data, TOUREX ECOM SARL is the data controller. By using the service, you agree to the processing of your data in accordance with this policy.

Data We Collect

In connection with the use of Delemed CRM by pharmaceutical promotion agencies, their partner laboratories and their field teams, we collect in particular:

• Account data: name, email address, password (stored in hashed form), role (agency owner, manager, supervisor, delegate) and, where applicable, phone number.
• Organization data: information about the agency, laboratories, geographic sectors and teams.
• Field activity data: visit plans, visit reports, summaries, orders and photos taken during visits.
• Geolocation data of medical delegates during their field rounds (see the dedicated section below).
• Data relating to the healthcare professionals visited: name, specialty, healthcare facility and facility location.
• Billing and subscription data, processed by our payment provider Stripe; we do not store card numbers.

Delegate Geolocation

Some service plans include GPS tracking of medical delegates during their field rounds, so that authorized supervisors and managers can monitor field activity. This processing is governed as follows:

• Geolocation is only active in a professional context, during field rounds, and delegates are informed of it.
• Positions are transmitted securely and are only accessible to authorized managers of the relevant laboratory.
• Detailed position data is kept for 90 days and then automatically deleted.

How We Use Data

We use the data we collect to:

• Provide, maintain and improve the service: visit planning, reports, objectives and dashboards.
• Manage accounts, roles and access rights within each agency and each laboratory.
• Track field activity and produce statistics for authorized managers.
• Manage subscriptions, billing and payments.
• Send service-related notifications: report reminders, subscription alerts, security emails.
• Ensure the security of the service and prevent fraud and abuse.

IP Addresses and Abuse Prevention

To protect our public forms and sensitive endpoints against abuse, we collect and temporarily retain:

• The IP address when a public form is submitted (contact, sign-up), for anti-spam and anti-fraud purposes.
• Technical logs (IP address, timestamp, action) on sensitive endpoints, for security and rate-limiting purposes.

Recipients and Subprocessors

Data is only accessible to authorized members of your agency and your laboratory, according to their role. We also rely on technical providers that process certain data on our behalf:

• Vercel: application hosting and cookieless audience and performance measurement (Vercel Analytics, Speed Insights).
• Neon: PostgreSQL database hosting.
• Supabase: photo storage and real-time transmission of GPS positions.
• Stripe: payments and subscription management.
• Resend: transactional email delivery.
• Inngest: execution of scheduled jobs (reminders, data cleanup, subscription synchronization).
• Sentry: technical error monitoring; when an error occurs, a session replay is recorded with all text masked and media blocked.
• Google: sign-in with a Google account (if you choose this option) and, with your consent, Google Analytics audience measurement.
• Cal.com: demo booking from the Contact page.
• Some of these providers are located outside Côte d'Ivoire; such transfers are governed by appropriate contractual safeguards.

Cookies and audience measurement

We use two categories of cookies:

• Strictly necessary cookies: session, authentication and security. They are essential for the service to work and do not require consent.
• Audience measurement cookies (Google Analytics): they are only set after your consent, collected through the banner shown on your first visit. They help us understand how the site is used in order to improve it.
• You can withdraw or change your consent at any time via the “Manage cookies” link in the footer.

Data Protection

We implement appropriate technical and organizational measures: encryption in transit (TLS), password hashing, available two-factor authentication, strict data isolation between laboratories and role-based access control. Access to data by our team is limited to what is strictly necessary, for support and maintenance.

Data Retention

Data is kept for the duration of the contract with your agency, then deleted or anonymized after a reasonable period, subject to legal retention obligations. Detailed geolocation data is kept for 90 days and then automatically deleted. Billing data is kept in accordance with applicable accounting and tax obligations.

Your Rights

In accordance with Law No. 2013-450 of 19 June 2013, you have the right to access, rectify, object to and delete your personal data. You can exercise these rights by writing to us at contact@delemed.com or via the site's Contact page. If you believe your rights are not being respected, you may lodge a complaint with the Autorité de Régulation des Télécommunications de Côte d'Ivoire (ARTCI), the personal data protection authority.

Changes to This Policy

We may amend this policy at any time, in particular to reflect changes in the service or in regulations. The current version is published on this page; in the event of a substantial change, users will be informed via the service or by email.