Last updated: 11 October 2026
Preamble
Dr Khalil El Cadhi attaches the utmost importance to the confidentiality and security of the personal data entrusted to him in the course of his hair transplant surgery practice.
The purpose of this policy is to inform anyone who visits the drelcadhi.com website, uses the associated online services (contact forms, online assessment, quotes, ForceHT application) or attends the practice, of the conditions under which their personal data is collected, used and protected.
This policy applies jointly with Regulation (EU) 2016/679 (“GDPR”) (applicable to visitors residing in the European Union and the European Economic Area) and with Tunisian Organic Law no. 2004-63 of 27 July 2004 on the protection of personal data (applicable to Dr El Cadhi’s practice in Djerba).
1. Identity of the data controller
The personal data controller is:
- Dr Khalil El Cadhi — hair transplant surgeon
- Practice: Dar El Hakim medical complex, Route touristique, 4180 Houmt Souk, Djerba — Tunisia
- Tunisian Medical Association registration no.: 026253
- Phone / WhatsApp Business: +216 21 933 000
- GDPR contact e-mail: contact@drelcadhi.com
2. Data Protection Officer
Given the size of the practice, Dr El Cadhi is not legally required to appoint a Data Protection Officer (DPO). For any question regarding your personal data, you may nonetheless contact him directly using the details in section 1.
3. Personal data collected
Depending on your interaction with the site and online services, Dr El Cadhi may collect the following categories of data:
3.1 Identification and contact data
- Surname, first name
- Age or date of birth
- Sex
- Country of residence
- E-mail address
- Phone number (used for WhatsApp Business)
- Preferred language of communication (FR, EN, AR)
3.2 Medical data — exclusively related to hair restoration
- Relevant medical history (alopecia, previous treatments, any prior transplants)
- Scalp photographs (front, profiles, crown, donor area) submitted for preliminary assessment
- Stage of alopecia progression (Norwood classification for men, Ludwig for women)
- Follicular reserve characteristics (visual estimate or via ScanScalp.ai analysis)
- Current medications and treatments relevant to the procedure
- Known allergies
- Where applicable: assessment elements for repair surgery
3.3 Browsing data
- IP address
- Browser type and operating system
- Pages viewed, duration and path on the site
- Source (search engine, social network, direct access)
- Data collected via cookies (see section 12)
3.4 Data from the ForceHT application (pre-transplant 3D simulation)
- Scalp photographs submitted on the platform
photo.forceht.com/fr/clinics/drelcadhi - Result of the generated 3D simulation
- Treatment plan proposed following the consultation
This list corresponds to the data strictly necessary for the intended purpose (minimisation principle, Article 5 GDPR).
4. Purposes of processing
Your personal data is collected and processed for the following purposes:
| Purpose | Data concerned | Legal basis |
|---|---|---|
| Respond to a contact or consultation request | Identification, contact, preliminary medical data | Pre-contractual measures at the person’s request (Art. 6.1.b GDPR) |
| Prepare a personalised quote | Identification, contact, photographs, history | Pre-contractual measures (Art. 6.1.b GDPR) |
| Carry out a preliminary remote assessment | Preliminary medical data, photographs | Explicit consent (Art. 9.2.a GDPR for health data) |
| Prepare and perform the surgical procedure | All medical and photographic data | Performance of the care contract + legal obligations (Art. 6.1.b + 9.2.h GDPR) |
| Provide post-operative follow-up (M+1, M+3, M+6, M+12) | Medical data, follow-up photographs | Performance of the care contract (Art. 6.1.b + 9.2.h GDPR) |
| Improve the site and measure audience | Browsing data | Legitimate interest (Art. 6.1.f GDPR) + consent for non-essential cookies |
| Comply with a legal obligation or request from a competent authority | As requested | Legal obligation (Art. 6.1.c GDPR) |
No data is used for commercial, advertising or resale purposes.
5. Mandatory or optional nature of provision
Data marked with an asterisk in the online forms is essential to process your request. Without it, Dr El Cadhi will not be able to respond to you or offer a consultation. The other fields are optional.
6. Recipients and processors
Your personal data is strictly reserved for:
- Dr Khalil El Cadhi and his medical team bound by professional secrecy
- the technical processors strictly necessary for the operation of the site and associated services, listed below
List of processors
| Processor | Service provided | Hosting country | GDPR status |
|---|---|---|---|
| OxaHost | Site hosting | Tunisia | GDPR compliant |
| Force HT (3D simulation technology) | Processing of photographs for pre-transplant 3D simulation — platform photo.forceht.com | USA / European Union | See the publisher’s privacy policy |
| Google LLC (Google Analytics 4, Search Console) | Anonymised audience measurement and indexing | USA (EU-US Data Privacy Framework) | Compliant via DPF |
| Meta Platforms Ireland (Facebook pixel if enabled) | Advertising conversion measurement | Ireland / USA | Not enabled to date |
| Built-in site form (WordPress) | Processing of contact forms | Depending on hosting | GDPR compliant |
| WhatsApp Business (Meta) | Exchanges with the practice (contact, quotes, follow-up) | Ireland / USA | GDPR compliant |
Each processor is bound by a data processing agreement (DPA) imposing the same security and confidentiality guarantees as those set out in this policy.
7. Data transfers outside the European Union
Some data may be transferred to Tunisia (Dr El Cadhi’s practice) or to processors located outside the EU (notably the United States for Force HT, Google and Meta).
These transfers are governed by the following safeguards:
- To Tunisia: Tunisia does not currently benefit from an adequacy decision by the European Commission. The transfer is nonetheless lawful on the basis of the explicit consent of the data subject (Article 49.1.a GDPR) when you initiate a consultation or quote request, Dr El Cadhi’s practice being the natural final recipient of the data.
- To the United States: transfers are governed by the Standard Contractual Clauses approved by the European Commission and, where the processor has adhered to it, by the EU-US Data Privacy Framework.
8. Retention period
| Data | Retention period | Basis |
|---|---|---|
| Patient file medical data | 30 years from the last procedure | Tunisian law no. 91-21 on the practice of medicine + French HAS recommendation for international patients |
| Pre-operative and follow-up photographs | 30 years from the procedure | Same as previous row |
| Contact requests without follow-up (consultation not carried out) | 3 years from the last contact | French commercial limitation period (Art. L.110-4 Commercial Code) |
| Browsing data and cookies | Per cookie settings (see section 12), maximum 13 months | CNIL recommendation |
9. Security
Dr El Cadhi implements the following technical and organisational measures to protect your data:
- Site hosting on a secure server with an SSL/TLS certificate (all communications are encrypted via HTTPS)
- WordPress back-office access protected by strong authentication
- Regular, encrypted backups
- Storage of medical photographs in secure, restricted-access spaces, outside the public web server
- Professional secrecy commitment of all medical staff
- Regular updates of plugins and the WordPress core
- Incident response plan (notification to the CNIL and data subjects within 72 hours in the event of a breach, in accordance with Article 33 GDPR)
10. Rights of individuals (GDPR — EU/EEA)
In accordance with Articles 15 to 22 of the GDPR, you have the following rights over your personal data:
- Right of access: obtain confirmation that your data is processed and receive a copy
- Right to rectification: correct inaccurate or incomplete data
- Right to erasure (“right to be forgotten”): subject to legal obligations to retain the medical record
- Right to restriction of processing
- Right to portability: retrieve your data in a structured, machine-readable format
- Right to object: notably to processing for marketing purposes (where applicable)
- Right to withdraw your consent at any time, without affecting the lawfulness of processing carried out beforehand
- Right to define guidelines on the fate of your data after your death
To exercise these rights, send your request to Dr Khalil El Cadhi by e-mail at contact@drelcadhi.com or by post to the practice address, enclosing a copy of an identity document. A response will be sent to you within one month (Article 12.3 GDPR).
In the event of a persistent disagreement, you may lodge a complaint with the competent supervisory authority:
- For EU residents: CNIL (www.cnil.fr)
- For Tunisian residents: INPDP (www.inpdp.nat.tn)
11. Tunisia specificity — INPDP compliance
As Dr El Cadhi’s practice is established in Tunisia, data processing is also subject to Organic Law no. 2004-63 of 27 July 2004 on the protection of personal data, as amended and supplemented.
Accordingly: – The processing falls under the INPDP framework (Tunisian National Authority for the Protection of Personal Data) — – Health data is classified as sensitive data and benefits from enhanced protection – You have the same rights of access, rectification and objection with Dr El Cadhi as those provided by the GDPR – You may lodge a complaint with the INPDP: www.inpdp.nat.tn
The express consent and prior information required by this law also apply to non-necessary cookies and trackers: they are only set after your explicit agreement, given through the banner described in section 12, and you may withdraw it at any time.
12. Cookies and trackers
The drelcadhi.com website uses cookies and trackers to ensure its proper functioning, measure its audience and, where applicable, measure the effectiveness of its campaigns. No non-necessary cookie is set, and no measurement data is sent, before you make your choice.
12.1 Strictly necessary cookies
Essential for the operation of the site: language (Polylang), security and caching where applicable, and the recording of your consent choices (CookieYes, “cookieyes-consent” and “wp_consent_*” cookies). They do not require your consent and contain no data that could identify you.
12.2 Audience measurement and marketing cookies
Google Analytics 4 (loaded through Site Kit) measures site usage in aggregated form; the Google Ads tag, when a campaign is running, measures conversions. These tags are loaded in “denied” consent mode by default (“consent mode”: analytics_storage, ad_storage, ad_user_data and ad_personalization set to “denied”) for all visitors, whatever their region: until you accept, no measurement cookie is set and no identifier is sent. They switch to “granted” only for the categories you have accepted.
12.3 Functional cookies
They enable convenience features (embedded videos, sharing). They are subject to your consent; the site currently uses none.
12.4 Managing your consent
A banner (CookieYes) is shown on your first visit, in French and English, with three equivalent choices: “Accept all”, “Reject all” and “Customise” (category-by-category choice in the preference centre). Your choice is stored on your device, passed to the WordPress consent system (WP Consent API, “opt-in” model) and applied to the Google tags on every page. You can change or withdraw it at any time via the “Cookies” button displayed at the bottom of the page, or by deleting the cookies in your browser. Refusing has no effect on access to the site or on contacting the practice.
13. Specific clause — ForceHT application (pre-transplant 3D simulation)
Dr El Cadhi provides you with the ForceHT platform, accessible via photo.forceht.com/fr/clinics/drelcadhi, which lets you visualise the future result of your procedure in 3D.
13.1 Data processed
- Scalp photographs uploaded by you according to the indicated shooting protocol
- Result of the 3D simulation generated by the ForceHT algorithm
- Treatment plan proposed following the consultation
13.2 Transfer security
Your photographs are transferred to ForceHT via an encrypted channel (HTTPS/TLS). They are then stored locally in the space dedicated to Dr El Cadhi’s practice on the ForceHT platform, with restricted access.
13.3 Purpose
The photographs are used exclusively to: – Present you with a 3D simulation of your future result during the consultation – Establish the surgical plan and the planning of the hairline
They are in no case used for public communication purposes without your separate written consent (see section 14).
13.4 Retention
The photographs are kept for the duration of the patient file (30 years), like all medical data (see section 8).
13.5 Your rights
You can at any time request the deletion of your photographs from the ForceHT platform, subject to the medical record retention obligations applicable to procedures already carried out.
14. Communication photographs (gallery, before/after, social media)
The use of your photographs for communication purposes (public site gallery, social media, scientific presentations) is subject to separate written consent, revocable at any time, distinct from the medical consultation.
No photograph is published without your prior signature of the consent form.
You can withdraw this consent at any time by e-mail to contact@drelcadhi.com. The photographs will then be removed from the site and social media within a maximum of 30 days.
15. Minors
The site and associated services are not intended for minors. No consultation or procedure is carried out on a minor patient without written parental authorisation and the presence of a legal representative.
If you are a minor, do not use the online forms without the agreement of a parent or legal guardian.
16. Modifications to the policy
Dr El Cadhi reserves the right to modify this policy to reflect legislative, regulatory, case-law or technical developments. The date of the last update is shown at the top of the page.
In the event of a substantial change, you will be informed by a visible notice on the site on your next visit.
17. Contact
For any question regarding this policy or your personal data:
- E-mail: contact@drelcadhi.com
- WhatsApp Business: +216 21 933 000
- Postal address: Dr Khalil El Cadhi — Dar El Hakim medical complex, Djerba, Tunisia