Privacy policy

1. Who we are

Boki.ma is a service provided by SEM AGENCY, a company based in Morocco that designs, hosts and operates the platform. Any reference to “Boki.ma”, “we” or “our” in this policy means SEM AGENCY acting for the Boki.ma service.

Boki.ma gives businesses (doctors, dentists, beauty salons, hairdressers, coaches and others) a public booking page at <name>.boki.ma and a dashboard at boki.ma/dashboard to manage their diary, appointments, client or patient files, cash desk, team and notifications.

For any question about your data, you can write to us at support@boki.ma.

2. Roles: controller and processor

For business account data (owner’s identity, business details, team members, billing), SEM AGENCY acts as the data controller.

For the data of a business’s clients or patients (appointments, files, notes, documents, receipts), the business itself is the data controller. SEM AGENCY acts only as a processor, on the business’s instructions and solely to provide the service.

If you are a client or patient of a business using Boki.ma and wish to exercise your rights, please contact that business first. We will help it respond to your request.

3. Data we collect

Business account data: first and last name, e-mail address, phone number, business name and address, activity, logo and photos, opening hours, services and prices, team member details, and information about the subscribed pack and payments.

Client or patient data, entered by the business or during an online booking: name, phone number, e-mail address, appointment history, notes, attached documents and cash desk receipts.

Technical data: IP address, browser type, connection logs, dashboard sign-in history and cookies strictly necessary for the service to work.

4. Health data and sensitive data

Doctors, dentists and other health professionals may store sensitive data about their patients in Boki.ma: consultation notes, prescriptions, X-rays, copies of ID cards or any other document useful for follow-up.

These files are stored privately and are never made public. They can only be accessed by signed-in members of the business concerned, according to the access rights it defines.

The business remains solely responsible for obtaining its patients’ consent, for the relevance of the data it stores and for respecting medical and professional secrecy.

5. Purposes of processing

Data is used only to provide the Boki.ma service: creating and managing accounts, displaying the booking page, taking and managing appointments, sending confirmations, reminders and e-mail notifications, managing the cash desk and receipts, user support, billing of packs and platform security.

We may also use aggregated technical data to improve the stability and performance of the service, without identifying the businesses’ clients or patients.

6. No selling, no commercial use

We never sell the data of businesses or of their clients or patients. We do not share it for commercial purposes and do not use it for advertising.

Your clients’ data belongs to you: Boki.ma does not contact them on its own behalf and does not use their data for any purpose other than providing the service.

7. Recipients and technical subcontractors

Data can be accessed by authorised members of the business concerned and, in a limited way, by authorised SEM AGENCY staff when needed for support or maintenance, under a duty of confidentiality.

We use technical providers only as needed to host the service and send e-mails. These providers are bound by confidentiality obligations and may not use the data for their own purposes.

Data may be disclosed to the competent authorities when required by law.

8. Data security

We apply reasonable and adapted technical and organisational measures to protect data: encrypted connections (HTTPS), hashed passwords, access rights for each team member, sign-in history, private storage of documents and regular backups.

As no IT system is completely invulnerable, we cannot guarantee absolute security. We do, however, commit to improving our measures and to informing the businesses concerned of any security incident affecting their data.

Each user must also protect their credentials, choose a strong password and never share it.

9. Cookies

Boki.ma only uses cookies that are necessary for the service to work: session cookie, language preference, the “stay signed in” option (valid for 40 days) and security cookies.

We do not use any advertising or commercial tracking cookies.

Google’s reCAPTCHA service may be used on the sign-in and sign-up forms to protect the platform against bots. This service is subject to Google’s privacy rules.

10. Retention period

Account data is kept for as long as the account is active. After the account is closed, and upon request, it is deleted or anonymised within a reasonable time.

Invoices, receipts and accounting documents are kept for the period required by law.

Client or patient data is kept according to the instructions of the business acting as controller, which can edit or delete it from its dashboard.

11. Your rights

Under Law No. 09-08, you have the right to access and rectify your personal data and, on legitimate grounds, to object to its processing.

To exercise these rights, write to us at support@boki.ma, stating your request. We may ask you to prove your identity. If your data was entered by a business using Boki.ma, we will forward your request to that business or help it respond.

You may also contact the Commission Nationale de contrôle de la protection des Données à caractère Personnel (CNDP) if you believe your rights are not being respected.

12. Changes to this policy

We may update this policy to reflect changes to the service or to regulations. The date of the last update appears at the top of this page.

Businesses will be informed of any significant change by e-mail or through the dashboard.