Geripharma
Last updated : 31 August 2026
Geripharma is a mobile application for remote geriatric and medical follow-up, intended for patients supported by a healthcare professional. It lets you track medication intake, record health measurements, store medical documents and take part in video consultations.
We are committed to protecting our users' privacy, and health data in particular, which is sensitive data. This policy sets out what data is collected, why, how it is secured, who it is shared with, and what your rights are.
It applies to the Geripharma mobile application (com.geripharma.app) on Android and
iOS, to the connected devices associated with it, and to the services delivered by our servers,
wherever you live.
The Geripharma application is published by Gerimassy Consulting SRL, a company incorporated under Belgian law, which acts as the controller of your data.
As Gerimassy Consulting SRL is established in Belgium, all processing falls under the European Union's General Data Protection Regulation (GDPR), pursuant to its Article 3(1), whatever your country of residence. Belgian health data legislation also applies, in particular the Act of 30 July 2018 on the protection of natural persons with regard to the processing of personal data and the Act of 22 April 2019 on the quality of healthcare practice.
The rights and safeguards described in this policy apply to you identically, whether you live in Europe or in Africa. In addition to that foundation, and without replacing it, the national data protection laws of your country of residence also apply. For patients residing in Mali, this means Law No. 2013-015 of 21 May 2013, as amended, on the protection of personal data in the Republic of Mali, enforced by the Personal Data Protection Authority (APDP). Equivalent laws apply in the other West African countries where the service is offered. Where these frameworks differ, we apply the more protective one.
| Category | Data concerned |
|---|---|
| Account and identification | Email address, password (never stored in plain text), first name, last name, medical identifier, authentication method. |
| Patient profile | Date of birth, gender, weight, height and dominant hand. |
| Clinical and gerontological data | Allergies, medical history, number of chronic conditions, notes from the healthcare professional, autonomy and cognition scores (ADL, IADL, MMSE, CFS), medical documents you upload, appointments and video consultations. |
| Measurements you record | Readings you enter (blood glucose, blood pressure, etc.) and measurements from the gerontometer (grip strength, urinary flow strength, bowel rhythm, caloric intake). |
| Telemetry data | Where a connected bracelet is paired with your account: heart rate, blood pressure, oxygen saturation (SpO₂), daily step count, movement and fall detection. |
| Medication | Prescriptions, medication intake, adherence and polypharmacy management. |
| Your relatives' contact details | Name, phone number, email address and preferred contact channel (email, SMS or WhatsApp) of the people you designate as contacts or authorised carers. |
| Subscription and payment | The subscription plan taken out and the status of transactions. Payment card details are handled directly by our payment provider and do not pass through our servers. |
| Technical data | Push notification identifier, session token, IP address, device make, model and operating system version, application version, language and platform (Android or iOS). |
| Diagnostics and logging | Application error and crash reports, server technical logs, delivery events for the emails we send you. |
Where does this data come from? Most of it comes from you: what you enter in the application, what you upload to it, and the measurements produced by the connected devices you use. Some clinical data is recorded by the healthcare professional following you, as part of your care. Technical data is generated automatically by the application and by our servers.
When you record a relative as a contact or an authorised carer, you provide us with data about them: it is your responsibility to inform them. We use that data only to contact them as you have instructed, and they have the same rights over it as you have over yours.
Health data is sensitive data: it constitutes a special category under Article 9 GDPR, and sensitive data within the meaning of Article 3 of the Malian law. It is subject to enhanced protection.
We do not collect your location. The application shows no advertising and we do not sell your data to anyone.
| Purpose | Legal basis |
|---|---|
| Delivering your preventive, personalised geriatric follow-up and the teleconsultation service | Performance of a contract (Art. 6(1)(b) GDPR). For health data: Art. 9(2)(h) GDPR — the processing is necessary for your health care and for the management of health care services. It is carried out by, or under the responsibility of, healthcare professionals bound by an obligation of professional secrecy, in accordance with Article 9(3) GDPR. |
| Populating the clinical dashboard and computing frailty indicators (sarcopenia risk, fall risk) | Art. 6(1)(b) and Art. 9(2)(h) GDPR |
| Sharing summary reports between you, your authorised carers and the referring healthcare professionals | Art. 6(1)(b) and Art. 9(2)(h) GDPR. Designating an authorised carer is your decision and can be revoked at any time. |
| Improving treatment adherence and medication safety | Art. 6(1)(b) and Art. 9(2)(h) GDPR |
| Sending you medication and appointment reminders | Performance of a contract |
| Authenticating you and securing access to your account | Performance of a contract and legitimate interest (service security) |
| Keeping the application stable (crash reports, technical logs) | Legitimate interest (service quality and security) |
| Sending you messages about your account, its security and your billing | Performance of a contract |
| Managing subscriptions and meeting our accounting obligations | Performance of a contract and legal obligation (Art. 6(1)(c)) |
We send you no promotional messages and do not use your data for marketing purposes.
Automated calculations and decisions. The application automatically computes scores and indicators from your measurements, and may raise alerts. These calculations are analytical aids intended for the healthcare professional: they are not a diagnosis and give rise to no automated decision producing legal effects concerning you or significantly affecting you. Any medical decision is made by the healthcare professional following you. We carry out no profiling for any other purpose.
Your care team. The healthcare professional following you accesses your record as part of your care. They are bound by professional secrecy.
The carers you authorise. You decide which of your relatives may access what. That authorisation can be revoked at any time from the application.
Our processors, acting on our instructions and on our behalf, under a contract compliant with Article 28 GDPR:
| Provider | Role | Place of processing |
|---|---|---|
| Google Cloud Platform | Hosting of the server application, the database and documents | European Union (europe-west1 region, Belgium) |
| Google Firebase | Push notifications (Cloud Messaging) and crash reports (Crashlytics) | European Union and United States |
| Zoom Video Communications | Video consultations | European Union and United States |
| Mailgun | Sending service emails and tracking their delivery | European Union and United States |
| NRS360 | Sending notification text messages | Mali |
| Orange Money | Processing subscription payments | Mali |
| VIDAL | Medicine reference database, queried by our servers to display package leaflets. This query concerns medicine references, not your identity. | European Union |
We may also disclose your data to judicial or administrative authorities legally empowered to request it, within the limits of what the law requires.
We do not disclose your data to any third party for advertising purposes.
Location. All health data is hosted on Google Cloud Platform, in the
europe-west1 region (Belgium, European Union). The server application, the database and
your medical documents are stored there. Your health data is not stored outside the European
Union.
Transfers outside the European Union. Some of our processors handle data from countries outside the European Union for which the European Commission has issued no adequacy decision: providers established in Mali (text message delivery, payment processing) and, for certain technical operations, providers established in the United States. These transfers are governed by the standard contractual clauses adopted by the European Commission (Article 46(2)(c) GDPR), supplemented where necessary by additional technical and organisational measures. The data transferred is limited to what the service requires: a phone number and the content of a notification for text messages; a subscription reference and a transaction status for payment. No medical document and no health record is transferred to these providers.
Transfers from West African countries. For patients residing there, storing data on our servers constitutes a transfer outside the country of residence under the applicable national laws. For Mali, that transfer falls under Article 11 of Law No. 2013-015 of 21 May 2013, as amended: it relies on the contractual safeguards agreed with our host, including the standard contractual clauses, and on the fact that the recipient is established in the European Union and subject to the GDPR, which ensures a high level of protection of privacy and fundamental rights. Equivalent safeguards are in place for the other countries where the service is offered, in coordination with the competent national regulators.
You may obtain a copy of the safeguards in place by writing to the address given in section 2.
We keep your data for as long as is necessary for the purposes for which it was collected, and then for the archiving periods the law requires.
| Category | Retention period |
|---|---|
| Health record and clinical data (history, ADL, IADL, MMSE, CFS scores, gerontometer measurements, prescriptions, medical documents) | For the duration of the care relationship, then archived for 30 years from the last contact, not exceeding 50 years |
| Connected bracelet telemetry (steps, heart rate, saturation) | A rolling 12 months in the active dashboard; beyond that, the data is anonymised or deleted |
| Account, identification and profile | For as long as you use the application, then deleted or anonymised within a maximum of 30 days following closure of the account or a formal erasure request, subject to the archiving of the health record set out above |
| Your relatives' contact details | Deleted when the account is closed |
| Subscription and billing | 10 years from the close of the relevant financial year, in accordance with Belgian accounting law |
| Server technical logs | 12 months |
| Crash reports | 12 months |
| Email delivery events | 12 months |
The 30-year period applied to the health record corresponds to the patient record retention obligation laid down in Article 35 of the Belgian Act of 22 April 2019 on the quality of healthcare practice. It also covers the minimum periods imposed by the laws of the countries where care is delivered, including the ten years set out in Article 31 of Malian Law No. 02-050 of 22 July 2002 on hospitals, as amended.
Once these periods expire, the data is erased from our systems, including stored documents and backups, in line with the backup rotation cycle.
You have the following rights over your data:
These rights may be exercised by you or, where your condition warrants it, by your legal representative or the person of trust you have designated.
Limit on the right to erasure. Your health record cannot be erased on request during the archiving period stated in section 9. That retention answers a legal obligation within the meaning of Article 17(3)(b) GDPR as regards Belgian law, and in any event remains necessary for the establishment, exercise or defence of legal claims within the meaning of Article 17(3)(e). During that archiving period the record is no longer used to provide you with the service: it is retained, and nothing more.
To exercise these rights, write to minthe@geripharmaapp.com or use the support area of the application. We respond within one month, reduced to thirty days for rectification requests falling under Article 13 of the Malian law. We may ask you for proof of identity where we have reasonable doubt as to the identity of the requester. Exercising these rights is free of charge.
You may also lodge a complaint with a supervisory authority:
You can delete your account directly from the application:
Profile → Privacy and security → Close my Geripharma account
This immediately deactivates your account: you no longer have access to the application and the service ends. Your account and profile data is deleted or anonymised within a maximum of 30 days.
Your health record is not erased at the same moment: it is archived for the period stated in section 9, for the reasons set out in section 10. At the end of that period, your data is permanently erased.
You may also write to minthe@geripharmaapp.com to request deletion of your account and data.
If a data breach occurred and posed a risk to your rights and freedoms, we would notify the competent supervisory authority within the statutory time limits. If the risk were high, we would also inform you directly and without undue delay.
Geripharma is intended for adult patients followed by a healthcare professional. Under the user agreement, registration is reserved for people of legal age. We do not knowingly collect data from minors. If you believe a minor has provided us with data, write to us and we will delete it.
Where the patient is unable to express their wishes, the account may be opened and administered by their legal representative or by the person of trust they have designated, under the conditions provided by the applicable law. That person acts in the patient's interest and is bound by the same confidentiality rules.
We may update this policy. The date of the last update appears at the top of this page. In the event of a substantial change, we will inform you within the application, before the change takes effect.
For any question about this policy, about where your data is hosted, or to exercise your rights, write to us or use the support area of the application:
Gerimassy Consulting SRL