This policy describes how personal data is processed within the Katalyxpharma insurer portal. It is addressed to insurance organisations using the Portal as well as to the individuals whose data is processed there. It supplements the platform's general Privacy Policy and prevails over it for the scope of the insurer portal.
For its members' data and coverage decisions, the Insurer determines the purposes and means of processing: it is the controller. For that scope Katalyxpharma acts as a processor and acts only on the Insurer's instructions. For Portal user account data and technical logs, Katalyxpharma is the controller.
Portal accounts: last name, first name, email address, phone number, role and permissions, language preference, password hash, temporary verification codes. Organisation: legal name, code, coverage type, contact details, address, contract document. Member registry: member identifier, identity, coverage status, rates and ceilings. Claims and batches: issuing pharmacy, date, total, covered and member-borne amounts. Technical data: IP address, user agent, timestamps of connections and actions.
Data is processed in order to: open and secure access to the Portal, allow claims to be reviewed and batches validated, maintain the member registry and track ceilings, produce the exports and statements requested by the Insurer, guarantee batch integrity through cryptographic fingerprints, ensure traceability of actions for evidential and security purposes, and meet legal and accounting obligations.
Performance of the contract between Katalyxpharma and the Insurer underpins account management and Portal access. Performance of the insurance contract between the Insurer and its members underpins the processing of claims and of the registry. Legitimate interest underpins security measures, logging and fraud prevention. Legal and accounting obligations underpin the retention of financial records.
A claim reveals that a dispensing event took place for a given member, on a given date, for a given amount. Such information constitutes health data and benefits from reinforced protection. Access is restricted to Insurer accounts holding the corresponding permission and to Katalyxpharma personnel strictly necessary for technical operation. Every access is logged.
Data is never sold. It is accessible to: the Insurer's authorised accounts, for its own scope only; the issuing pharmacy, for the claims it generated itself; Katalyxpharma's technical providers (hosting, file storage, email delivery), bound by confidentiality undertakings and acting on instruction; the competent authorities where required by law. One Insurer never has access to another organisation's data.
Application data is hosted on secure servers with daily automatic backups. Documents and attachments, in particular signed contracts and exported batches, are kept in private storage accessed through temporary signed links. Where a transfer outside the country of establishment is necessary, it is framed by appropriate contractual safeguards.
Portal accounts: for the duration of the relationship, then deleted within 90 days of closure. Claims and batches: retained for the statutory period applicable to accounting and supporting records, with cryptographic fingerprints kept for as long as the batches they seal. Member registry: until removed by the Insurer or the account is closed. Technical and security logs: 12 months. Verification codes: 30 minutes.
Measures in place include encryption of communications, password hashing, two-factor authentication by email code, session expiry and rotation, role- and permission-based access control, strict data partitioning between organisations, document access through temporary signed links, and batch sealing using chained SHA-256 fingerprints allowing any alteration to be detected.
Every data subject has the rights of access, rectification, erasure, restriction, objection and portability. A member exercises these rights with their insurance organisation, which is the controller for that data; Katalyxpharma provides the Insurer with the assistance needed to respond. Portal users exercise the rights relating to their account directly with Katalyxpharma, at privacy@katalyxpharma.com. A response is provided within 30 days. Some erasure requests may be refused where retention is required by law.
This policy may be updated to reflect legal, regulatory or functional developments. Substantial changes are notified to the insurer account administrator. The date of last update appears at the top of the document.
For any question regarding data protection within the insurer portal: Email: privacy@katalyxpharma.com — Address: Katalyxpharma, Douala, Cameroon. For requests concerning a member's data, please contact your insurance organisation first.
© 2026 Katalyxpharma — For any question regarding your data, write to privacy@katalyxpharma.com