Privacy Policy

Last updated: [date of publication]

1. Who we are

961doctor is software for clinics and polyclinics, provided by [company legal name], registered in [country] under number [registration number], with its address at [registered address] ("we", "us").

We play two roles. For the website, the accounts of clinic staff and the accounts patients create in the patient app, we decide how information is used: we are the controller. For the records clinics keep about their patients, the clinic decides how that information is used and we process it only on the clinic's instructions: the clinic is the controller and we are its processor.

2. Who this policy covers

• Website visitors who read our public pages or try the live demo.
• Clinic staff: owners, admins, doctors, nurses, assistants and accountants who have a 961doctor account.
• Patient app users: people who create a patient account to find doctors, book visits and see the records clinics share with them.
• Patients of clinics that use 961doctor. If you are a patient, your clinic is responsible for your records; please contact your clinic first. This policy explains what happens to your information inside our system.

3. What we collect

Website visitors

• Technical information every website receives, such as your IP address, browser type and the pages you request, kept in server and security logs.
• If you allow visit counting: anonymous page views and page load times through Cloudflare Web Analytics. See Cookies and similar technologies.
• The demo is the real app with a shared sample clinic and shared logins. What you enter in the demo is stored on our servers, is visible to everyone else trying the demo, and is reset from time to time. Do not enter real patient information in the demo.

Clinic staff

• Name, email address, role, specialty and the clinic and doctors you work with.
• Your password, stored only as an Argon2id hash. We never see or store the password itself.
• Sign-in records: time, IP address, device name and browser, failed sign-in attempts, and changes to accounts and passwords, kept in an audit log.
• For doctors: working hours, locations, service prices, income and expense entries, and subscription and billing details.

Patient app users

• Your account: name, email address, password (stored only as an Argon2id hash), preferred language, and whether you confirmed your email.
• Your profile, if you give it: mobile number, date of birth, sex and city. Clinics receive these details when you book with them, to open your record.
• Your bookings and cancellations, and which clinic records are linked to your account (after you book online, or enter a code the clinic gave you).
• Sign-in records: time, IP address, device name, failed attempts and account changes, kept in an audit log.

The patient app shows you records clinics keep about you (visits, prescriptions, allergies, vital signs and bills), but those records remain the clinic's. Doctors' private notes are never shown.

Patients (on behalf of clinics)

• Identity and contact details: name in English and Arabic, sex, date of birth, phone number, email address and preferred language.
• Health information entered by the clinic or by the patient through an intake form: allergies, chronic conditions, current medicines, past surgeries, visit notes, diagnoses and prescriptions.
• Appointments, invoices and payments, including the currency and exchange rate used.
• Consent records, such as whether the patient agreed to receive WhatsApp messages, and the signed intake forms.
• A history of messages sent to the patient and their delivery status.

4. How we use it

• To provide the service clinics sign up for: scheduling, records, prescriptions, payments, reminders and reports. (Legal basis: performance of our contract with the clinic.)
• To run the patient app: showing listed doctors and their free times, booking and cancelling, telling the clinic, and showing you the records clinics share with you. (Performance of our contract with you.)
• To keep accounts secure: verifying sign-ins, locking an account after five wrong passwords, detecting reuse of old sign-in tokens, and keeping an audit log. (Legitimate interest in security, and legal obligations.)
• To bill subscriptions and keep accounting records. (Contract and legal obligations.)
• To understand use of our public website, only if you allow visit counting. (Consent.)
• To contact clinic staff about their account, security, billing and changes to the service. (Contract and legitimate interest.)

We do not sell personal information, we do not use patient information for advertising, and we do not use it to train artificial intelligence models.

5. Patient health information

Health information is sensitive. Inside 961doctor:

• Each clinic's records are kept separate by the database itself, so one clinic cannot read another's records.
• Visit notes, conditions and prescriptions are visible only to doctors. Assistants see appointments, contact details, allergies and payments. Allergies are shown to all clinic staff for safety.
• Answers a patient gives in an intake form are held for review and only update the record after a doctor approves them.
• We access patient records only when the clinic asks us to (for example for support), when needed to keep the service running or secure, or when the law requires it.

Each clinic signs a data processing agreement with us before it stores real patient information. [Confirm the health-data and personal-data laws that apply, for example Lebanese Law No. 81 of 2018 on Electronic Transactions and Personal Data, and the EU GDPR where patients are in the EU.]

6. WhatsApp and email

• Clinics send appointment confirmations, reminders, intake form links, prescriptions and receipts through the WhatsApp Business Platform operated by Meta, and by email.
• WhatsApp messages go only to patients who agreed to receive them. A patient can reply STOP at any time to stop messages.
• Message text does not include diagnoses or medicine names. Prescriptions and receipts are sent as PDF attachments, only to patients who agreed.
• Intake form links are unique to each patient, ask for the date of birth before opening, lock after five wrong attempts and expire after 7 days.
• Meta processes message content and phone numbers to deliver WhatsApp messages, under its own terms and privacy policy.

7. Who we share it with

We share information only with service providers that help us run 961doctor, under contracts that require them to protect it and use it only for that purpose:

We may also disclose information when the law requires it, to protect people's safety, or as part of a sale or merger of our business, in which case this policy continues to apply.

8. Where it is stored

961doctor data is stored in [hosting region, chosen to meet the health-data rules that apply]. Some providers listed above may process information in other countries. Where that happens we use the safeguards the law requires, such as standard contractual clauses. [Confirm with counsel.]

9. How long we keep it

• Patient records are kept for as long as the clinic uses 961doctor and then for the period medical-records law requires, [retention period], unless the clinic asks us to return or delete them sooner where the law allows.
• Staff accounts are kept while the person works at a clinic. Deactivated accounts are kept so past records still show who did what, until the person deletes their account.
• Patient app accounts are kept until you delete them.
• Closed clinics: when a clinic owner deletes their account, the clinic closes and its records stay sealed for 30 days, then are deleted, except billing records.
• Audit and security logs are kept for [period].
• Billing records are kept for the period tax and accounting law requires, [period].
• Website logs are kept for [period].

When a subscription ends, the account becomes read-only so the clinic can export its records. Nothing is deleted before the retention period ends.

10. Deleting your account

You can delete your account yourself at any time: in the app (patients in My profile, staff in Account) or on the web. See Delete your account for the steps and for what is deleted and what is kept.

• Your sign-in (email, name, phone, password) and, for patients, your profile are deleted at once, and every device is signed out.
• Upcoming appointments you booked in the app are cancelled, and the clinic is told.
• Records clinics keep about you stay with those clinics, no longer linked to your account, because doctors must keep medical records by law. Contact the clinic about them.
• Security logs and billing records are kept for the periods given in How long we keep it.

11. How we protect it

• Passwords are hashed with Argon2id. Passwords must be at least 12 characters, and five wrong attempts lock an account for 15 minutes.
• Sign-in tokens are short-lived, and signing out, deactivating a person or suspending a clinic takes effect on their next request.
• New accounts and password resets use one-time temporary passwords that must be changed at first sign-in.
• Each request runs with the permissions of the signed-in person, and the database enforces which clinic's records they can reach.
• Connections are encrypted with HTTPS. [Confirm encryption at rest, backups and their testing, and penetration testing before publication.]

No system is perfectly secure. If a breach affects your information, we will tell the clinic and, where the law requires, the authorities and the people affected.

12. Your rights

Depending on the law that applies to you, you may have the right to ask for a copy of your information, to have it corrected or deleted, to object to or restrict its use, to take it elsewhere, and to withdraw consent at any time.

• Patients: please contact your clinic, which controls your records. We help clinics answer these requests.
• Patient app users, clinic staff and website visitors: you can see and correct your account details in the app and delete your account at any time. For anything else, contact us at privacy@961doctors.com.

You can also complain to the data-protection authority where you live. [Name the relevant authority.]

13. Cookies and similar technologies

We use no advertising or tracking cookies.

You can change your choice at any time: open privacy choices.

14. Children

961doctor is used by clinic staff and by adult patients. The patient app is not meant for children under 18: a parent or guardian arranges a child's visits with the clinic. Clinics may keep records about patients who are children; in that case the clinic deals with the child's parent or guardian, and the intake form is filled by them.

15. Changes to this policy

We will post any change on this page and update the date at the top. If a change is significant, we will tell clinic admins by email before it takes effect.

16. Contact us

[Company legal name], [registered address]. Email: privacy@961doctors.com. [Data protection officer, if one is appointed.]