Privacy Policy

Effective date: 11 August 2026

This Privacy Policy explains what HealthCare ("we", "us", the "Service") collects about you, why we collect it, who we share it with, and the choices you have.

HealthCare is operated by DoctorBooking (placeholder). You can reach us at [email protected].

Health information is the most sensitive data we hold, and most of this policy is about how we protect it. Please read at least the sections "What we collect", "Who we share it with" and "Your choices".

1. Who this policy covers

This policy covers people who use HealthCare as patients — to find doctors, book appointments, message a doctor, and keep their health records.

Doctors, secretaries, hospitals, laboratories, clinics and pharmacies use HealthCare under a separate agreement. When a doctor writes a note about you, they are acting as your healthcare provider, and their own professional and legal duties apply to them in addition to this policy.

2. What we collect

Information you give us

Your phone number. This is how you sign in — we do not use passwords for patients.

Your profile: first and last name, and optionally your email address, date of birth,

gender, and a profile photo.

People you book for ("dependents"): the name and phone number of a family member or

other person when you book an appointment on their behalf. Only add someone else's details if you are entitled to do so.

Your health information that you choose to record: allergies and chronic conditions you

add to "My health".

Messages and reviews: what you write to a doctor in chat (including any image or PDF you

attach), what you write to our support team, and the reviews and ratings you publish about doctors.

Information created when you use the Service

Appointments: which doctor, when, at which location, in person or by video, whether you

attended, cancelled or rescheduled.

Clinical records your doctor creates about you: visit notes (your complaint, the doctor's

findings, diagnosis and follow-up advice), measurements taken during a visit (for example weight or blood pressure), prescriptions (medicines and laboratory tests), and documents your doctor files on your record such as laboratory reports and scans.

Dispensing records: which pharmacy handed over which medicines from your prescription, in

what quantity, and when.

Favourites and search activity within the app, so the app can show you the doctors you saved.

Information collected automatically

Device and technical data: your device's push-notification token, the language you chose,

app version, and the IP address your requests come from.

Server logs, kept for security and troubleshooting. These record the time of a request and

its outcome. Log files are retained for 30 days.

We do not collect your location in the background. The app does not track where you are.

3. Why we use your information

We use your information only for the purposes below.

Purpose	What this involves
To let you sign in	Sending a one-time code by SMS to your phone number and verifying it.
To provide the Service	Showing you doctors, taking your booking, and telling the doctor who is coming.
To carry your health record	Storing and showing you your prescriptions, visit notes, documents and health summary, and making them available to the right clinician.
To let a pharmacy fill your prescription	Showing a pharmacy the prescription that matches the code you present.
To keep you informed	Appointment reminders, notice that a pharmacy dispensed your medicines, replies from your doctor, and messages from support.
To keep the Service safe	Detecting abuse, rate-limiting, and investigating suspicious access to prescription codes.
To meet legal obligations	Keeping medical records for the period the law requires, and responding to lawful requests.

We do not sell your personal information. We do not use your health information for advertising, and we do not show third-party advertising in the app.

4. Who we share it with

The doctor you book with

When you book an appointment, that doctor (and any secretary they have authorised) can see your name, phone number, and the appointment itself. They can also see:

Your allergies and chronic conditions, unless you have switched sharing off — see

"Your choices" below.

Visit notes and prescriptions they themselves wrote about you. A doctor does not

automatically see notes written by a different doctor.

Documents on your record that they uploaded themselves, plus any document you have

explicitly shared using the per-document sharing switch.

Pharmacies

A pharmacy can look up a prescription only by entering the dispensing code printed on it or shown in the app. When they do, they see the prescription's medicines, your name and phone number, and who prescribed it. A pharmacy never sees your diagnosis, your visit notes, your health summary, or your laboratory test orders.

⚠️ Anyone holding your dispensing code can look up that prescription. Treat it like a key — see the Terms of Service.

Hospitals, laboratories and clinics

If you book with a doctor at a facility, that facility's administrator can see the appointment as part of managing their doctors' schedules. They do not receive your clinical records.

Service providers who work for us

SMS delivery (OTPIQ, Iraq) — receives your phone number and the sign-in message so it can

deliver it.

Push notifications (Google Firebase) — receives your device token and the notification text

so it can deliver it to your phone. Notification text can include a doctor's name and the fact that you have an appointment or a dispensed prescription.

Hosting and infrastructure — stores the data on our behalf under contract.

These providers may only process your data on our instructions.

Others

We may disclose information where the law requires it, to protect someone's life or safety, or to establish or defend a legal claim.

5. International transfers

Google Firebase, which delivers push notifications, processes data on servers outside Iraq. If you do not want any data leaving the country through this route, you can turn off notifications for the app in your phone's settings, or switch off individual notification types in the app.

6. Your choices and controls

Health summary sharing. In "My health" you can switch off sharing your allergies and

conditions with doctors entirely, or hide an individual condition from doctors while keeping it for yourself.

Documents. Every document on your record has its own "share with my other doctors" switch.

It is off by default. The doctor who uploaded a document keeps access to it either way.

Notifications. You can turn each type of notification on or off in the app.

Language. You choose the language of the app and of the messages we send you.

Your profile. You can correct your name, email, date of birth and gender at any time. Your

phone number is your sign-in identity and cannot be changed in the app — contact us.

Reviews. You can delete a review you wrote.

7. How long we keep it

Your account and profile: for as long as your account exists.

Medical records (appointments, prescriptions, visit notes, documents, dispensing records):

retained even if you ask us to delete your account, for the period required by applicable medical-records law and for the establishment or defence of legal claims. Medical records are also records about the doctor's practice, and neither party can unilaterally erase them.

One-time sign-in codes: deleted within 24 hours.

Expired sign-in sessions: deleted within 7 days of expiry.

Server logs: 30 days.

8. How we protect it

All traffic between the app and our servers is encrypted in transit (HTTPS).

Your one-time sign-in code is never stored. We store only a keyed hash of it, and it expires

after 2 minutes.

Sign-in sessions are stored as hashes, are single-use, and rotate on every refresh.

Access to your clinical data is checked on every single request against your relationship with

that doctor and your own sharing settings.

Access to prescriptions by dispensing code is rate-limited and every lookup is logged,

including failed ones, so that guessing attempts can be detected.

No system is perfectly secure. If a breach affects your data, we will inform you.

9. Children

HealthCare is for people aged 18 and over. A parent or guardian books for a child using the "dependents" feature, under their own account. If you believe a child has created their own account, contact us and we will remove it.

10. Your rights

You may ask us to:

give you a copy of the personal information we hold about you;

correct information that is wrong;

delete your account (subject to the medical-record retention above);

stop sending you a particular kind of notification.

Write to [email protected]. We will respond within 30 days. If you are not satisfied with our response, you may complain to the competent authority.

11. Changes to this policy

We may update this policy. Every version has a version number and an effective date, and we keep a record of which version you accepted. If we make a change that materially affects your rights or how we use your health information, we will ask you to accept the new version in the app before you continue using the Service. Minor corrections will be published without asking again.

12. Contact us

DoctorBooking (placeholder) Placeholder address, Baghdad, Iraq [email protected]

2026-08-11