Privacy Policy

When you register, we collect identification details: full name, verified email address, mobile phone number, date of birth, gender, and optional profile photograph.

As you build your Electronic Medical Record (EMR) and consult with physicians, our system securely stores medical history, active medications, vital signs, lab reports, imaging files, allergies, immunization records, and family health history.

During consultations, audio and video are streamed in real time for telemedicine. With your explicit per-session consent, our AI Scribe processes clinical speech solely to draft doctor consultation notes. Raw media recordings are immediately purged once the consultation note is reviewed, approved, and signed by the licensed clinician; only the structured medical note persists.

To deliver telemedicine and record management on mobile devices, the Sehat Sahoolat mobile application requests the following permissions with your explicit authorization:

• Camera: Used exclusively during active video consultations with your clinician, or when scanning QR codes to verify medical records or prescriptions.

• Microphone: Used solely for two-way audio communication during live telehealth appointments with your treating doctor.

• Photos & File Storage: Used only when you choose to attach or upload external lab reports, diagnostic images, or prior medical summaries to your EMR.

• Notifications: Used to send vital appointment reminders, doctor arrival alerts, prescription ready notifications, and health tracking updates.

We do not access your background location, contacts, or any personal device files unrelated to your healthcare management.

Your personal and healthcare data is processed solely to: schedule and conduct virtual consultations with licensed clinicians, maintain an accurate, longitudinal EMR across your family profile, generate validated digital prescriptions, dispatch appointment reminders, and comply with clinical governance requirements.

We do NOT sell, rent, or trade your personal or health data to data brokers, advertisers, or any commercial third parties.

We never use your personal health data to train external public AI models. Any quality-assurance or epidemiological analytics are strictly executed on fully anonymized, de-identified datasets.

Treating clinicians can access only the parts of your EMR relevant to an active or confirmed upcoming consultation, and only for a time-delimited window before, during, and after the appointment. Every clinician access event is recorded in an immutable audit trail that you can review directly from your profile.

Authorized partner pharmacies or diagnostic laboratories only receive the specific prescription or lab requisition details that you explicitly choose to dispatch.

Engineering and operations personnel have zero direct access to unencrypted patient health records. Privileged system access is restricted to senior compliance officers via hardware-key multi-factor authentication (MFA) solely under audited incident-investigation procedures.

All patient data, EMR documents, and digital prescriptions are encrypted at rest using industry-standard AES-256 and transmitted using TLS 1.3 encryption.

Database backups are cryptographically secured and stored with strict geographic residency protocols. We perform automated vulnerability scans, regular third-party penetration testing, and continuous audit logging to protect against unauthorized access.

You have the right to access and export your complete Electronic Medical Record as a QR-verified PDF at any time, directly through the mobile app or web portal.

You can update demographic information or submit correction requests for any patient-supplied health metric directly in your profile.

Account & Data Deletion (Google Play & Apple App Store compliance): You can request complete deletion of your account and associated personal data at any time. In the mobile app, navigate to Profile > Account Security > Delete Account. Alternatively, email privacy@sehatsahoolat.com or support@sehatsahoolat.com with "Account Deletion Request". Upon verification, your user profile, credentials, and non-statutory records will be permanently purged within 30 days. Please note that signed clinical consultation notes and dispensed prescription logs must be retained for the minimum statutory period mandated by PMDC and healthcare regulatory laws.

Sehat Sahoolat allows primary account holders to manage healthcare records for family members, including minor children, under our Family Health module.

Minors cannot register independent accounts; their profiles must be created and supervised by a verified parent or legal guardian who consents to consultations and EMR management on their behalf.

Sehat Sahoolat is operated by Web Health Online (Pvt.) Ltd., registered under the laws of Pakistan.

If you have questions regarding this Privacy Policy, wish to exercise your data protection rights, or need assistance with your personal data, please contact our Data Protection Officer:

• Data Protection Officer: privacy@sehatsahoolat.com

• General App & Patient Support: support@sehatsahoolat.com

• 24/7 Virtual Hospital Helpline: +92 305 111 7784

We review and reply to all data protection requests within one business day.