Privacy Policy

Summary

1. Introduction

IlajDesk ("we," "our," or "us") is a clinic management software-as-a-service (SaaS) platform operated from Pakistan. This Privacy Policy explains how we collect, use, disclose, and safeguard your information when you use our website, applications, and related services (collectively, the "Service").

By using the Service, you agree to the collection and use of information in accordance with this policy. If you do not agree, please discontinue use of the Service.

This policy applies to all users of the Service, including clinic owners, doctors, staff, receptionists, and any authorized personnel who access the platform on behalf of a clinic.

2. Information We Collect

2.1 Information You Provide

• Account Information: Name, email address, phone number, and password when you create an account.
• Clinic Details: Clinic name, address, phone number, services offered, staff information, and branding settings.
• Patient Records: Patient names, contact details, medical history, prescriptions, dental charts, treatment notes, and appointment records that you enter into the platform.
• Financial Data: Invoice details, payment records, and billing information you process through the platform.
• Communications: Messages you send to us through support channels or in-app feedback forms.

2.2 Information Collected Automatically

• Usage Data: Pages viewed, features used, actions taken, time spent, and interaction patterns within the platform.
• Device Information: Browser type, operating system, device type, screen resolution, and language settings.
• Log Data: IP address, access times, referring URLs, and error logs.
• Cookies & Similar Technologies: See our Cookie Policy for details.

2.3 Information from Third Parties

• Payment Processors: Transaction confirmation data from payment gateways (e.g., JazzCash, EasyPaisa, bank transfers).
• Analytics Providers: Aggregated usage statistics from tools like Google Analytics.

3. How We Use Your Information

• Provide the Service: Operate, maintain, and deliver the features of the IlajDesk platform.
• Manage Your Account: Create and maintain your account, authenticate users, and manage access permissions.
• Process Transactions: Handle billing, invoices, payments, and financial records.
• Communicate with You: Send service-related emails (account updates, security alerts), respond to support requests, and send optional product updates (which you can opt out of).
• Improve the Platform: Analyze usage patterns to improve features, fix bugs, and develop new functionality.
• Ensure Security: Detect and prevent fraud, abuse, and security incidents.
• Comply with Law: Meet legal, regulatory, and audit requirements applicable to our operations.

4. How We Share Your Information

We do not sell, rent, or trade your personal information. We may share data in the following limited circumstances:

• Service Providers: Third-party vendors who perform services on our behalf (e.g., cloud hosting, payment processing, email delivery). These providers are contractually bound to use your data only for the purposes we specify.
• Legal Requirements: If required by law, regulation, legal process, or governmental request.
• Business Transfers: In connection with a merger, acquisition, or sale of assets, with prior notice to affected users.
• With Your Consent: For any other purpose, with your explicit permission.

Sub-Processors: A current list of third-party sub-processors we use is available upon request. We review each sub-processor's security posture before engagement.

5. Patient Data & HIPAA Considerations

IlajDesk is designed to help clinics manage patient information. We understand the sensitivity of health data and take this responsibility seriously.

• Data Ownership: All patient records, medical history, and clinical data entered into IlajDesk are owned by you (the clinic). We act as a data processor, not a data controller, for this information.
• Access Control: Only authorized personnel within your clinic can access patient data based on the role-based permissions you configure.
• Data Portability: You can export your patient data at any time from the platform settings.
• Termination: Upon account deletion or termination, we retain your data for a limited period as required for data export, then permanently delete it from our active systems.
• PHI Handling: If you are a HIPAA-covered entity, a Business Associate Agreement (BAA) is available upon request and governs how we handle Protected Health Information (PHI).

6. Data Security

We implement reasonable and appropriate administrative, technical, and physical safeguards designed to protect your data, including:

• Encryption of data in transit (TLS 1.2+) and at rest
• Role-based access controls with unique user credentials
• Regular security assessments and vulnerability testing
• Automated audit logging of user actions
• Secure cloud infrastructure with physical security controls
• Employee security training and clean-desk policies

No method of transmission or storage is 100% secure. While we strive to protect your data, we cannot guarantee absolute security.

7. Data Retention

• Patient Data: Retained as long as your account is active, or as required by applicable medical-record retention laws. You control when to delete patient records.
• Account Data: Retained for the duration of your subscription plus a reasonable period (up to 24 months) for backup, audit, and legal compliance purposes.
• Usage & Log Data: Retained for up to 12 months for analytics and security monitoring.
• Payment Records: Retained as required by applicable tax and financial regulations.

You may request deletion of your data at any time by contacting us. We will process deletion requests within 30 days, subject to any legal retention obligations.

8. Your Rights

You have the following rights regarding your personal data:

• Access: Request a copy of the personal data we hold about you.
• Correction: Request correction of inaccurate or incomplete data.
• Deletion: Request deletion of your personal data, subject to legal retention requirements.
• Export: Export your data in a machine-readable format.
• Objection: Object to processing of your data for certain purposes.
• Withdraw Consent: Where processing is based on consent, withdraw it at any time.
• Lodge a Complaint: File a complaint with your local data protection authority if you believe your rights have been violated.

To exercise any of these rights, contact us at privacy@ilajdesk.com. We will respond within 30 days.

9. International Data Transfers

IlajDesk is operated from Pakistan. If you access the Service from outside Pakistan, your data may be transferred to and processed in Pakistan. By using the Service, you consent to such transfers. We ensure that appropriate safeguards are in place for international transfers, including standard contractual clauses where required.

10. Children's Privacy

The Service is not directed to individuals under 18 years of age. We do not knowingly collect personal information from children. If you are a parent or guardian and believe your child has provided us with personal data, please contact us immediately.

11. Changes to This Policy

We may update this Privacy Policy from time to time. We will notify you of material changes by posting the updated policy on this page with a revised "Last updated" date and, for significant changes, sending you an email notification. Your continued use of the Service after changes are posted constitutes acceptance of the updated policy.

12. Contact Us

If you have any questions or concerns about this Privacy Policy, please contact us:

• Email: privacy@ilajdesk.com
• Address: Islamabad, Pakistan