Privacy Policy

Information We Collect for Patients: When registering as a patient, we collect: Full name, phone number (primary identifier), date of birth/age, gender, nationality, address (as text and map location), preferred language. For dependent patients (family members): We collect full name, date of birth, relationship to primary account holder, and use the primary account holder's address. Optional medical information: Medical history, health condition, medications, allergies, uploaded medical records.

Information We Collect for Service Providers: For doctors: Specialty, academic level, certificates, syndicate registration number and date, clinic information. For nurses: Workplace, degree type, transportation method, expected availability. For physiotherapists: Workplace, owned equipment, monthly availability. All service providers: Phone number, name, professional credentials. Service-provider public profile: your public name, specialty, affiliated institution, degrees, profile photo, nationality, and gender are shared with patients connected to your services. If your profile is activated as "public", this information is additionally available in the in-app public medical directory and may be viewed by any user. Date of birth and phone numbers are never displayed publicly.

Service and Order Information: We collect service request details: Service type, preferred time, preferred service address, patient notes, order and visit status. For lab tests: Required test types, uploaded prescription images. Financial information: Service prices, payment method, transaction information. For online payments: We retain transaction metadata including payment status, transaction amount, transaction identifiers, and transaction date, but we do not retain any payment card data.

Use of Information: We use your information to: Facilitate requesting and providing home healthcare services, connect patients with appropriate service providers, manage appointments and visits, process payments and financial transactions, send service updates and reminders, improve our services and user experience, comply with legal and medical requirements, communicate with you about your orders.

Information Sharing: We share your information with: Healthcare service providers assigned to serve you (doctors, nurses, therapists), including order details, notes, and patient-submitted attachments; our internal order management team; certified laboratories (for lab test services); the payment gateway provider (when you choose online payment) for payment processing, where we share only the transaction amount, currency, and order reference, and we do not share any medical or health data with the gateway provider; advertising, measurement, and attribution partners (see the next clause for details). We do not make your information publicly available or accessible to unassigned service providers. Service providers can only access information and attachments of patients assigned to them. We do not sell your personal information to any third party.

Advertising, Measurement, and Attribution Partners: To measure the effectiveness of our marketing, improve the user experience, and reach patients in need, we use mobile measurement and attribution providers (such as AppsFlyer) and integrate with advertising platforms (such as Meta and Google). On our website and marketing pages we also use Google's web analytics and advertising tools, including Google Analytics for page-usage analysis and Google Ads for conversion measurement. Through these integrations, certain data may be collected and shared with our partners, including advertising identifiers (such as IDFA and GAID), your IP address, device and operating system information, order information, and in-app event data. Examples of events we may measure include, but are not limited to: app installs, app opens, registration, page views, adding items to cart, initiating checkout, and purchases. These usage events may include the category of service you interact with (for example physiotherapy, lab test, or doctor consultation) for measurement and audience-segmentation purposes, but we do not share any details about your medical condition, diagnosis, or visit notes. This data is used for attribution, campaign optimization, targeting, measurement, and fraud prevention. We do not share any health or medical information with these partners. Each partner processes the data it receives according to its own privacy policy, and some data may be shared with these platforms by default when an integration is enabled. In addition, when you take part in a prize draw, your entry is recorded on our own servers, and the name, phone number, and account type held on your account are used to identify you and to contact you if you win. An analytics provider may also receive a record that an entry was made. No medical information is shared in this process.

Third-Party Payment Processing: When you choose online payment, payments are processed through a third-party payment gateway provider. The gateways currently offered are Qi Card and ZainCash. Your card or wallet details are entered directly on a secure page hosted by the payment gateway provider. Saleem does not receive, process, or store any payment card data such as card numbers, expiration dates, or security codes (CVV). The data we retain in relation to online payments is limited to: payment status (successful, failed, cancelled), transaction amount and currency, transaction identifiers (internal reference numbers and payment gateway identifiers), a reference the gateway returns so that a wallet you have already used can be offered again, and transaction date and time. For an order that is created only after payment is confirmed, we also hold the details of the order you were about to place until the payment resolves. Any personal or financial data you enter on the payment gateway page is governed by the gateway provider's own privacy policy, not Saleem's privacy policy. We recommend reviewing the payment gateway provider's privacy policy before completing any online transaction.

Data Retention and Account Deletion: When you request account deletion, your request will be processed within 7 business days. After processing, your account will be deactivated and some data will be deleted if present (profile picture, app preferences, secondary phone number, addresses, security session data such as verification codes and temporary login tokens). We retain your essential data (name, phone number, service records, financial transactions) for 7 years for accounting, financial auditing, and healthcare record purposes. After the retention period expires, all personal data is permanently deleted and service records are fully anonymized. To delete your account: Contact us via WhatsApp, phone, or email.

Updating Personal Information: Name or date of birth cannot be updated directly in the app to ensure medical record accuracy. To update this information: Contact support team via WhatsApp, we will verify the requested changes and process them as needed.

Device and Session Information: We collect technical information: Device type and operating system, notification tokens (FCM tokens), voice call tokens (VOIP tokens), your device's IP address. For login session management, we store session tokens with creation and expiration timestamps along with the IP address and device or browser information used to sign in. You can review your active sessions and sign out from any or all of them from the app's sign-out screen.

Data Security: We work to protect your data through encryption in transit, encryption of consultation message content at rest, access restricted to those who need it for their role, periodic security reviews, and servers in managed data centres. No method of transmission or storage over the internet is completely secure, and we do not and cannot guarantee absolute security. We do not promise that your data will never be accessed, disclosed, altered, or destroyed by a breach of our safeguards. You are also responsible for the security of the device and the phone number you use to sign in. If we become aware of a breach that affects your personal data, we will act on it and, where the law requires, notify you.

User Rights: You have the right to: Request correction of inaccurate information, request deletion of your data (subject to legal restrictions). You can also contact us to inquire about how your data is handled and we will respond to your inquiries.

Minors and Children: The app is not intended for persons under 18 years to create independent accounts. Parents/guardians can add their children as dependent patients under their accounts. We do not collect information from minors directly without parental consent.

Notifications and Communication: We may contact you via: App notifications about order status and appointments, SMS or WhatsApp messages for identity verification and updates, important service updates, promotional offers. Verification codes and WhatsApp messages are delivered through third-party messaging providers, which receive your phone number and the content of that message for the purpose of delivering it. Push notifications are written to be generic and do not include your medical details, because a notification can appear on a locked screen that other people may see.

Cookies and Tracking: The app may use: Device identifiers for security, usage analytics to improve service, location data (with your permission) to determine service addresses. On our website saleemapp.com and our pages under the try.saleemapp.com subdomain, we use cookies and similar technologies, including from third parties such as Google and Meta, for performance measurement and advertising purposes. You can control or disable cookies through your browser settings, though disabling them may affect some website functions.

App Analytics: We collect data about your app usage to improve our services. This data may include, but is not limited to: screens you visit, services you request, order completion success or failure, and user type. This data is linked to your account to understand and improve user experience.

Session Recording: We may record app usage sessions for a selected group of users to improve user experience and identify technical issues. A recording captures how you move through the screens, not the audio or video of you or of a consultation. This is done through our analytics provider and is used internally only to improve the app.

Feedback and Comments: When you choose to submit feedback or comments through the app (whether from the dedicated feedback screen or from other places within the app), you agree that we collect this information to improve our services. The data we collect includes: the content of the feedback, the source location within the app, device type and operating system, and app version.

Changes to Privacy Policy: We may update this policy to reflect: Changes in our services, new legal requirements, improvements in data protection. We will notify you of substantial changes via the app or email. Continued use of the app means you agree to the updated policy.

Contact Us: For any privacy-related questions or requests: WhatsApp: +964 785 033 5500, Email: info@saleemapp.com.

Online Consultation and Chat Information: When you book an online consultation, we record the booking time, the doctor, the consultation type, and the fee. For a video or voice consultation, we also record that the call took place, who joined it, and when each participant joined and left, together with any free extension the doctor granted. We use this to operate the service and to measure punctuality and reliability. We do not record, store, or listen to the audio or the video of a consultation. When you use in app chat, we store the messages you send, including text, images, files, and voice messages, together with their timestamps and their delivery and read status. Chat content forms part of your medical record and is retained accordingly.

Confidentiality of Your Consultations: Messages between a patient and a doctor are encrypted in transit and encrypted while stored on our servers. The key used to encrypt them is held in server side configuration and is not stored alongside the messages, so the stored messages cannot be read from the database alone. We want to be precise about what this means, and about what it does not mean. Our application restricts the reading of a consultation to the participants of that conversation, and our support and operations staff are not given access to it in the ordinary course of their work. This is a confidentiality control enforced by our systems and our internal rules. We do not describe it as end to end encryption, and we do not claim that message content is technically unreadable by us: Saleem, as the operator of the service, retains the technical ability to decrypt content, and a small number of authorized personnel can exercise that ability, in the limited circumstances described in the following clause and where we are required to do so by law. Access to conversation content is recorded in an audit log, including who accessed it, when, and why.

Reporting Abuse: If you report a message for abuse, you consent to our team accessing that reported message, together with the limited surrounding context needed to understand it, for the purpose of reviewing your report. This access is time limited, is recorded in an audit log, and is used only to assess the report and take appropriate action. Other than in this case, and where the law requires it, we do not read your consultations with a doctor. We may disclose information to the competent authorities where we are legally obliged to do so.

Service Providers We Rely On: We do not run every part of the service ourselves. We use the following kinds of third-party providers, each of which receives only the data it needs for its purpose, and each of which processes that data under its own terms and privacy policy. Cloud hosting and file storage: our servers, our database, and the files you upload (such as prescriptions, medical documents, and chat attachments) are hosted with a cloud infrastructure provider, currently Amazon Web Services. Real time video and voice: online consultations are carried by a real time communication provider, currently LiveKit, which transports the audio and video of your call between you and the doctor while the call is happening; the call is not recorded and no copy of its audio or video is stored by us or by that provider on our behalf. Verification codes and WhatsApp messages: delivered through messaging providers, currently Twilio and Respond.io, which receive your phone number and the message content. Push notifications: delivered through the notification service of the application platform, currently Expo, which receives a device token and the notification text. Payment gateways: currently Qi Card and ZainCash, as described above. Analytics, session replay, and product measurement: currently PostHog. Advertising, attribution, and measurement partners: as described in the advertising clause above. Maps and address lookup: Google Maps, used to turn a location you choose into a readable address. Voice to text for providers: when a healthcare provider dictates a clinical note, the audio of that dictation is sent to a speech to text provider, currently ElevenLabs, and the resulting text may then be tidied up by a language model accessed through a model routing provider, currently OpenRouter. Medical coding: the World Health Organization ICD-11 service, used to match a condition to a standard medical code. Because these providers operate internationally, your data may be processed or stored outside Iraq. We do not sell your personal information, and we do not share health or medical information with advertising or measurement partners.

Features That Use Artificial Intelligence: Some features use automated language models. A healthcare provider may dictate a clinical note by voice, in which case the recording of that dictation and the resulting text are processed to produce a written note. We may also generate a summary of a patient's health record, including conditions, medications, allergies, and family history, from the orders and notes already held on that record, so that a provider can see a patient's history at a glance. Where the provider we use offers it, we request that your content is not retained by them and is not used to train their models. These features are assistive only. Their output is a draft for a qualified person to read and correct, it is not a diagnosis, it is not medical advice, and it is not a substitute for the judgement of your treating provider. Automated output can be incomplete or wrong, and no decision about your care is made by an automated system alone. If you see something inaccurate on your record, contact us and we will correct it.

Links We Share and Campaign Measurement: When we share a link to Saleem, for example in an advertisement, a social media post, a message, or a QR code, that link may be a tracking link. When you open a tracking link, we record that the link was opened, when, and the type of device (for example iPhone or Android). We do not record your IP address or your browser details for this purpose. The link may open the application directly or pass through the app store, and our attribution partner (currently AppsFlyer) may receive that the link was opened, as described in the advertising clause above. The application keeps a reference to that visit on your device, including before you sign in or create an account, so that if you later take a measured action, such as completing a health campaign questionnaire or booking a service, we can record that the action followed the link. That record is linked to your account and to the record of the action, and authorised Saleem staff can see it. We use this information to measure and improve our campaigns and marketing, to understand which channels help people reach care, and, where we run partner or referral programmes, to credit the partner who shared the link. We do not use it to make any decision about your care, and we do not share any health or medical information with advertising or attribution partners. In our own records, a link being opened that is not followed by a measured action is not linked to your identity. Links shared by a third party, including links shortened through a third-party link service, are also processed by that service under its own privacy policy. You can avoid this measurement by opening the application directly rather than through a link.