Version 2026-09-18
This agreement is between نجمك ("the Provider", "we") and the clinic or business that registers an account ("the Clinic", "you"). For patient data, the Clinic is the data controller: it decides what is collected and why. The Provider is the data processor: it handles that data only on the Clinic's behalf and instructions.
The Provider offers an appointment book, patient records, a public booking page, WhatsApp appointment reminders and post-visit review requests, and related reports. The appointment book is free; messaging is a paid feature subject to the chosen plan.
The service is not designed to store medical records, diagnoses or payment card data; the Clinic agrees not to enter them.
We process patient data only to provide the service to the Clinic. We do not sell it, rent it, share it with third parties for their own purposes, use it to market to patients, or combine it with data of other clinics. Aggregate counts without identities (such as the number of messages sent) are used for billing and service improvement.
Our administrative console shows counts and billing information only; it does not display patient records. Our staff access patient data only when the Clinic asks for support that requires it, and are bound by confidentiality.
Encrypted connections (HTTPS), hashed passwords, strict separation between clinics, role-based access inside the Clinic (owner and reception staff), and regular backups. No system is perfectly secure; the Clinic is responsible for keeping its passwords and devices safe.
Data is hosted in Frankfurt, Germany (DigitalOcean). Sub-processors are limited to the hosting provider and the messaging channel the Clinic chooses (WhatsApp and, where enabled, SMS). We tell the Clinic before adding a new sub-processor that handles patient data.
Any patient can stop messages at any time by replying STOP (or إلغاء). The number is then blocked permanently for that Clinic. The opt-out list is kept even after an erase so the person is never messaged again.
If we become aware of a breach affecting the Clinic's patient data, we notify the Clinic without undue delay, and no later than 72 hours, with what we know and the steps taken.
The Clinic can export all its data and erase all patient data at any time from the dashboard. On termination, we delete the Clinic's patient data within 30 days, except what the law requires us to keep (such as invoices).
If this agreement changes materially, we publish a new version and ask the Clinic to accept it. The accepted version, date and account are recorded.