Privacy Policy

ChatDoctor operates the ChatDoctor website, the ChatDoctor mobile apps and the ChatDoctor patient portal (together, the Platform). We are based in Tunisia.

For the purposes of Tunisian Organic Law No. 2004-63 of 27 July 2004 on the protection of personal data — and of the GDPR where it applies to you — ChatDoctor is the controller of the information described in this policy, except in the cases set out in section 3, where a medical practice is the controller and we act on its instructions.

Privacy questions, requests and complaints: [email protected]. Our data protection contact: [email protected]. We will give you our registered postal address on request.

This policy applies to:

• visitors who browse the directory, articles and clinician profiles;
• patients with a ChatDoctor account, on web or mobile;
• people who book on behalf of someone else — a parent booking for a child, or an adult booking for a relative they are authorised to help.

It does not cover:

• what a practice does with your information in its own systems, on paper, or after your visit — its own privacy notice and the rules of medical confidentiality apply there;
• clinicians, clinic owners and clinic staff using the professional portal, who are covered by a separate notice and by their practice agreement with us;
• other websites, apps or services we link to.

This is the most important thing to understand about privacy on a health platform, so we will be blunt about it.

When ChatDoctor is the controller

Your account, your searches, the bookings you request, the notifications we send you and the documents you upload to your own patient record are handled by us, as controller, under this policy.

When your practice is the controller

When a practice uses ChatDoctor to run its schedule, record consultation notes, issue prescriptions or file the results it produces for you, that clinical record belongs to the practice. The practice decides what goes in it and how long it is kept; we host and process it on the practice’s instructions, as its processor. Your clinician remains bound by medical confidentiality independently of us.

In practice this means: if you ask us to change or delete something a clinician wrote about you, we will route the request to that practice rather than edit a medical record ourselves — and we will help you get there.

Information you give us

• Account and identity — name, email address, phone number, a hashed password, date of birth, gender, preferred language, profile photo, and the Google account identifier if you choose to sign in with Google.
• Family profiles — the profiles you create for children or relatives you book for: their name, date of birth, your relationship to them, and the details their visit needs.
• Booking information — the practice and clinician, date and time, visit mode (in person, remote or home visit), the reason for the visit and any symptoms you describe, and the status of the booking, including cancellations and missed appointments.
• Health information — the symptoms and reason for visit you share, the intake note that goes to the practice, documents you or a practice upload to your record (results, imaging reports, prescriptions, letters), the medications and dose times you track, vitals you record, and consultation entries a clinician shares with you.
• Messages — the messages and attachments you exchange with a practice through the Platform.
• Community content — comments you post on articles and the name displayed with them.
• Correspondence — what you send us when you contact support.

Information we collect automatically

• Location — the city and area you select. If, and only if, you grant permission in your browser or on your phone, your approximate device location, which we use to sort results by real distance. You can refuse or withdraw this at any time; the Platform still works without it.
• Technical and usage data — IP address, device and browser type, operating system, language, the pages and screens you view, timestamps and error diagnostics.
• Cookies and local storage — as described in section 12, plus a push notification token if you turn on push notifications.

Information from other people

• from a practice’s front desk, when staff create or change a booking for you by phone or at the counter;
• from the account holder who added you as a family member;
• from Google, if you use Google sign-in — your name, email and profile photo;
• from public professional directories, for clinician and clinic listings only (see section 15).

We do not buy personal data from data brokers, and we do not build advertising profiles.

We only use your information for the purposes below. Where the law requires a legal basis, this is ours.

We never use health information for marketing, advertising or profiling, and we never make a decision about you by automated means alone that produces a legal or similarly significant effect.

Sina helps you describe a problem in your own words and suggests the specialties and clinicians that fit. Here is exactly what happens to what you type.

• What is sent to our AI provider: the text of your request, and the city or area you are searching in — plus your approximate coordinates if you have shared your location.
• What is not sent: your name, email address, phone number, your medical documents, your past consultations, your medication list or your booking history.
• Who processes it: our AI provider, DeepSeek, on infrastructure outside Tunisia — see section 9 on international transfers. If the AI service is unavailable, matching falls back to a non-AI search and nothing is sent at all.
• What we do with it afterwards: we keep the text of the request to operate and improve matching, for the period in section 10. We do not use it to build a profile about you and we do not train models on identified data.

Because the request text travels to a third-party model, please do not type information that identifies you — your full name, national identity number, or anything you would not put in a search box. Describe the problem; that is all Sina needs.

If you go on to book, the reason for visit you confirm at the booking step is what is sent to the practice. Sina’s suggestions are not a diagnosis — see our Terms of Use.

We do not sell your information, to anyone, ever. We share it only in these situations.

• With the practice you choose. When you request a booking, the practice receives your name, contact details, the reason for visit and the appointment details. Their clinicians and the staff those clinicians have authorised can see it. Staff access is set by the practice and is limited to what their role requires.
• With people you authorise. A parent or guardian managing a family profile, or a relative you have added to your account, sees the information tied to that profile.
• With service providers acting on our instructions. They may only use the data to provide the service to us, under contract. See the table below.
• When the law requires it. In response to a valid court order or regulatory demand, or where disclosure is necessary to protect someone from serious harm. We check that every request is lawful and disclose only what is strictly required.
• In a business transfer. If ChatDoctor is involved in a merger, acquisition or sale of assets, information may transfer with it. We will tell you beforehand, and this policy continues to apply until you are given a new one.
• As aggregate statistics that cannot identify you — for example, average waiting times by specialty.

We contact you by email, SMS, WhatsApp, push notification and in the app itself. What we send falls into two groups.

• Essential messages — booking confirmations and changes, security alerts, one-time sign-in codes, and legal notices. These cannot be turned off while your account is open, because the service does not work without them.
• Optional messages — appointment reminders, follow-up nudges, digests and product news. You can turn these off per channel in your settings, and every marketing email carries an unsubscribe link.

On channels we do not control end to end — SMS, WhatsApp and lock-screen push previews — we deliberately keep the content thin. We send the time and the practice, not your symptoms, your diagnosis or your medication. You can also set quiet hours so nothing arrives overnight except genuinely urgent notices.

The Platform database and the encrypted object storage that holds medical documents are hosted in European data centres. Documents are stored with server-side encryption and are served only through short-lived signed links.

Some of the providers listed in section 7 — Google, Meta and DeepSeek — process data outside Tunisia and outside the European Economic Area. Where that happens we send the minimum needed for that provider to do its job, and we rely on contractual protections with the provider.

Transfers of personal data outside Tunisia are governed by the authorisation regime in Organic Law No. 2004-63 and by the Instance Nationale de Protection des Données à Caractère Personnel (INPDP). We operate within that regime and take the steps it requires of us. If you would like details of the safeguards that apply to a particular transfer, email [email protected].

We keep information only as long as we need it for the purpose we collected it for, or as long as the law requires.

• Everything travels over encrypted connections (TLS).
• Medical documents are stored with server-side encryption and are only reachable through signed links that expire within minutes.
• Passwords are stored only as salted hashes. We cannot read your password, and neither can our staff.
• Sessions use cookies that JavaScript cannot read, and are protected against cross-site request forgery. Sessions expire after a period of inactivity.
• Access is role-based and least-privilege. Inside a practice, the doctor controls what each staff member can see. Access to production data by our own team is restricted, justified and logged.
• Our people are bound by confidentiality obligations.

If a breach affects your personal data, we investigate and contain it, and we notify you and the Instance Nationale de Protection des Données à Caractère Personnel (INPDP) without undue delay where the law requires it, explaining what happened and what to do about it.

No system is perfectly secure. Use a strong, unique password, keep your one-time codes to yourself, and tell us immediately at [email protected] if you think someone else has been in your account.

We do not use advertising cookies, third-party analytics or tracking pixels. What we do use is limited to what makes the Platform work.

You can clear or block these in your browser settings. Blocking the strictly necessary ones will sign you out and prevent you from booking.

You can ask us to:

• confirm what we hold about you and give you a copy;
• correct anything inaccurate or incomplete;
• delete your account and the data tied to it;
• export your data in a portable, machine-readable format, where it was provided by you;
• stop or restrict a particular use, including objecting to a use based on our legitimate interests;
• withdraw a consent you gave — for location, notifications, marketing or the processing of health information — without affecting what we did lawfully before you withdrew it.

How to make a request

Email [email protected] from the address registered on your account, or use the privacy controls in your settings. We verify who you are before we act — for requests touching health information we may ask for more than an email confirmation, because handing your record to the wrong person is the worst outcome available to us. We respond within 30 days. There is no charge unless a request is manifestly excessive or repetitive.

For anything in a clinical record created by a practice, we will pass your request to that practice, tell you we have done so, and follow up.

Complaints

If you are not satisfied with how we have handled your information, please tell us first at [email protected] so we can put it right. You also have the right to complain to the Instance Nationale de Protection des Données à Caractère Personnel (INPDP), and — if you are in the European Economic Area or the United Kingdom — to your local data protection authority.

ChatDoctor accounts are for adults aged 18 and over. A parent or legal guardian can create a family profile for a child and book and manage care on their behalf; by doing so you confirm you have the authority to act for that child and to share their health information with the practice you choose.

As a young person approaches the age at which they can consent to their own care, a clinician may restrict what is visible to the account holder, in line with medical confidentiality. That is the clinician’s call, and we respect it.

We do not knowingly allow anyone under 18 to create their own account. If you believe a child has, contact [email protected] and we will remove the account and its data.

Professional listings — a clinician’s name, specialty, qualifications, practice address, opening hours, languages and consultation fees — are published as business information so that patients can find care. Some listings are built from public professional directories before the clinician claims their profile, and are marked as unclaimed until they do.

If you are a clinician and want your listing corrected, claimed or removed, email [email protected] from a verifiable professional address, and we will act on it. Once you claim a profile, your use of the Platform is governed by your practice agreement and the professional privacy notice rather than this one.

When we change this policy we publish the new version on this page and update the date at the top. For changes that materially affect you we give at least 14 days’ notice in the app or by email, and where a change relies on your consent we ask you again rather than assume it.

Previous versions are available on request from [email protected].

• Privacy requests and questions: [email protected]
• Data protection contact: [email protected]
• Help with your account or a booking: [email protected]
• Everything else: our contact page