Doctor Mobile App — Privacy Policy

Effective date: June 22, 2026 Last updated: June 27, 2026

This Privacy Policy explains how the CareClinic Doctor mobile app ("the app") handles information. The app is a companion to the CareClinic platform that lets a doctor sign in to their own clinic and manage appointments, patient records, prescriptions and notifications from an Android device.

Each clinic that uses CareClinic is the controller of its own patient and operational data. The app accesses that data on the clinic's behalf so the signed-in doctor can do their work; it is not a separate consumer service that collects data for its own purposes.

Information the app handles

Your account and professional profile. When you sign in and edit your profile, the app processes your name, email address, phone number, specialization, and — where you provide them — your license number, PTR number and S2 number, plus an optional profile photo.

Clinical and clinic information. To do its job, the app displays information your clinic already stores in CareClinic, including patient profiles and medical history, appointments, prescriptions, and laboratory orders and results. This information is shown to you because of your role at the clinic; the app does not copy it for any other use.

Authentication and device data. The app stores a sign-in token securely on the device so you stay logged in to your clinic. To deliver push notifications it registers a messaging token for your device. It also reads the app's own version number to power the "Check for updates" feature.

Photos you capture. If you add a profile photo, the app uses the camera or photo library only for the image you choose. The photo is uploaded to your clinic's storage and is not used for anything else.

Information the app does not collect

• The app does not read biometric data. Fingerprint or face unlock is handled entirely by your device's operating system; the app only receives a yes/no result and never sees your biometric information.
• The app does not sell personal information or share it with advertisers.
• The app does not track you across other apps or websites.

How information is used

• To authenticate you and keep you signed in to the correct clinic.
• To show your schedule, patients, records and prescriptions so you can provide care.
• To create consultation notes, prescriptions and lab orders that you enter.
• To send you notifications about new bookings and important updates, according to your notification preferences.
• To let you check whether a newer version of the app is available.

Permissions the app may request

• Camera and photos — only when you choose to add or update a profile photo.
• Notifications — to deliver booking and clinic alerts. You control which categories you receive in Settings.
• Biometric / device unlock — optional, to protect access to the app. This is processed on-device.
• Internet access — to communicate securely with your clinic's server.

Services we rely on

• Google Firebase Cloud Messaging delivers push notifications to your device. A device messaging token is shared with this service for that purpose.
• Google Play distributes and updates the app.

These providers process data under their own terms and only to provide the function described.

How information is protected

• All communication between the app and the server uses encrypted connections (HTTPS/TLS).
• Your sign-in token is kept in the device's secure storage.
• Your account can be signed in on only one device at a time. Signing in elsewhere is refused until the existing session ends, which limits unauthorised access if a device is lost.
• On the server, clinics are isolated from one another, and sensitive fields are encrypted at rest with per-clinic keys.
• Access is limited by your role and the permissions your clinic grants you.

Multi-clinic separation

If you belong to more than one clinic, the app keeps each clinic's session and data separate. Information from one clinic is never mixed with another.

Data retention and your choices

Because your clinic controls its records, requests to access, correct, export or delete patient or account information are handled by your clinic as the data controller. You can:

• Edit your own profile in the app at any time.
• Manage your notification preferences in Settings.
• Remove a clinic from the app, which clears that clinic's session from your device.
• Contact your clinic administrator to deactivate your account or to exercise data rights under applicable law.

Children

The app is intended for use by healthcare professionals and is not directed at children.

Changes to this policy

We may update this policy as the app evolves. Material changes will be reflected on this page with a new effective date.

Contact

For questions about this policy or about how your clinic handles data, contact your clinic administrator, or reach the platform operator at [email protected].