1. Information We Collect

MUDAWA collects information you provide directly to us when you create an account, use our AI health assistant, track your vitals, or contact us for support. This includes:

Account Information: Name and email address (doctors additionally provide phone number, CNIC, and PMDC registration number)
Health Information: Vital signs (blood pressure, blood glucose, HbA1c, and other lab values), symptoms, and your Sehat Card (date of birth, gender, blood group, known conditions)
Appointments: Doctor name, specialty, and appointment time
AI Chat Messages: Questions you send to our AI health assistant
Device Location: GPS coordinates, only when you use the nearby pharmacy/hospital finder
Voice Input: Audio captured only when you use the voice-to-text feature

2. How We Use Your Information

To store and display your vitals, symptoms, and health trends
To process your questions through Google Gemini AI for health guidance
To manage and remind you about doctor appointments
To find nearby pharmacies and health facilities using your location
To maintain your account and secure your session
To comply with legal obligations under Pakistani law

3. Third-Party Services We Share Data With

We share your data only with the following service providers, and only for the specific purposes described:

Firebase (Google Cloud) — authentication and secure data storage
Google Gemini AI — processing your AI chat messages to generate responses
Google Maps / Places — map display and nearby pharmacy search
Jitsi Meet — video consultations with doctors (audio/video stream only, no health records)

We do not sell, rent, or trade your personal data. We do not share your health data with advertisers, insurance companies, or employers.

4. Data Storage & Security

Storage: Firebase (Google Cloud)

Your data is stored on Google Cloud servers. Google does not currently operate data centers in Pakistan, so data may be stored outside Pakistan.

Encryption

Data is encrypted in transit using TLS 1.2+ and at rest using AES-256 (Google-managed encryption keys). Passwords are hashed with scrypt and never stored in plaintext.

Access Control

Strict Firestore security rules ensure only you can read or write your own health data. A catch-all deny rule blocks all other access.

5. App Permissions (Mobile App)

The MUDAWA mobile app requests only the following permissions:

Microphone — for voice input (voice-to-text), only when you use it
Location — for the nearby pharmacy/hospital finder, only when you use it
Internet — required for all online features

The app does not access your camera and does not collect biometric data (fingerprints or face scans). All permissions can be revoked at any time through your device settings.

6. Regulatory Alignment

MUDAWA aligns with:

Constitution of Pakistan (Article 14) — right to privacy
Prevention of Electronic Crimes Act (PECA) 2016 — data security requirements
Draft Personal Data Protection Bill (PDPB) 2023 — not yet enacted, but we proactively follow its principles
PMDC (Pakistan Medical & Dental Council) — telemedicine and doctor verification guidelines

Note: Pakistan does not currently have an enacted comprehensive data-protection law. We follow the draft PDPB 2023 and international best practices (including GDPR principles) as our standard.

7. Medical Disclaimer

Important Medical Disclaimer

MUDAWA's AI assistant provides general health information only and is NOT a substitute for professional medical advice, diagnosis, or treatment. Always consult a qualified healthcare professional registered with PMDC for medical decisions. For emergencies, contact emergency services or the nearest hospital immediately.

8. Your Rights

You have the right to:

Access your personal and health information stored with MUDAWA
Correct inaccurate data at any time in the app
Export your health data as a PDF report
Delete your account and all associated data at any time
Withdraw consent by deleting your account

To exercise these rights, delete your account from within the app, or contact us at mudawahealthcare@gmail.com.

9. Data Deletion & Retention

When you delete your account from within the app, we delete your user profile, all vitals and health records, appointment records, notifications, settings, and your Firebase Authentication account. We retain your data only while your account is active. If you cannot access the app to delete your account, email us at mudawahealthcare@gmail.com and we will process your deletion request.

10. Children's Privacy

MUDAWA is not directed at children under 13 years old, and we do not knowingly collect personal information from them. If you believe a child has provided us with personal data, contact us at mudawahealthcare@gmail.com and we will delete it.

11. Security Incidents

In the event of a data breach or security incident, we will notify affected users promptly and take steps to contain and remediate the issue, in line with PECA 2016 requirements.

12. Contact Us

For privacy concerns, data requests, or account deletion:

MUDAWA Team

mudawahealthcare@gmail.com

Response Time: Within 15 business days

13. Changes to This Policy

We may update this Privacy Policy to reflect changes in our practices or applicable regulations. We will notify you of significant changes via email or in-app notification. Continued use of MUDAWA after changes constitutes acceptance of the updated policy.

14. Governing Law

This Privacy Policy is governed by the laws of Pakistan.

Privacy Policy

Encrypted In Transit & At Rest

Account Security

Transparent Data Use

Pakistan Law Alignment

Permissions You Control

Data Deletion