Noor Einek Privacy Policy

1. Overview

Noor Einek helps patients connect with eye-care doctors, upload diagnostic files, receive prescriptions, manage reminders, and exchange clinical messages with authorized doctors. This Privacy Policy explains what information we collect, why we collect it, how we protect it, and the choices available to users.

We design the service with privacy and security in mind. Medical data is treated as sensitive information and is only made available to the patient, the patient’s linked doctor, and authorized administrative users where needed for support, safety, compliance, or platform operations.

2. Information We Collect

Account and identity information

• Name, email address, phone number, password hash, account role, account status, and verification data.
• Doctor profile details such as specialization, clinic details, professional profile, and verification status.
• Patient profile details such as age, gender, governorate, linked doctor, and care permissions.

Health and clinical information

• Eye conditions, allergies, medical notes, prescriptions, medication schedules, diagnostic tests, and test review notes.
• Uploaded diagnostic files, images, PDFs, chat attachments, and medical record attachments.
• Medication reminders, adherence responses, and patient progress information.

Messages, notifications, and device information

• Messages exchanged between linked patients and doctors, including file attachments.
• Push notification tokens and device details needed to deliver notifications.
• Basic technical logs such as request time, IP-derived request metadata, error logs, and security/audit events.

3. How We Use Information

• To create, verify, and secure user accounts.
• To connect patients with authorized doctors.
• To allow patients to upload tests and doctors to review them.
• To deliver prescriptions, reminders, medical records, messages, and push notifications.
• To detect abuse, investigate errors, improve reliability, and protect the platform.
• To comply with legal, regulatory, security, and store review requirements.

4. How We Protect Medical Files and Images

We apply additional controls to sensitive patient uploads such as diagnostic files and chat attachments. These files are stored using protected Cloudinary delivery settings and are not intended to be exposed as permanent public links. When an authorized user needs to view a protected file, the backend generates a temporary signed URL. This helps limit access to users who are authenticated and authorized for that record.

• Access control: patient records are checked against the authenticated user’s role and relationship to the record.
• Linked doctor checks: doctors can access patient data only when the patient is linked to that doctor, unless an authorized admin access path applies.
• Temporary file links: sensitive file links are signed and time-limited when returned by the backend.
• Transport security: production API traffic should use HTTPS/TLS.
• Authentication: API access requires access tokens, and sensitive routes enforce role-based authorization.
• Abuse protection: the backend uses rate limiting, security headers, request sanitization, and audit/activity logging.

5. Sharing and Disclosure

We do not sell patient medical information. We may share information only in the following cases:

• With the patient’s linked doctor for care-related workflows.
• With authorized administrators for verification, support, moderation, reporting, and platform security.
• With infrastructure providers that help operate the service, such as hosting, database, email, push notification, and secure media storage providers.
• When required by law, regulation, legal process, or to protect users and the platform from abuse or harm.

6. Third-Party Service Providers

Noor Einek may use service providers for cloud hosting, database storage, media storage, email delivery, push notifications, analytics/operational monitoring, and customer support. These providers process data only as needed to provide and secure the service.

7. Data Retention

We keep account, clinical, messaging, and operational data for as long as needed to provide the service, maintain records, resolve disputes, meet legal obligations, and protect platform integrity. Users may request account deletion or data deletion where applicable by contacting us.

8. Your Choices and Rights

• You can update profile information inside the app.
• You can request account deletion or data deletion by contacting us at aamr24987@gmail.com.
• You can control device permissions such as camera, photo library, files, and notifications from your device settings.
• You can sign out of the app at any time.

9. Permissions Used by the Apps

• Camera: used only when you choose to take a profile photo or upload/send an image.
• Photo library/files: used only when you choose to upload or attach a file, image, or medical document.
• Notifications: used to send care-related alerts such as prescriptions, messages, reminders, test review updates, and account notices.

10. Children and Eligibility

Noor Einek is intended for users who are legally able to use digital health services in their location, or who use the service with the involvement of a parent, guardian, or authorized caregiver where required.

11. International Data Processing

Data may be processed and stored using cloud infrastructure and service providers located in different countries. We use reasonable technical and organizational measures to protect information during processing.

12. Changes to This Policy

We may update this Privacy Policy when our services, security measures, legal requirements, or store policies change. The effective date above indicates the latest version.

13. Contact Us

For privacy, security, account deletion, or data requests, contact us at aamr24987@gmail.com.