Privacy Policy

1About MediConnect AI

MediConnect AI is an advanced healthcare appointment and telemedicine platform designed to connect patients with certified medical professionals. The platform offers features including doctor directory search, appointment scheduling, AI-assisted health triage and symptom checking, digital prescriptions, and encrypted video consultations.

2Information We Collect

We collect information that you directly provide to us, as well as information generated through your interaction with the platform:

• Account & Profile Information: Full name, email address, password hash (for credentials-based accounts), phone number, gender, date of birth, blood group, city/location, and optional profile photograph.
• Patient Health Information: Self-reported medical history, known allergies, chronic diseases, emergency contacts, symptoms submitted when requesting appointments, doctor consultation notes, and digital prescriptions.
• Doctor Professional Credentials: Medical license number, specialization, qualifications and degrees, hospital affiliations, years of experience, biography, consultation fees, and schedule availability.
• Appointment & Telehealth Data: Selected healthcare provider, appointment date and time, consultation format (in-person or video consultation), reason for visit, appointment status, and appointment QR codes.
• Payment & Transaction Information: Consultation fee amounts, payment status, transaction identifiers, and payment method (Stripe, JazzCash, EasyPaisa). We do not store raw credit or debit card numbers on our servers; payments are processed securely through certified gateways.
• AI Interaction Data: Symptoms, queries, age range, and pain level descriptions voluntarily provided to our AI Symptom Checker and AI Health Assistant to receive informational triage assistance.

4How We Use Your Information

All data collected by MediConnect AI is processed for lawful, legitimate medical and platform operational purposes, including:

• Facilitating appointment scheduling between patients and doctors.
• Enabling secure, encrypted real-time video consultations.
• Delivering automated appointment confirmations, reminders, and updates via email.
• Generating AI-driven preliminary symptom analysis and triage recommendations to assist patients in selecting suitable medical specialists.
• Allowing licensed doctors to create and issue verifiable digital prescriptions.
• Processing consultation payments securely and generating invoices.
• Maintaining audit logs for security, platform integrity, and fraud prevention.

5Third-Party Services in Use

We only engage third-party services that are strictly necessary to deliver the functionality of MediConnect AI. Below is an exhaustive list of external service providers utilized in the application:

6Cookies & Local Storage

We use essential cookies and browser storage strictly to ensure platform security and functionality:

• Session Authentication Cookies: Cryptographically signed HTTP-only cookies (authjs.session-token or __Secure-authjs.session-token) to maintain your login session securely across pages.
• CSRF Protection Tokens: Prevent cross-site request forgery attacks during forms and authentication.
• Local Storage: Remembers your UI display preferences, such as Dark Mode or Light Mode theme selection.

We do not use invasive third-party cross-site advertising trackers.

7Data Sharing & Zero Sale Policy

We NEVER sell, rent, or monetize your personal information or health records. Information is shared solely in the following strict circumstances:

• With Healthcare Providers: Your appointment reason, medical notes, and relevant patient profile information are shared with the specific doctor you book with so they can provide appropriate medical care.
• With Infrastructure Sub-processors: Verified technical providers (listed in Section 5) operating under strict data protection and confidentiality agreements.
• For Legal & Regulatory Compliance: If required by a valid court order, subpoena, government regulation, or to protect the safety and rights of patients and healthcare providers.

8Data Storage & Security

We implement rigorous organizational, technical, and physical security measures to protect your information:

• Encryption in Transit: All web traffic is strictly served over TLS 1.3 HTTPS encryption with HSTS protection.
• Encryption at Rest: Application databases and storage buckets utilize industry-standard AES-256 encryption.
• Credential Security: User passwords are cryptographically hashed using salted bcrypt (cost factor 12).
• Role-Based Access Control: Strict backend permission checks ensure patients, doctors, and administrators can access only their authorized data.

9Data Retention & Your Rights

We retain personal data for as long as your account remains active or as needed to comply with applicable healthcare documentation and statutory retention requirements.

You have the right to:

• Access & Inspect: View your profile, appointment records, and prescriptions at any time.
• Rectification: Update inaccurate or incomplete medical or contact information in your dashboard.
• Account & Data Deletion: Request the deletion of your account and associated personal data by submitting a request to our privacy team.
• Revoke Google Access: You can revoke MediConnect AI's access to your Google Account at any time via your Google Account Permissions dashboard.

10Children's Privacy

MediConnect AI is not directed at children under the age of 13. We do not knowingly collect personal information directly from children under 13. Individuals under the age of 18 may only use MediConnect AI with the express involvement, supervision, and consent of a parent or legal guardian.

11Changes to this Privacy Policy

We may update this Privacy Policy periodically to reflect enhancements to our platform, changes in applicable laws, or adjustments to our service providers. When updates are published, the "Effective & Last Updated" date at the top of this policy will be revised. For significant changes, we will notify registered users via email or through prominent notifications in the application.