Legal
Privacy Policy
Dktor helps you find doctors, clinics, hospitals, pharmacies and labs in Iraq and book a visit. This page explains, in plain words, what information the app handles, why, who can see it, how long we keep it and what you can do about it.
The short version
- You can search and browse Dktor without an account. An account is needed only to book, review or save places.
- When you book, the clinic you chose sees the details it needs for your visit: your name, phone number and, if you add them, the reason for the visit, your birth date and sex.
- Your location stays on your phone. It is used to show places near you and is never sent to our servers.
- No ads. No selling of personal information. We do not track you across other apps or websites.
- You can delete your account in the app or by e-mail whenever you like.
About this policy
Dktor is a directory of doctors, clinics, hospitals, pharmacies and labs in Iraq. People use it to find a place, see its fees and opening hours, read reviews and book a visit. Clinics and pharmacies use it to keep their listing up to date and to manage the bookings they receive.
This policy applies to the Dktor app for Android and iOS and to this website. In this policy, "we" and "us" mean Dktor. You can reach us at [email protected].
Dktor is not a medical service. We do not give medical advice, and the app does not hold medical records.
Who is who
- People looking for care. You can use Dktor without an account. If you create one, we are responsible for your account information.
- Clinics, hospitals, pharmacies and labs ("places"). A place that joins Dktor manages its own listing, its team and the bookings it receives. The details a place keeps about its own patients, such as its list of visits, are the place's responsibility. Dktor stores them on the place's behalf.
- Doctors and staff. People who work at a place have their own Dktor account and see what their role allows.
Information we handle
What we handle depends on how you use Dktor.
| Kind | What it includes | Where it comes from |
|---|---|---|
| Account | Your name, phone number and e-mail address (whichever you sign in with), an optional profile photo, your language and city, and the sign-in method you use. Passwords are kept only as a salted one-way hash by our sign-in service. | You |
| Optional profile details | Your birth date and sex, only if you add them. They help a clinic prepare for your visit when you book. | You |
| Bookings | The place, doctor, day and time you chose, the patient's name and phone number, whether the visit is for you or someone else, an optional reason, the fee shown at the time of booking, and the booking's status (for example confirmed or cancelled). | You and the place |
| Reviews and reports | Your star rating and comment, the name shown with it (your first name and the first letter of your last name), any reply from the place, and the reports you send about a review. | You |
| Saved places | The doctors and places you save. | You |
| Listings | For a place: its name, photos, address, map location, opening hours, phone numbers, services, doctors and fees. For a doctor: the name, photo, specialty, qualifications and fees. Team members and invitations, and the place's plan. | The place and its team |
| Photos | Profile photos, and the photos and logos a place adds to its listing. Photos are re-saved without their hidden details (such as the place where a photo was taken) before they are uploaded. | You and the place |
| Notifications | Booking updates and reminders, and the push notification token of your device. | Dktor and your device |
| Device and diagnostics | Device model, operating system, app version and language. If the app has a problem it can send an error report. Web addresses, access tokens, phone numbers and e-mail addresses are removed from it first. | Your device |
| Usage signals | Which screens and actions are used, for example "opened a doctor's page". No names, messages or phone numbers are included. | Your device |
If you sign in with Google or Apple we receive your name, an e-mail address (Apple may give a private relay address) and an account identifier. We never see your Google or Apple password. If you sign in with your phone number, we send you a one-time code.
What we do not do
- We do not send your location to our servers. When you allow it, the app reads your location on your phone to show places near you and to centre the map. If you do not allow it, the map may use a rough area guessed from your internet address instead.
- We do not read your contacts, your messages, your call history or your microphone.
- We do not use advertising identifiers, and Dktor shows no ads.
- We do not take card or bank details. Fees are paid at the place, not in the app.
- We do not hold medical records, test results or prescriptions.
How we use information
- To run the service: show the directory, create accounts, send bookings to places, let places confirm and manage them, publish reviews and send notifications such as booking reminders.
- To send sign-in codes to your phone by WhatsApp, Telegram or SMS.
- To keep Dktor safe and fair: sign-in checks, limits on repeated attempts, and handling reports about reviews.
- To fix problems and improve the app, using diagnostics and usage signals.
- To understand overall use of Dktor, for example how many bookings are made per day, using totals that do not identify people.
- To meet legal obligations and answer valid requests from authorities.
We do not sell personal information. We do not use it for advertising or to build advertising profiles.
Where the law asks for a legal basis, ours is: providing the service you asked for, our legitimate interest in security and in improving Dktor, your consent for location and notifications (you can withdraw it in your device settings), and legal obligations.
Who can see your information
- Everyone. Listings of places and doctors, and published reviews with the reviewer's first name and last initial. Your phone number and e-mail address are never shown with a review.
- The place you book with. Its team sees the booking: the patient's name and phone number, the reason if you gave one, and your birth date and sex if you added them to your profile. A place does not see your saved places, your other bookings or your bookings at other places.
- Our team. A small number of people at Dktor can access data when needed to run, secure and support the service and to handle reports.
- Service providers that help us run Dktor, listed below.
- Authorities, when the law requires it, and a buyer, if Dktor is ever sold. A buyer would have to follow this policy.
Service providers
These companies process information for us. They may use it only to provide their service.
| Provider | What for | What they receive |
|---|---|---|
| Supabase | Database, sign-in and server functions | The information described above |
| Google sign-in, Firebase Cloud Messaging for push notifications, and hosting of this website | Your Google account identifier, name and e-mail at sign-in; the push token and notification text; server logs for this site | |
| Apple | Sign in with Apple, and push notifications on iPhone | Your Apple account identifier, the push token and the notification text |
| Backblaze | Storage of photos | Profile photos and the photos places add to their listings |
| OTPIQ | Sending sign-in codes by WhatsApp, Telegram or SMS | Your phone number and the code |
| OpenFreeMap and OpenStreetMap | Map images | The map area being viewed and your IP address |
| ipapi.co | A rough area from your IP address, used only to centre the map when your location is not available | Your IP address |
When you tap Directions, your phone's map app (such as Google Maps or Apple Maps) opens and handles the route under its own policy. Each provider has its own privacy policy. We do not sell or rent personal information to anyone.
Where information is stored
Dktor's servers and our providers' data centres are outside Iraq, currently in the United States and the European Union. When you use Dktor, your information is therefore processed outside your country. We protect it as described below, wherever it is.
How long we keep it
| What | How long |
|---|---|
| Your account, profile, saved places and reviews | Until you delete your account, or until you delete a review. |
| Bookings | A place keeps its record of a visit as long as it has its Dktor account, so that it keeps its history. When you delete your account, your bookings are no longer linked to it. |
| Listings and a place's team records | As long as the place has its Dktor account. |
| Phone sign-in codes and anti-abuse counters | From one hour to 7 days. |
| Error reports | 90 days. |
| Usage signals | 12 months. |
| Push notification tokens | Until you sign out or delete your account. A device that has not opened Dktor for 60 days no longer receives notifications. |
Your choices and rights
- Edit your name, photo, language, city, birth date and sex in the app, or remove the optional ones.
- Delete a review, remove a saved place, or cancel a booking in the app.
- Turn off location or notifications in your device settings. Dktor keeps working without them.
- Delete your account in the app, or by e-mail. Steps are on the page Delete your account.
- Ask us for a copy of your information, to correct it, or to stop using it, by writing to the address below. We answer within 30 days.
- If you think we handled your information wrongly, you may complain to the data protection authority where you live.
How we protect it
- All traffic between the app and our servers uses HTTPS.
- A place can read only its own bookings and team. This is enforced in the database itself, not only in the app.
- Phone sign-in codes are stored only as a hash and expire quickly.
- Photos are stripped of hidden details, such as location, before upload.
- Our providers run their own security programmes.
No system is perfectly secure. If a breach affects you, we will tell you and the authorities as the law requires.
Children
You must be 18 or older to create a Dktor account. A parent or guardian can book a visit for a child from their own account; the child's name is then shared with the place in the same way as described above. We do not knowingly collect information from children. If you believe a child has an account, write to us and we will delete it.
Changes to this policy
We may update this policy, for example when Dktor gets a new feature. We will change the date at the top and, for important changes, tell you in the app. Using Dktor after a change means you accept the updated policy.
Contact
Questions, requests or complaints: [email protected].