Privacy Policy

Effective date: 22 October 2026.

This policy explains what personal data XpertMedico collects, why, who processes it and your rights. We collect only what we need to run XpertMedico and we never sell your personal data.

1.What we collect

• Account data: name, mobile number, email, password (stored only as a secure hash), language, and family members you add.
• Health records held by providers: appointments, consultation notes, prescriptions, lab orders and reports that a provider creates for you on XpertMedico, and prescriptions you upload to XpertMedico Shop.
• Orders and payments: delivery address, order history, and payment proofs (screenshots of bank transfer, EasyPaisa or JazzCash payments).
• Location: your precise location (GPS) only if you allow it in your browser, otherwise an approximate city worked out from your IP address using the DB-IP database. It is used to show nearby providers and is stored in a cookie on your device.
• Business data: for stores and providers, business and licence details, staff accounts, inventory, sales and billing records.
• Technical data: cookies (see the Cookie Policy), IP address, device and browser type, and security logs. We count searches on our own servers to improve results; we do not use third-party advertising trackers.

2.How we use it

To run your account, show nearby providers, handle bookings, orders and deliveries, send one-time codes, receipts and service emails, keep the platform secure, prevent fraud and meet legal duties. We do not use your health data for advertising.

3.Health data and consent

Prescriptions, lab reports and consultation details are sensitive health data. We process them with your consent, which is recorded when you create an account, book, order a test or accept a prescription; you can see and withdraw your consents at /account/privacy. Withdrawing consent stops future processing but does not undo records a provider or pharmacy must keep by law.

4.Who can see it

• The store or provider you deal with sees your name, phone number and the records of that visit or order. Providers decide how they keep their own records and are responsible for them.
• XpertMedico Shop pharmacists and support staff see your Shop orders, prescriptions and payment proofs.
• XpertMedico staff access other records only when strictly needed for support, security or legal reasons, and access is logged.
• Reviews show your name, not your phone number.
• Lab reports open through a private link protected by a one-time code. A pharmacy can see an e-prescription only when you share it or it is sent to them for dispensing.
• We disclose data to authorities only when the law requires it.

5.Service providers (sub-processors)

We use trusted service providers to run XpertMedico. They process data only on our instructions:

• Hosting and database providers that store the platform and its data.
• Email (SMTP) providers that deliver one-time codes, receipts and notices.
• Google Maps and Google Places for maps, directions and public business data (shown with Google attribution).
• Google Gemini for the AI assistant and for reading uploaded documents such as invoices. Please do not type names, phone numbers or other personal details into the assistant.
• DB-IP IP-to-city data, used on our own servers; your IP address is not sent to DB-IP.

Some of these providers may store data outside Pakistan. We choose providers with appropriate security.

6.Retention

• Account data is kept while your account is active and deleted or anonymised after a deletion request, except records we must keep.
• Medical, prescription, lab, sales, tax and billing records are kept for the period required by Pakistani law and Healthcare Commission rules.
• Routine technical logs (for example AI chat turns, search logs and scheduler logs) are deleted after 3 days. Legal and clinical audit records (such as e-signature records, prescription access, lab critical-result tasks, consents, payments and admin actions) are kept as legal records.

7.Your rights

You can ask to access a copy of your data, correct it, or delete it, and withdraw consent, at /account/privacy or by email. We reply within 30 days. See the Data and Account Deletion page for details.

8.Minors

Data of a person under 18 is managed by a parent or legal guardian through a family account. The guardian gives consent and makes requests on the child's behalf.

9.Security and breaches

Data is sent over encrypted connections, passwords are hashed, access is role-based and logged, and routine logs are pruned. If a breach affects your personal data, we will contain it, assess the risk, inform affected users without undue delay where there is a real risk of harm, and report it to the authorities where the law requires.

10.Law

We follow the Prevention of Electronic Crimes Act 2016, the Electronic Transactions Ordinance 2002 and the confidentiality duties in healthcare laws. Pakistan's Personal Data Protection Bill is still a draft; we will update this policy when a data protection law is enacted.

11.Changes

We may update this policy; the version number and date are shown at the top.

Questions or complaints: email info@xpertmedico.com or call / WhatsApp 03442490527.