Privacy Policy & Data Protection

1. Who We Are & Developer Identity

Entity Name: Dar Al-Salam Modern Medical Polyclinic & Pharmacy (مستوصف دار السلام الطبي الحديث وصيدلية دار السلام)
Official Website: https://daralsalammodern.com
Physical Address: Sana'a, Yemen - Al-Salam Main Street
Official Contact Email: support@daralsalammodern.com (or qqwe77058@gmail.com)
Customer Support Phone: +967 776 928 420 / +967 772 503 801

2. Information We Collect

We only collect data that is strictly required to provide our medical polyclinic services, dispense prescription pharmaceuticals, and deliver health support:

A. Personal Account Information

• Full Name: To address you on medical prescriptions, clinic appointments, and delivery invoices.
• Phone Number: Used as your unique account login identifier, for order status SMS/WhatsApp updates, and emergency medical follow-up.
• Physical Delivery Address: Used strictly by our certified pharmacy courier to deliver prescription and OTC medications to your home.
• Password: Stored using industry-standard secure one-way salted hashing (BCrypt) to safeguard your account against unauthorized access.

B. Sensitive Health & Medical Information

• Prescription Images & Documents: Photos of doctor prescriptions uploaded by you to enable our licensed pharmacists to review, verify dosages, and prepare your medicines.
• Clinic Appointment Records: Requested appointment dates, chosen specialized clinic (e.g. Pediatrics, Cardiology, Dental), and consultant physician.
• Medication Reminder Schedules: Medicine names, frequencies, and dosage times configured in your local app schedule to trigger automated reminder notifications.
• Family Card Beneficiaries: Names and relationship degrees of family members registered under your Gold/Silver medical discount card.

C. Device & Technical Telemetry

• Firebase Cloud Messaging (FCM) Token: A device-unique cryptographic token used solely to push critical alerts (e.g., "Your prescription has been approved", "Medicine dosage reminder", "Urgent order update").
• Device Model & Operating System: Collected solely to optimize display rendering and maintain WebRTC teleconsultation compatibility.
• Internet Protocol (IP) Address: Collected temporarily during active sessions for security fraud prevention and preventing brute-force login attempts.

3. Android Permissions & How They Are Used

Android Permission	Technical Purpose	Mandatory or Optional
CAMERA	Allows you to take real-time photos of your medical prescriptions or lab test reports.	Optional (Only prompted when uploading prescription via camera).
Photo Picker (READ_MEDIA)	Allows you to select a saved prescription or doctor's note from your gallery using Android's zero-permission system photo picker.	Optional (User-initiated).
RECORD_AUDIO	Enables crystal-clear audio during live telehealth consultations with your doctor or when recording a voice note for the clinic pharmacist.	Optional (Only prompted during active calls or voice recording).
POST_NOTIFICATIONS	Delivers timely medication dosage reminders, appointment confirmations, and pharmacy delivery tracking alerts.	Optional (Prompted on Android 13+).
INTERNET & NETWORK_STATE	Synchronizes your orders with our medical database and connects live WebRTC consultations.	Required for app operation.

4. How We Use Your Information

All collected data is utilized exclusively for genuine healthcare and pharmaceutical operations:

• Dispensing, reviewing, and delivering prescribed medications through licensed pharmacists.
• Scheduling and confirming outpatient clinic visits and diagnostic lab appointments.
• Facilitating secure encrypted audio/video teleconsultations between patients and doctors.
• Applying discounts according to registered family and individual discount cards.
• Responding to patient inquiries, medical clarifications, and technical support requests.
• NEVER FOR ADVERTISING: We do NOT sell, lease, rent, or trade your personal or health data to advertisers, data brokers, or marketing networks.

5. Third-Party Services & Data Sharing

We do not share your health data with any third parties except the following trusted technical infrastructure providers strictly needed to operate the service:

• Google Firebase (Google Cloud): Provides encrypted database synchronization (Firebase Realtime Database) and push notification delivery (Firebase Cloud Messaging). Google adheres to ISO/IEC 27001, SOC 1/2/3, and GDPR compliance.
• WebRTC: Direct peer-to-peer encrypted protocol utilized for live audio/video medical consultations. No video or audio is stored on public servers.
• Ministry of Health & Legal Mandates: We may disclose information only if required by valid legal process or official public health authorities under applicable laws of Yemen.

6. Data Security & Storage

We employ robust technical, physical, and administrative safeguards to keep your sensitive medical data secure:

• Encryption in Transit: All data transmitted between the Android mobile application, web portal, and backend servers is encrypted using 256-bit Transport Layer Security (TLS / HTTPS).
• Restricted Access: Only licensed healthcare professionals (doctors, pharmacists, receptionists) with role-based authentication have access to clinical orders.
• Password Protection: Passwords are protected using modern cryptographic hashes and are never stored in plain text.

8. Children's Privacy (COPPA Compliance)

Our application and services are not directed to children under 13 (or under 16 in certain jurisdictions) without explicit parental or legal guardian consent. Pediatric appointments and prescriptions for children must be registered and managed under the account of a parent or adult legal guardian. If we discover that personal data of a minor was provided without verified guardian authorization, we promptly delete such records.

9. Changes to This Privacy Policy

We may update our Privacy Policy periodically to reflect enhancements in our healthcare technology or updates to Google Play Developer policies. When changes occur, the "Last Updated" date at the top of this document will be revised, and a notification banner will be displayed within the mobile app.

10. Contact Our Data Protection Officer

If you have any questions, concerns, or requests regarding this Privacy Policy or your personal health data, please contact our medical administration team: