Privacy Policy

Version 2 · Effective 17 October 2026

Privacy Policy — Alhakeem Health

Last Updated: October 17, 2026 Effective Date: October 17, 2026

Welcome to Alhakeem Health ("Alhakeem", "we", "our", or "us"). Alhakeem Health is a clinic management and electronic health record platform that connects patients, doctors and clinics in the Arab Republic of Egypt, through the Alhakeem mobile app and the website https://alhakeem.io.

We protect your personal data and your health data in line with Egyptian Law No. 151 of 2020 on the Protection of Personal Data and its Executive Regulations, Egyptian rules on medical practice and medical records, and the Google Play Developer Policies.

This policy explains what we collect, why, who can see it, where it is stored, how long we keep it, and the rights you have.

1. Medical and AI disclaimer

Alhakeem Health is a clinic management and health records tool. It is not an emergency service, it is not a medical device, and it does not diagnose, treat, cure or prevent any medical condition.

  • Emergencies: if you have a medical emergency, call the Egyptian ambulance service on 123 or go to the nearest hospital emergency department.
  • AI assistant: the Alhakeem AI assistant is powered by Google Gemini and our medical knowledge base. For patients it gives general information, not a diagnosis. For doctors it is clinical support only and does not replace direct clinical assessment. All diagnosis, prescribing and treatment decisions are made by licensed healthcare professionals. Always consult a qualified healthcare professional for medical advice.
  • Reporting AI answers: you can report any AI answer you find harmful, inaccurate or offensive with the Report button under the answer. Our team reviews every report.

2. Data we collect

Under Law No. 151 of 2020, data is either personal data or sensitive personal data, which includes health data. We collect only what we need to provide the service.

A. Identity and contact data

  • Patients: full name (and Arabic name, if given), mobile phone number (your main sign-in identifier), email address (optional), date of birth, gender, governorate, address (optional), emergency contact (optional), and national ID number (optional; usually entered by your clinic to identify your file).
  • Doctors and clinic staff: name, title and medical specialty, email address, phone number, clinic name and address, and working hours.

B. Health data (sensitive personal data)

With your explicit consent, we process:

  • Medical records: complaints, visit notes, medical history, diagnoses and problem lists (including ICD-10 codes), procedure and operative reports, and your doctor's assessments.
  • Vital signs: blood pressure, heart rate, temperature, blood sugar, weight and oxygen saturation.
  • Medicines and prescriptions: prescriptions issued by your doctor, doses, allergies, chronic conditions, blood type, smoking status, and drug-interaction safety checks.
  • Tests and imaging: laboratory results (including results read from a photo of a lab report), investigation orders, echocardiography reports and attached files.
  • Your uploads: photos and PDFs you upload (for example lab reports, prescriptions and medicine boxes).
  • AI conversations: the questions you ask the AI assistant, the files you attach to them, and the answers, plus any reports you send about an answer.

C. Technical data

  • Device data: a push-notification token (Firebase Cloud Messaging on Android, Apple Push Notification service on iOS) and the device platform (Android or iOS).
  • Security logs: IP address, sign-in times, and records of actions taken in your account and of access to medical files.
  • Photo metadata: when you upload a photo, we remove its metadata (such as GPS location and camera model) on our servers before the photo is stored or sent to the AI assistant.

3. Why we use your data, and on what legal basis

We process personal data on the legal bases set out in Law No. 151 of 2020 and its Executive Regulations:

  1. Your explicit consent: given when you sign up (including a separate consent for health data) and again when this policy changes materially.
  2. Providing the service you asked for: booking appointments, managing visits, issuing prescriptions and connecting you with your clinic.
  3. Legal obligations: medical record-keeping, tax and electronic-transaction rules, and lawful requests from competent authorities.
  4. Vital interests: for example drug-allergy and drug-interaction warnings.

We use your data to:

  • create, verify and secure your account;
  • let your doctors and their clinic staff document your care and follow your progress;
  • answer your questions with the AI assistant, and read medicine boxes, vital-sign slips and lab reports you choose to scan;
  • send notifications about appointments, results and your account;
  • show you when doctors at other clinics you have shared your records with viewed them (Privacy Center, where available);
  • review reports about AI answers and improve safety;
  • keep the platform secure and meet our legal obligations.

We do not use your data for advertising, and we do not sell it.

4. Device permissions

The Android app asks only for:

  • Camera: when you choose to photograph a medicine box, a vital-sign slip, a lab report or a document. Never in the background.
  • Notifications: for appointment reminders, results and account notices. You can turn them off at any time in your phone's settings.

To attach photos or PDFs, the app uses the system photo and file picker, so it does not need access to your storage. The app does not read your SMS messages: verification codes are sent to you by our server.

5. Who can see your data

We do not sell, rent or trade your personal or medical data, and we do not share it with advertisers or data brokers.

  1. Your doctors and clinics: the clinics you are a patient of keep your medical records, as the law requires. Doctors at another clinic see your records only if you link to that clinic and choose what to share (visits, prescriptions, lab results, reports, and so on). You can change or withdraw this sharing at any time.
  2. Service providers that process data only on our instructions:
    • Amazon Web Services (AWS): hosts our servers, database and file storage in Frankfurt, Germany (AWS region eu-central-1). Server disks are encrypted at rest (AES-256).
    • Google (Gemini API): generates AI answers and reads photos you scan. We use the paid service: Google keeps prompts for a limited period to detect abuse and does not use them to improve its products.
    • Google Cloud (Vertex AI Search): searches our medical knowledge base using the search query derived from your question.
    • Firebase Cloud Messaging (Google): delivers push notifications to your device.
    • Resend: sends verification and password-reset emails.
  3. Legal obligations: when required by an Egyptian court order or by a lawful request from a competent authority, such as the Personal Data Protection Center.

6. Data transfers outside Egypt

Our servers are in Frankfurt, Germany (AWS), and some services we use (Google, Resend) process data outside Egypt. We transfer personal data abroad only under the conditions of Law No. 151 of 2020 and its Executive Regulations, including the required licence from the Personal Data Protection Center, and under data processing agreements with each provider. Data is encrypted in transit and at rest.

7. How long we keep data, and how to delete your account

A. Retention

  • Account data: while your account is active.
  • Medical records: clinics and doctors must keep medical records for the period required by Egyptian law, even after you delete your account.
  • Unsent AI attachments: files you upload to the AI assistant but never send are deleted after 24 hours.

B. Deleting your account

You can ask us to delete your account at any time:

  1. Patients:
    • In the app: Settings → Data & privacy → Request account deletion. You can see the status of your request there and cancel it while it is pending.
    • On the website: Profile → Your data → Request account deletion.
  2. Doctors and clinic staff:
    • In the app: Settings → Delete account (confirm with your password).
    • On the website: Profile → Delete account.
  3. Without the app or without access to your account: use https://alhakeem.io/account-deletion, or email privacy@alhakeem.io with the subject "Account deletion request" and your registered phone number or email, so we can verify your identity.

C. What deletion does

We complete deletion requests within 30 days.

  • Patients: your account, sign-in details, uploads, AI conversations and their files, and notification tokens are deleted. The medical records your clinics must keep are retained by them, with your name, phone number and national ID removed from the record.
  • Doctors and clinic staff: your sign-in and contact details are deleted and you can no longer sign in. Your professional name stays on the medical records you created, because the law requires them to be kept. Your future appointments are cancelled and the patients are notified.

8. Your rights

Under Law No. 151 of 2020 you have the right to:

  • Know and access the data we hold about you, and get a copy. Patients can export their record in the app (Settings → Data & privacy → Export my data) or on the website (Profile → Your data).
  • Correct inaccurate data in your profile, or ask your clinic to correct your medical record.
  • Control sharing with other clinics and see when doctors at other clinics you've shared with viewed your records (Privacy Center, where available).
  • Delete your account (section 7).
  • Withdraw consent or object to future processing at any time. This doesn't affect care already provided.
  • Complain to the Egyptian Personal Data Protection Center.

9. Security

  • Encryption: data is encrypted in transit (HTTPS, TLS 1.2 or higher) and at rest (AES-256 disk encryption on our AWS servers).
  • Private medical files: medical files are kept in private storage that isn't reachable from the internet and are shown only to signed-in users allowed to see them.
  • Clinic isolation and roles: each clinic's data is separated from other clinics, and role-based permissions limit what nurses, receptionists and doctors can see.
  • Account protection: rate limiting, brute-force protection and hashed passwords.
  • Breach notification: if a breach puts your rights at risk, we will notify the Personal Data Protection Center within 72 hours and inform affected users as the law requires.

10. Children

Patient accounts are for adults (18 or over). Children's medical records are managed by their clinic; a parent or legal guardian can contact the clinic about a child's record.

11. Changes to this policy

We may update this policy when our services or the law change. When we make a material change, we will show the new version in the app and on the website and ask you to review and accept it before you continue.

12. Contact and Data Protection Officer

  • Entity: Alhakeem Health
  • Data Protection Officer: dpo@alhakeem.io
  • Privacy and deletion requests: privacy@alhakeem.io
  • Address: Cairo, Arab Republic of Egypt
  • Website: https://alhakeem.io
  • Account deletion: https://alhakeem.io/account-deletion
Previous versions