Privacy Policy

Last updated: 10 October 2026

Aafiya is a supervised telemedicine platform. Patients attend a partner health centre in person, where a trained technician records their details and connects them to a remote specialist. This policy explains what information we hold, why we hold it, and who can see it.

1. Who this policy covers

Aafiya has two groups of people whose information we handle, and they are treated differently:

• Patients. Patients do not have accounts and never sign in. Their information is entered on their behalf by centre staff during a visit.
• Staff. Administrators, technicians, laboratory technicians and doctors hold accounts created by an administrator.

2. Information we collect

Patient information

• Name, age, gender and contact number
• Identity document type and number, where recorded
• Clinical history taken at intake: presenting complaint, past history, family history, allergies, previous investigations and current treatment
• Vital signs and laboratory results recorded at the centre
• Documents uploaded by staff, such as scans and prior reports
• Appointment records and prescriptions issued after a consult

Staff information

• Name, email address, role, assigned centre and specialty
• Timezone and language preference
• Authentication details. Passwords are hashed by our authentication provider and are never visible to us.
• An audit record of significant actions taken in the platform, including who performed them and when

Google account information (doctors only)

A doctor may connect their Google Calendar so that consultations appear on their own calendar with a video link attached. This is optional and is covered in detail in section 6.

3. Why we use this information

We use the information above only to operate the service:

• To create and maintain a patient’s medical record
• To let a remote specialist review that record and conduct a consultation
• To schedule appointments and issue prescriptions
• To keep an audit trail, so that any change to a clinical record can be attributed to a specific person
• To secure the platform and investigate misuse

We do not sell personal information, and we do not use it for advertising or profiling.

4. Who can see patient information

Access is restricted in the database itself, not merely hidden in the interface:

• Technicians and laboratory technicians can only see patients belonging to their own centre.
• Doctors can only see the records of patients they have been scheduled to consult.
• Administrators can see records across centres in order to operate the service.

A technician at one centre cannot see patients from another centre, even by altering a web address.

5. Service providers we rely on

We use a small number of providers to run Aafiya. Each receives only what it needs to perform its function.

6. Google user data

This section describes exactly how Aafiya handles data obtained through Google APIs. It applies only to doctors who choose to connect a Google account.

What we request

• calendar.events — to create, update and cancel consultation events on the doctor’s calendar and attach a Google Meet link.
• userinfo.email — to show the doctor which Google account is connected, so they can confirm it is the right one.

What we do with it

• We create calendar events for scheduled consultations only. We do not read, index or analyse the doctor’s existing calendar entries.
• Event details are deliberately minimal: a title identifying the consult, the patient’s first name, the appointment time and a meeting link. No clinical information is ever written to Google Calendar.
• We store a Google refresh token so that events can be created at the moment a booking is made. It is held server-side and is never sent to a browser.

Limited Use commitment

Aafiya’s use of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements. Specifically, we do not transfer or use Google user data for serving advertising, we do not allow humans to read it except with the user’s explicit permission, for security purposes, or where required by law, and we do not sell it.

Disconnecting

A doctor can disconnect at any time from their Settings page, which deletes the stored refresh token immediately. Access can also be revoked directly at myaccount.google.com/permissions. Calendar events already created remain on the doctor’s calendar and can be deleted there.

7. Artificial intelligence

Aafiya uses an AI assistant to help technicians take a more complete history. It reviews the history recorded during a visit and suggests follow-up questions and a completeness score.

• The assistant is decision support only. It does not diagnose, does not prescribe, and does not make clinical decisions. Every suggestion is labelled and shown alongside the information it was based on.
• Only the clinical history text of a single visit is sent. Patient names, contact numbers and identity documents are not included.
• The content is not used to train AI models.

8. How long we keep information

Medical records are retained for as long as the partner centre requires them to provide continuing care and to meet its record-keeping obligations. Audit records are retained for the life of the platform, as their purpose is accountability. Staff accounts are deactivated rather than deleted, so that past actions remain attributable.

9. Security

• All traffic is encrypted in transit; stored data is encrypted at rest.
• Access rules are enforced at the database level, so they apply to every request regardless of how it is made.
• Uploaded documents are held in private storage and are reachable only through short-lived links issued to authorised staff.
• Significant actions are recorded in an audit log.

No system is perfectly secure. If we become aware of a breach affecting personal information, we will notify the affected partner centre without undue delay.

10. Patient rights and requests

Because patients do not hold accounts, requests to access, correct or delete a record should be made through the partner centre where the patient was seen. Centre staff can correct records directly, and every correction is logged. Requests that cannot be resolved at the centre can be sent to us using the contact details below.

11. Children

Children are treated at partner centres and their records are handled the same way as any other patient record, with consent given by a parent or guardian at the centre. Aafiya accounts are never issued to children.

12. Changes to this policy

If we change this policy we will update the date at the top of this page. Material changes affecting how patient information is handled will also be communicated to partner centres directly.

13. Contact

Questions about this policy, or requests relating to personal information, can be sent to malaika@secondemployee.net.