Waraqa Privacy Policy

1. What this Policy is for

Waraqa is a service that records medical consultations, with the patient’s prior consent, and turns them into written notes and summaries for the doctor. This Policy explains what information we collect, why, who sees it, how long we keep it, and what you can do about it.

It applies to patients whose consultations are recorded, to doctors, assistant doctors and secretaries at clinics that use Waraqa, and to visitors to our website.

2. Who we are

Waraqa is operated by Al Waraqa Al Thahabiya for Artificial Intelligence LLC, a limited liability company registered with the Companies Control Department under no. 84614, with its head office in Amman, Jordan ("Waraqa", "we"). When it comes to who is responsible for your data (the "controller"), it depends on the data, as explained in sections 3 and 4. For anything about data we are responsible for, contact our Data Protection Officer at dpo@waraqa.io.

3. If you are a patient

Your clinic is responsible for your data (the "controller"), including the recording of your visit. Waraqa processes it only on the clinic's behalf and under its instructions (the "processor"). Authorised Waraqa staff may review it only to run the service for your clinic and to find and fix errors, and every such access is logged. For questions or requests about your data, contact your clinic.

What is processed: the audio of the consultation, the written transcript and summary made from it, your name and phone number, and the record of your consent. This includes information about your health and, if discussed, your family's health history. If someone accompanies you, what they say during the consultation is recorded too.

Why: to produce the notes and summary your doctor reviews and approves. We do not diagnose, treat or advise; only your doctor does. No decision about you is made automatically: every note is reviewed and approved by your doctor, and your data is not used to profile you.

Your consent: before your first recorded visit, you agree on the consent screen your doctor shows you. That consent covers your later visits until you withdraw it. If you do not agree, nothing is recorded. Processing of your data starts when recording starts.

4. If you are a doctor, assistant doctor or secretary at a clinic

What we collect: your profile and account details (including your licence details if you are a doctor) and records of your logins and activity. We start processing them when your clinic invites you to join Waraqa.

Why: your clinic decides who has an account and which role each user has. We process your details only on your clinic’s behalf, to give you access, keep the service secure and support you. You agree to this on the sign-up screen. We will not use your details for any other purpose, such as marketing, unless you agree to it first.

5. Who else sees your data

Only those who need to: your clinic and the users it authorises, according to their role; authorised Waraqa staff who need it to provide the service; and the service providers below, who process it for us under contract.

Our providers: Render (hosting) in the United States; Supabase (database, file storage and backups) in Germany; Microsoft Azure (speech-to-text) in the United States; and OpenRouter (summarisation) in the United States, which passes text to Google in the United States.

Your data is sent outside Jordan only after you have agreed to it: patients on the consent screen, and doctors, assistant doctors and secretaries on the sign-up screen.

We disclose data to official authorities only in the cases authorised by law. We do not sell your data.

6. How we protect it

Your data is encrypted in transit and at rest. Each user has individual login details, access depends on the user’s role, and every access is logged.

If a breach of the security and integrity of data we process for your clinic occurs, we notify your clinic without delay, and it informs you as the law requires. If the breach involves data we are responsible for, we inform you and the relevant authorities as the law requires.

7. How long we keep it

Audio recordings: erased within 24 hours of recording, and in any event within 7 days.

Unfinished sessions: the doctor must approve every note and summary before ending a session. An unfinished session stays saved until the doctor completes it, and is erased if not completed within [period].

Notes and summaries the doctor approves, and the consent record: kept for your clinic while it uses Waraqa, then returned to the clinic or erased within 60 days, unless the law requires otherwise.

Accounts of doctors, assistant doctors and secretaries: kept while the account is open, then for 30 days for necessary billing and legal records only, and then erased.

Sign-up invitations that are not accepted: erased within [period].

Erasure reaches our database backups within 7 days and our providers' copies within 90 days at most.

8. Your rights

You can ask your clinic, or us for data we are responsible for, to: (a) let you know about, see and obtain the data held about you; (b) correct, amend, add to or update it; (c) erase or hide it; (d) limit its processing to a specific scope; (e) object to its processing where the processing is unnecessary for the purposes for which the data was collected, excessive in relation to them, discriminatory, unfair or unlawful; (f) transfer a copy of it to another controller; and (g) withdraw your consent. You also have the right to know of any breach of the security and integrity of your data.

For data we are responsible for, send your request to support@waraqa.io; doctors, assistant doctors and secretaries can also use Account settings. For data your clinic is responsible for, contact your clinic. We will acknowledge your request, verify your identity, and act on it within fifteen (15) working days from the day after we receive it. If we need more time, we will tell you why, and take no more than a further fifteen (15) working days. You may also use the forms approved by the Personal Data Protection Council.

If you are a patient, you can withdraw your consent at any time by telling your clinic, in any way. Withdrawing stops any further recording and use of your recordings, and the recordings held by Waraqa and its service providers are erased. It does not undo what was already done, and it does not remove notes already in your medical file, which your clinic keeps as the law requires. If you are a doctor, assistant doctor or secretary, you can withdraw your consent from Account settings or by telling your clinic; this ends your access to Waraqa.

9. Patients who lack legal capacity

If the patient lacks legal capacity, one of the patient’s parents or the patient’s guardian gives the consent and can exercise the rights above on the patient’s behalf.

10. Cookies

Our website and app use cookies and similar browser storage to support sign-in, security, language preferences and recovery of unsaved work. We do not use advertising or tracking cookies.

11. Complaints

For data we are responsible for, send your complaint to dpo@waraqa.io; for data your clinic is responsible for, complain to your clinic. We will give you a reference number to follow your complaint, reply within ten (10) days from the day after you submit it, and tell you the outcome in plain language. If we do not reply within that period, or you are not satisfied, you may take your complaint to the Personal Data Protection Unit at the Ministry of Digital Economy and Entrepreneurship, or to the courts. Requests and complaints are free of charge.

12. Changes and language

We may update this Policy. The current version, with its date, is always at https://waraqa.io/privacy, and we will tell clinics and users of any material change before it takes effect. Where a change needs your consent, we will ask for it again. This Policy is issued in Arabic and English; if the two differ, the Arabic text prevails.