Draft for legal review before publication. The provider's identity, contact details, hosting countries, recipients and retention schedule must be verified for the live deployment.
1. Scope and applicable law
This notice explains how the OCA-Clinic provider and subscribing clinics handle personal data in the service. It covers clinic staff, patients and portal users. Egypt's Personal Data Protection Law No. 151 of 2020 and Executive Regulations No. 816 of 2025 apply where within their scope. Privacy and medical confidentiality are also protected by Egyptian law. This notice is information, not a request for consent.
2. Who decides how data is used
For patient and clinical records, the subscribing clinic normally decides why information is collected and how it is used; the software provider handles it on the clinic's instructions to operate the service. The provider decides how it uses account, website, support and service-security data for its own operations. Your clinic must identify itself and provide its own patient notice. The provider's registered name and address must be added here before publication.
3. Categories and sources
We handle staff names, contact details, roles and login records; patient identity, contact, appointment, health, prescription, consent and billing records entered by clinics or patients; and technical records such as IP address, device, session, access and error logs. We may also receive support messages and contact-form enquiries. Clinics decide which clinical fields to collect. Health, financial and children's data require particular care.
4. Purposes and legal grounds
Patient information is used for care administration and the clinic's lawful purposes, under the clinic's directions and an applicable legal ground. The provider uses account and technical data to provide the contract, secure and support the service, meet legal duties and defend legal claims. Each use must have a valid ground under Egyptian law; consent is sought separately where required and can be withdrawn for that use. Operational messages are distinct from marketing. Direct marketing requires its own valid permission and opt-out process.
5. Health and children's information
Health information and children's data are sensitive personal data. Clinics must give an appropriate notice and obtain any specific consent, guardian authority or other legal basis and approvals required for the particular processing. Access should be limited to authorised care or administrative staff. The provider does not use identifiable clinical records for advertising or model training under this notice. A patient's use of a portal does not replace informed consent to medical treatment.
6. Recipients
Information may be disclosed to authorised clinic staff, contracted hosting and communications providers, payment or tax services where enabled, and public authorities where legally required. Each recipient should receive only what its task requires, under suitable confidentiality and data-protection terms. The actual vendor list and any optional integrations must be identified for the live deployment. We do not sell identifiable patient records.
7. Storage and transfers outside Egypt
The service uses a private virtual server from Hostinger. The country of that server, backups and support access must be stated for the live deployment. Personal data must not be transferred outside Egypt unless a lawful route under Law 151/2020 and its regulations applies, including any required permit, safeguards or qualifying exception. A clinic should confirm these arrangements before entering patient data. This notice does not itself authorise a cross-border transfer.
8. Cookies and telemetry
Necessary cookies and local storage support login, language and preferences. Where optional analytics are configured, they should run only after the visitor accepts them; visitors can decline or change their choice in Cookie settings. Technical error reporting may be configured for operations and must avoid unnecessary patient details. The provider must verify the active tools, recipients, storage locations and retention before publishing this notice.
9. Retention and deletion
The clinic sets medical-record retention according to health, professional and legal duties. Account, billing, security and support records are kept only as long as needed for their purposes or legal obligations. On a verified exit request, the provider will arrange a secure clinic-record handover within 30 days, then return or delete active copies on documented instructions where lawful. Encrypted backups are scheduled for expiry under the configured backup period, normally 30 days unless the deployment specifies otherwise. Other exact periods must be published after the live schedule is approved.
10. Security and incidents
The provider and clinic must use measures appropriate to the sensitivity of the information, including controlled access, confidentiality, backups and incident response. Actual safeguards depend on deployment and should be documented in the clinic agreement. Suspected breaches must be assessed and reported to the Personal Data Protection Center and affected people when Egyptian law requires; the provider and clinic must cooperate to meet their respective duties.
11. Your rights
Subject to applicable law, you may ask to be informed, access or correct data, withdraw consent, object to or restrict a use, request erasure, and request transfer to another controller. A request may be limited by medical-record retention or another lawful duty. Patients should contact their clinic first; staff and website users should use the provider contact in their agreement or the website contact page. We will verify identity, route the request to the responsible party and respond within the time required by law.
12. Complaints
If a privacy request is unresolved, you may complain to Egypt's Personal Data Protection Center at pdpc.gov.eg. You may also use any judicial remedy available under law. Complaints about medical care or clinical records should first be directed to the treating clinic.
13. Contact and changes
For provider privacy questions, use the contact method in the clinic agreement or the website contact page until a dedicated privacy contact is published. Patient-record requests should go to the treating clinic. We will update the date above and provide notice of material changes. The provider's registered identity, address and dedicated privacy contact must be published here before this notice is final.