Your data, handled with care.

We collect the minimum information needed to deliver the Service:

• Account information: name, email address, phone number, and an avatar if you upload one.
• Authentication data: hashed password, refresh tokens, and verification codes.
• Booking information: patient name, contact phone, selected doctor, hospital, shift, and appointment status.
• Payment information: Waafi phone number, transaction IDs, and payment status. We do not store full payment credentials.
• Operational data: timestamps, IP-based rate-limiting signals, and basic device information used to protect the Service.

Your information is used to:

• Authenticate you and keep your account secure.
• Confirm and manage appointments, generate ticket numbers, and notify you of status changes.
• Process payments through the Waafi gateway and reverse charges when bookings fail.
• Provide hospitals and administrators with the data they need to run their operations (e.g. doctor rosters, daily ticket lists, capacity).
• Improve reliability and detect abuse.

We share information only as needed to operate the Service:

• Hospitals and doctors receive the patient name, phone, and appointment details required to provide care.
• Waafi receives the data needed to process payments and refunds.
• AWS S3 stores uploaded images (avatars, banners).
• Email delivery providers receive the addresses required to send OTPs and notifications.

Appointment records and associated payment metadata are retained for as long as needed to provide the Service, support audits, and meet regulatory obligations.

You may request deletion of your account; appointments tied to a hospital's history may be retained in anonymized form to preserve record integrity.

Passwords are hashed with Argon2id. One-time codes are stored only as SHA-256 hashes.

Authentication uses short-lived access tokens kept in memory and refresh tokens delivered as httpOnly cookies with rotation. Reusing a rotated refresh token revokes all active sessions on the account.

No security control is perfect; you are responsible for protecting your own device and credentials.

You may update your profile information at any time from the account settings page. You may also request a copy or deletion of your data by contacting us at the address below.

The Service is not directed at children under 13. We do not knowingly collect data from children. Bookings on behalf of minors must be made by a parent or guardian using their own account.

We may update this policy from time to time. Material changes will be highlighted at the top of this page with a new "last updated" date.

Questions about this policy can be sent to goodirtechnology@gmail.com.