Privacy policy

Health data is sensitive personal data

Under Act 843, information about your health is a special category of personal data. We treat it accordingly: it is collected only for the purpose of providing care, accessed only by the provider you consult (and, where you choose to route a prescription, the pharmacy fulfilling it), and is never sold or used for advertising.

What we collect

• • Account details: name, phone number, and (for providers/pharmacies) license or registration information
• • For providers specifically: a photo of your current MDC license renewal certificate, used to automatically verify your credentials against the Medical and Dental Council's own registry
• • What you tell us about your concern, and any pre-screen answers, before a consultation
• • The consultation record: notes, prescriptions, and referrals your provider creates, including any lab test referral and the results you choose to upload
• • Consult chat messages: monitored for platform-safety purposes, including attempts to share contact details to move a paid consultation off SabiDoc; messages that appear to do this are blocked and a record of the attempt is kept
• • Your phone number is verified by a one-time SMS code at sign-in, sent via our payment processor Hubtel's SMS gateway
• • Payment metadata (amount, timestamp, method): full card or Mobile Money credentials are handled by our payment processor, Hubtel, not stored by us
• • If you subscribe to SabiDoc Plus, your subscription status and billing history (start date, renewal date, and whether a payment succeeded or failed), not stored any differently from a one-off consultation payment
• • Basic device and usage data needed to keep the service reliable and secure

Why we collect it

To match you with an appropriate, verified provider; to let that provider review your history and prepare for your visit; to generate a prescription any pharmacy can verify; to process payment, including recurring SabiDoc Plus billing if you choose to subscribe; and to maintain your portable health record across visits. Wellness tips shown in the app are the same generic content for every patient. We do not use your health record to personalize non-clinical content without a deliberate, separate decision to do so.

Who can see your data

The provider you're matched with sees your intake, pre-screen answers, and history relevant to that visit, including any lab results you upload in response to their referral. A pharmacy you route a prescription to sees only that prescription. A lab partner you route a referral to sees only that referral. SabiDoc staff can access records only as needed to operate the platform (for example, reviewing a complaint or a flagged chat message) or where required by law. If you contact support or a ticket you filed is updated, your email address and the ticket contents are sent to our transactional email provider, Resend, solely to deliver that notification to you.

Automated processing of your data

Some of what you write, such as a description of your concern or a message in a support conversation, is processed by automated software to draft a note for your provider, suggest how soon a doctor is needed, or answer a general question about how the app works. That processing is performed by Groq Inc., a US-based AI infrastructure provider acting as our sub-processor. Groq does not use your data to train its own models, and nothing this software produces becomes part of your record until a licensed provider has reviewed and approved it.

Cookies and analytics

We use a small number of cookies to keep you signed in and to understand which pages and campaigns lead people to sign up, so we can spend our limited marketing budget on what actually works. This does not include your health data. You can control cookies through your browser settings.

Where your data is processed

Our infrastructure providers, including Supabase (database and authentication), Vercel (web hosting), Hubtel (payments and SMS verification), Resend (email), and Groq (described above), may process data outside Ghana, including in the United States. Each is bound by its own data protection obligations to us as a condition of processing your data.

How we protect your data

Sensitive fields like your stated concern are encrypted at rest, not just in transit. Access to patient records is restricted by role, so a pharmacy sees only the prescription routed to it and a provider sees only patients they are actually matched with. We rate-limit and monitor the platform against abuse. No system is perfectly secure, but this is the standard we hold ourselves to.

Your rights

Under Act 843 you can ask to access, correct, or request deletion of your personal data, and object to specific processing. Contact us using the details below to exercise any of these rights.

Children and dependents

A family plan lets one adult account holder add dependents, including minors, to manage their care. In that case, we collect a dependent's data from the adult account holder, not directly from the dependent, and the account holder is responsible for the accuracy of the information they provide on a dependent's behalf.

Retention

We keep consultation records for as long as your account is active, so your record stays portable across visits and providers, and for a limited period afterward as required for legal, medical-record, or dispute-resolution purposes.

If something goes wrong

If a data breach is likely to put your rights at risk, we'll notify the Data Protection Commission and affected users without undue delay, as required under Act 843.

Contact

Questions about this policy or your data can be sent to privacy@sabidoc.com.