Your consent forms

Controller: Dr. Mohammad Al-Hajjiri, consultant cardiologist, Amman. Clinic phone (Hajjiri Health Line): +962 7 9311 1123. We are committed to protecting your personal data and its privacy. Please read every clause carefully. 1. Your details: your full name, email, phone, and identifiers (your app account and clinic file number) are filled automatically from your clinic record. Before activation, the clinic binds the email address it confirmed with you to that record. You cannot replace it during activation, and it remains unverified until you prove control with the code sent there. A residence address is asked only if ever needed for verification. 2. Purposes of processing - tick each purpose you agree to: Purpose 1 - My care through this app. Processing my data so that my records, results, medications, reminders, clinic letters, and my messages with the clinic are available to me through this app, operated for the Controller by his company, Al Qalb Al Mutanaghim for Computer Programming L.L.C. (the data processor). This includes the clinic reading a laboratory report I upload with its AI service to enter results faster, and authorized staff using N-AI in conversation to support my care and clinic work: prepare a patient briefing, answer chart questions, review changes, prepare for visits, read the clinic roster and calendar, answer role-authorized questions across records, review aggregate practice statistics and clinic work queues, and draft notes for human review. Read-only clinic work includes information about messages, requests, consents and administrative records within the staff member's existing access. N-AI can also provide general medical explanations and conditional clinical considerations for the treating clinician to assess, as described in section 4. Using identifiable information about me requires my current consent to both the care and transfer purposes in this form. Aggregate operational counts can cover the full clinic register without supplying patient identities or clinical text to the model; the optional N-AI assistant I can use myself has its own separate consent. Optional video consultations require a separate consent before each booked visit; this care-and-data consent does not authorize a video call. Purpose 2 - Transfer and exchange of my data, including storage outside Jordan. Transfer and exchange of my personal data with the recipients in section 4, including Microsoft Azure hosting and storage in Sweden and Front Door's global processing of requests and responses, which may occur outside Sweden and the European Union. Sharing my data with another person, including any recipient, for marketing purposes: NOT REQUESTED HERE. This form does not ask for any marketing consent. The only marketing the clinic offers is its own optional email newsletter, under its own separate consent: it stays off unless you choose it yourself, using the optional box below or the More screen at any time, it uses your email address only, and it switches off just as easily. Your data is never sold or shared for anyone else's marketing. 3. Types of data collected and processed. Personal data: name, date of birth, sex, phone number, email, preferred language, app account and clinic file identifiers, and the names and phone numbers of your two emergency contacts. Sensitive personal data (health data): your conditions and history, medications, laboratory results, reports and documents you upload, visit notes and clinic letters, appointments, and your messages with the clinic. Staff N-AI also processes role-authorized chart, clinic-roster and calendar information, cross-record query results, aggregate practice statistics, and clinic work-queue, message, request, consent and administrative information supplied for a request, staff messages and rough notes, recent context from the same staff conversation, and generated responses and drafts, with a safety trail of the request, processing and outcome. If you separately agree to a video visit, live audio and optional video, participant identifiers, and connection and call-quality information are also processed as explained in the video consent. If you enable phone alerts, we also process your app-installation identifier, notification registration token, platform, preferred language, and opaque registration and notification identifiers with technical delivery status. For activation, password recovery and deletion confirmation, we process the email address bound to your record by the clinic, a one-time code, its purpose, attempts, expiry and verification status, and technical delivery metadata. When deletion is completed, we also process that verified address in a field-level encrypted delivery job, a fixed bilingual receipt describing the broad classes erased and retained and the next retention review date, and coded delivery status. We do not collect your national ID or passport number or payment data, and we do not request GPS or precise device location; network addresses can reveal an approximate location. Retired services. Voice dictation, N-AI Wellbeing and mental-health screening are no longer provided. Historical clinical records and original consent receipts remain subject to their retention rules. Former wellbeing conversation data is not used for AI and can be erased through the withdrawal form. No new consent for these retired services is requested. 4. Sharing data with another person, including the recipient, inside and outside Jordan. Clinic staff and the company's technical staff: access limited by role to named, logged individuals. Microsoft Azure hosts the app and clinic console and stores the clinic's database and uploaded files in Sweden. Its Front Door service handles requests and responses, including personal and health information, through a global network that may process them outside Sweden and the European Union. Microsoft Azure OpenAI processes AI requests within the European Union data zone, which can include EU countries other than Sweden. When the clinic reads a laboratory report you upload, this AI service receives the report file (which may show your printed name) to extract the values; a member of clinic staff verifies every value before it enters your record. For staff N-AI, the same Azure OpenAI service receives staff messages, rough notes, recent conversation context and relevant role-authorized chart, roster, calendar, cross-record, statistical, work-queue and administrative information. Filters are applied to direct identifying details, age is provided as a range, and structured patient entries use references rather than names. Clinical or free text may still contain personal information. General chat and clinic-wide read-only questions do not require opening an individual chart. Aggregate operational counts may include the full clinic register, including records not eligible for individual AI use, without supplying those patients' identities or clinical text. Identifiable patient processing requires current consent to both care and transfer. A focused individual chart discussion or patient-specific clinical draft requires staff to select and verify one patient. Each clinic-wide patient result stays tied to its permanent internal record identifier; matching names or reused chart numbers do not merge records, and uncertain identity requires staff verification. Every read stays within the staff member's existing permissions. This assistant does not read your conversations with the patient N-AI assistant or wellbeing companion. It can explain information, discuss conditional options for a treating clinician to assess, and produce unsaved drafts. Staff must distinguish suggestions from recorded facts, check the sources and review drafts. N-AI makes no autonomous clinical decisions, issues no prescriptions, and cannot save or sign records, send messages, or change your chart or the clinic calendar. Microsoft's data-protection terms govern this processing. The clinic uses encrypted hosting connections and encrypted database and file storage. Microsoft does not use submitted prompts and responses to train its foundation models. To detect misuse, flagged content may be stored and reviewed under Microsoft's abuse-monitoring terms; any authorized human review for this European deployment takes place within the European Economic Area. Public web research: staff can ask about generic public topics using a separate Bing search feature through Azure. Only public queries are permitted, with checks for identifiers and private case details; patient charts and conversation history are not supplied to the search request. Bing search is governed by separate Microsoft terms and is outside the Azure OpenAI data-processing and EU data-zone commitments described above. Public queries, retrieved sources and generated research are included in the clinic's staff AI safety trail. Plus Five Five, Inc. (Resend): receives the email address the clinic bound to your record, either a neutral verification-code message for account activation, password recovery or deletion confirmation, or a fixed bilingual account-deletion receipt, plus technical delivery metadata. The deletion receipt states that the account closed, names only broad data classes erased or retained and gives the next retention review date. It contains no patient name, record identifier, clinical value, diagnosis, result, medicine, attachment or marketing. Sending is configured in Resend's Ireland region (eu-west-1), but this does not mean storage or processing stays only in the EU. Resend's data-processing addendum identifies primary processing in the United States, incorporates the EU's 2021 standard contractual clauses, and treats account and usage data under separate terms. These necessary account emails do not enroll you in, or infer consent for, the optional newsletter. Documented acceptance of the required data-processing addendum and completion of the Controller's Article 15(b) transfer assessment are required before patient use. At this version date, both are still pending, and this consent does not replace them. Daily, Co. (United States), only if you separately agree to a video visit: carries encrypted call media with a Frankfurt relay configured, and processes participant, connection and call-quality data. Operational processing can take place outside the EU, including in the United States. Daily's data-processing terms distinguish its processing of call content from its separate-controller role for account and usage data and include international-transfer safeguards where applicable; the video consent and privacy policy explain these in full. Optional phone alerts: when enabled for your device, Apple Push Notification service (APNs) on iPhone or Google Firebase Cloud Messaging (FCM) on Android receives a device registration token, neutral alert text and opaque notification identifiers. These providers process technical delivery data under their service and privacy terms; their processing is not confined to the EU and can include the United States. Alerts contain no patient name, message text, test result, medicine, diagnosis or appointment detail. The app name and the fact that an alert arrived may still be visible on your phone. There is no Expo push relay. Medication alerts are scheduled locally on your phone, with neutral text. You can disable phone alerts in the app or system settings. Turning them off cancels locally scheduled alerts and requests removal of the device registration. Remote alerts may still arrive if the phone is offline or removal fails, until the service confirms the change; disabling alerts in the phone settings blocks their display. An alert already accepted by a delivery provider cannot be recalled. Government bodies: only where the law requires. The Controller must verify and document the protection provided by a recipient before a transfer begins, under Article 15(b) of the Personal Data Protection Law No. 24 of 2023. This consent does not replace that written assessment. 5. Retention period. Your data is retained until you withdraw your consent or your account closes, unless a legal obligation requires us to retain it longer: the medical record itself is kept for the period medical-record law requires (the clinic's working period is 10 years) and is locked away, not erased, if you leave. The clinic retains the full tamper-evident staff N-AI safety trail for the same period as the medical record, including submitted messages and rough notes, supplied chart and clinic-wide information, query results, statistics and conversation context, model responses, safety checks and what staff saw. A draft is not a saved clinical note; its inclusion in this safety trail does not add it to your chart. Reminder schedules, your taken/skipped history, and your notifications inbox are erased immediately on account deletion. Device registrations and queued alerts are removed once the service confirms that you disabled alerts, signed out of that device, withdrew core consent or closed your account. If you remain signed in and have a connection, the app retries an unconfirmed request to turn alerts off when you reopen the app or choose Retry. If sign-out could not reach the service, remote alerts may continue until the registration is removed or expires; phone settings can block their display. Unrefreshed registrations expire after 90 days, and delivery metadata after seven days. Alerts already handed to Apple or Google and their operational records follow those providers’ terms. For a deletion receipt, the verified address is copied into a field-level encrypted delivery job while the account email is erased. The encrypted address and provider correlation identifiers are erased when delivery is confirmed or another written channel is recorded; signed webhook receipt identifiers are retained for no more than seven days. 6. Contact for exercising your rights. To exercise any of your rights under the Personal Data Protection Law No. 24 of 2023 (to know and access your data and obtain a copy; withdraw consent without penalty; correct, update, or complete it; restrict processing to a defined scope; request erasure or concealment; object to processing, including automated profiling; move a copy to another controller; and be told of any breach), contact the clinic at admin@hajjiriheart.app or +962 7 9311 1123. Your request is answered within 15 working days, free of charge, and the app's More screen offers each right directly. 7. Privacy policy. For full information on how your data is collected, processed, and stored, see the privacy policy (version 4.13) via the link below. Confirmation. Having reviewed the clauses of this form and the privacy policy, I consent to the processing of my personal data for the purposes I ticked above. I confirm I am 18 or older and that my two emergency contacts are adults whom I have told I am naming. I acknowledge that I have been informed of my full right to withdraw my consent at any time, as easily as I give it now, without penalty, and that withdrawal does not affect the lawfulness of processing carried out before it. My tap while signed in is my signature, documented electronically with the exact text, version, language, date, and time.

Before you join a video visit Controller: Dr. Mohammad Al-Hajjiri, consultant cardiologist, Amman. Clinic phone (Hajjiri Health Line): +962 7 9311 1123. Data subject: you, the account holder signed in when this consent is given; your name, email, phone and identifiers are as recorded in your account. Al Qalb Al Mutanaghim for Computer Programming L.L.C. operates the app for the doctor as data processor. Please read every clause carefully. 1. Purpose and choice. This separate consent is for your scheduled consultation with Dr. Al-Hajjiri by video or audio inside Hajjiri Heart, including the transfer of call data described below. It applies to this booked visit and any rejoin of the same visit. Video is optional: choosing Not now leaves the appointment booked, and you can contact the clinic to arrange an in-person visit instead. Declining video does not affect the rest of the app or your other care. No marketing consent is requested here. 2. Data and participants. The call uses your microphone and, if you allow it, your camera. Permission is requested when you open the call; you can mute your microphone, turn off your camera or leave at any time. Clinic staff may join at the doctor's direction and are visible as participants in the call. What you show and say can reveal your identity and health information. Choose a private place for the call. The app sends generic participant labels and opaque identifiers specific to the visit, without your name, phone number or chart number, but your face, voice and discussion are not anonymous. Daily also receives connection and call-quality information, including IP addresses, device information, participant identifiers and call times. 3. Recipient, location and safeguards. Daily, Co., a United States company, provides the call service under its data-processing terms. Call media is encrypted in transit and configured to use a relay in Frankfurt, Germany. This does not make every part of the service EU-only: Daily's operational processing can take place outside the EU, including in the United States. Daily processes call content to provide the service and acts as a separate controller for its account and usage data, including service reliability, security and legal compliance. Its data-processing addendum includes international-transfer safeguards, including standard contractual clauses where applicable. The clinic's written assessment of these transfers is separate from your consent. 4. Recording and retention. The clinic does not record or transcribe these calls, and this integration does not enable Daily recording or transcription. The app cannot prevent someone using another device to record; participants must not record the visit. The doctor may write clinical notes. The appointment, its outcome and the notes are kept with your medical record for its retention period; this consent and any withdrawal are kept under the consent-record retention rules in the privacy policy. Daily retains operational logs separately from call media, for service, security and legal purposes under its retention terms. The number of days of logs available in the clinic's Daily dashboard is not a promise that older logs have been deleted. 5. Stopping, withdrawal and rights. You can stop participating immediately by leaving the call. You may withdraw this consent without penalty or exercise any of your data rights by contacting the clinic through the More screen or the Health Line. You can also contact the clinic at admin@hajjiriheart.app or +962 7 9311 1123. The clinic answers rights requests within 15 working days, free of charge. Withdrawal does not erase clinical records that must be retained or affect the lawfulness of earlier processing. The rest of your care remains available. 6. Safety and privacy policy. Video visits are not for emergencies. For chest pain or severe symptoms now, call 911. If the connection fails, leave the call and contact the clinic by phone. Privacy policy 4.13, available through the link below and the More screen, explains the data, recipients, safeguards, retention and your rights in full. Confirmation. Having reviewed this form and the privacy policy, I consent to the processing and transfers described above for this visit. I confirm I am 18 or older. I acknowledge that I have been informed of my right to withdraw this consent at any time without penalty and that withdrawal does not affect the lawfulness of processing before it. My tap while signed in is my signature, documented electronically with the exact text, version, language, date and time.