Privacy policy

This policy covers Hajjiri Heart on iPhone and Android, the staff console and this website. Dr. Mohammad Al-Hajjiri, Amman, Jordan, is the controller of the clinical record and the app processing described here. Al Qalb Al Mutanaghim for Computer Programming L.L.C. operates the service as processor on his instructions. Clinical accounts are for the clinic’s patients aged 18 and over, using a clinic-issued registration code. Where available, the public library and device-only personal tools do not require that account. Processing starts when the clinic records your details and when you use the relevant service, under the purposes and permissions below.

These optional features may not be available in your app version. You do not need a Hajjiri patient account to use the public library or personal tools. You can organise your own notes and prepare for a visit with any doctor. The tools do not diagnose, interpret measurements or monitor your health, and their content is not sent to N-AI. Clinical account requirements remain separate.

• On this device: your timeline, family-history notes, visit plans, unfinished drafts remain on this device after closing the app. They are not uploaded to your patient account or sent to the clinic by these tools. Signing in or out does not transfer or erase this separate personal notebook. It uses encrypted local storage and device authentication. Someone able to unlock this device may be able to open it, including when a different patient account is signed in. Avoid relatives' names, contact details and identifying free text.
• Keeping and removing local notes: the personal notebook is excluded from ordinary app backups. It is not a backup or recovery service. Removing the app, clearing its data, losing the phone or losing its protected key can lose the notes. You can erase notes using the personal-tools controls. To keep a separate copy, explicitly export your chosen notes before erasing them or changing phones.
• Exports you choose: you can preview selected information and export a PDF to show or share with any doctor. The tools do not submit visit plans to the clinic console. The app does not read an exported PDF back into your medical record. Exported files, screenshots, recordings and copies shared with another app are outside Hajjiri's deletion controls. The destination you choose handles its copy under its own terms. Export or share only information you intend that recipient to receive.
• Earlier optional storage: account-notebook storage and clinic preparation sends are no longer offered. If this device holds an earlier account copy, recovery controls let you read, export or erase it. Signing out removes those account copies, including unfinished edits, and keeps your separate personal notebook. Limited earlier consent, withdrawal, security and content-free operation records can remain under the retention rules below. Operation receipts and deletion markers become eligible for scheduled removal after 30 days. Provider backups follow separate retention and controlled-restore rules.
• Heart Health Library: public articles need no patient login. Service and network providers process connection information, such as IP address, device/browser information and the requested article, to deliver and protect the service. This library adds no per-patient reading profile or article-view counter. In newer app versions, saving a public article keeps only its reference in encrypted storage on this phone, without a separate Face ID or notebook unlock. Anyone using the app on this phone can see the saved list. Remove a reference with the same Save control, or use Clear saved list to remove all references, including unavailable articles. References are not synced to an account. They are cleared after reinstall and may also be lost if app data is removed or the phone is lost. Earlier bookmarks saved inside the private notebook remain protected there and are not moved automatically. Article text is fetched from the current public library, so withdrawn or expired content may no longer open. External source links open another provider's service under its own privacy policy. Earlier article features and existing aggregate counters are described separately below.

Required identity, contact and care information supports your account and care. Optional features are identified below. We process:

• Your name, birth date, sex, language, phone, clinic-bound email and chart number, plus insurance and occupation recorded by the clinic.
• Your conditions, results and reports, medicines, visits, notes, letters, prescriptions, appointments, follow-ups and requests.
• Care-team messages, photos, PDFs, annotations and staff voice notes; reminder settings, dose history and notification records.
• Two adult emergency contacts’ names and phone numbers, supplied by you. Tell them you are sharing their details. The clinic uses these only for emergency contact connected with your care, never routine messages or marketing.
• AI questions, relevant record context, responses and drafts; optional video connection data; and account, consent, access and security records, including IP and device information.
• We do not collect your national ID or passport number, phone contact list, advertising identifiers or precise GPS location. Face ID and fingerprints stay on your device. IP addresses may indicate approximate location.

We use data to provide and coordinate cardiac care, maintain records, communicate with you and protect the service. Applicable bases under Jordan’s Personal Data Protection Law No. 24 of 2023 include explicit consent, healthcare, legal record-keeping obligations and protection of vital interests. The app’s care and overseas-processing permissions are requested explicitly. Patient N-AI, video visits and newsletters have separate choices. We do not sell data or use health records for advertising. No automated system makes clinical decisions about you.

Microsoft Azure OpenAI processes these features within its EU data zone, which can include EU countries other than Sweden. We reduce direct identifying details before sending context; clinical text may still be personal data. Microsoft does not use submitted content to train foundation models. Flagged content may be retained and reviewed under its abuse-monitoring terms; authorized human review for this European deployment takes place in the EEA.

• Patient N-AI is optional. It explains your results, medicines and appointments using your question and relevant record information. This may involve automated analysis of your information, which you can object to. It does not diagnose, prescribe or change treatment. Withdraw its consent from More to stop it without stopping other care features.
• If you choose Report response, you share only that answer with the clinic for safety review. Other private AI messages are not shared. The quoted answer is erased with your AI history; a record that you made a report remains.
• Staff N-AI uses authorized record and clinic information, staff questions and recent conversation context for briefings, questions, clinic work and unsaved drafts. Identifiable patient use requires valid care and overseas-processing consent. Staff can also discuss general knowledge and conditional clinical considerations. They must review outputs; N-AI cannot save, sign, prescribe, send messages or change appointments.
• The staff assistant cannot read private patient N-AI conversations. Its public Bing research uses generic topics, with checks against sending identifiers or private case details; patient charts and conversation history are not supplied to web search. Bing has separate Microsoft terms and is outside Azure OpenAI’s EU data-zone commitment.
• Staff may use AI to transcribe lab reports into proposed results. Staff check and confirm them before saving. The report can contain identity and health information. AI can make mistakes and does not replace clinical review.
• The clinic retains an AI safety trail containing submitted information, supplied context, responses, drafts and check results, including rejected responses, as described under retention. Clearing a chat does not erase that trail.

• Microsoft AI privacy terms

Activation, recovery and deletion codes go to the email the clinic has connected to your record. Resend delivers neutral account messages and, where a verified address is available, a deletion receipt describing broad data categories, not clinical details. Changing an email requires identity verification. Necessary account emails do not subscribe you to marketing.

• Phone alerts are optional. Apple APNs or Google FCM receives delivery tokens, neutral text, technical delivery information and opaque identifiers. Lock-screen alerts do not include names, diagnoses, results, medicines or message content. Local medicine reminders use your device. Delivery can be delayed by connectivity or phone settings and is not an emergency service.
• The clinic newsletter uses only your email after a separate opt-in, never your health record or emergency contacts. Turn it off in the app at any time. The clinic adds no advertising or behavioral tracking software. Article views contribute to an unlinked article count.

Each scheduled video visit asks for separate consent. You can decline, mute, turn the camera off or leave without withdrawing other consents. Declining keeps the booking so you can arrange an alternative with the clinic. A moved visit asks again. Your face, voice and discussion can reveal identity and health information, despite generic participant labels.

• Daily, Co. provides encrypted call transport configured through Frankfurt, Germany. It also receives IP, device, participant, timing and quality information. Its operational account and usage processing can occur outside the EU, including the United States, under its separate privacy and data-processing terms.
• The clinic does not record or transcribe calls. Participants must not record; the app cannot prevent recording with another device. Appointment details, consent and any clinical notes are retained. Contact the clinic to withdraw video consent or exercise your rights over provider-held data. Call 911 in an emergency.

• Daily privacy policy
• Daily data-processing terms
• Daily subprocessors

Your care team accesses records in Jordan. The following providers support the service. Overseas processing requires the applicable permission and the controller’s assessment of recipient protection under Article 15(b); consent does not replace that assessment. The separate provider-contract and transfer reviews must be completed before real-patient launch.

• Microsoft Azure hosts the app, database and uploaded files in Sweden. Front Door handles requests and responses, including personal and health information, through a global network. This processing is not limited to Sweden or the EU.
• Microsoft Azure OpenAI processes the AI features within the EU data zone under Microsoft’s data-protection and abuse-monitoring terms. The separate public Bing search described above has its own terms.
• Plus Five Five, Inc. (Resend) receives the account email, neutral message or deletion receipt and delivery metadata. Sending is configured in Ireland, but Resend identifies primary processing in the United States. Its data-processing addendum includes standard contractual clauses; the sending setting is not an EU-only guarantee.
• Daily handles video as described above. Apple and Google handle enabled remote phone alerts under their developer, privacy and data-processing terms; processing can include the United States.
• Cloudflare provides domain services and the staff sign-in bot check, processing technical browser and connection information under its privacy terms. Have I Been Pwned receives only a partial password fingerprint for breached-password checks, not your password or identity. If enabled, RxLabelGuard receives medicine names for staff safety information, not patient details.

• Front Door locations
• Resend data-processing terms
• Cloudflare privacy

Retention depends on the record and legal obligations. Access to retained records is restricted. Deleting an account does not erase records the clinic must lawfully keep.

• Medical records, including clinical documents, care-team messages and attachments: at least 10 years after the last visit, or longer where law or a legal claim requires. Existing screening results and clinical transcripts follow these rules.
• Patient N-AI history: erased on AI-consent withdrawal or account deletion. The clinic’s separate patient and staff AI safety trails, including supplied context, generated drafts and rejected outputs, are retained for the medical-record period. Staff cannot read private patient AI history.
• Consent and withdrawal receipts: kept for the medical-record period plus applicable legal limitation periods to prove permission and how requests were handled. Account activity audits follow the medical-record period.
• Reminder schedules, dose history, notification inbox, login sessions and code records: erased when account deletion is completed. Temporary deletion-email delivery details are erased after confirmed email or manual delivery; duplicate-delivery receipt identifiers expire after seven days.
• Provider security, email delivery and video operational records follow their separate service terms. Dashboard visibility is not a deletion deadline. The clinic handles requests concerning provider-held data through the rights process below.

You can access, correct, request a copy or secure transfer of your data, object to or restrict processing, withdraw consent and request deletion. Requests are free and answered within 15 working days, with one reasoned extension where permitted. The clinic may verify identity. Exercising a right or complaining does not penalize you or reduce your clinic care.

• In More, Download my record provides a medical summary or full medical-record package. This download covers your medical record, rather than all personal data held by the clinic and its processors.
• Use Request a record correction or Manage consent in More, or contact the clinic. You choose which purposes to withdraw. Withdrawing a core purpose stops app care processing; optional AI or video withdrawal affects that feature only. Legally retained records remain. Withdrawal does not undo earlier lawful processing.
• Request deletion from More, Delete my account, or the public deletion page without the app. The clinic closes access, stops notifications and optional processing, erases data it need not retain and gives a written summary of what remains and why. Failed email delivery does not prevent deletion; the clinic uses another written channel. Contact the clinic promptly if you need to cancel an uncompleted request.
• Emergency contacts can exercise rights over their own details by phone or email without your account or password. A removed contact entry is cleared; you then supply a replacement before app care screens reopen. Clinic care remains available.

Discontinued optional features no longer collect data. Existing clinical entries and consent receipts keep their retention rules. Any previous conversations from those features remain private from staff and are not used by N-AI. To request erasure, contact the clinic or describe your request under Another specific purpose in More, Manage consent. Account deletion also erases those conversations; the clinic keeps no content-bearing safety copy of them. Microsoft’s separate abuse-monitoring terms still apply.

We use encrypted connections and storage, protected passwords, individual staff accounts with authenticator verification, role-based access, security monitoring and access audits. Device biometrics remain local. Staff and the operator are bound by confidentiality. Keep your phone and password secure and contact us about suspected misuse. No system can promise absolute security.

• Where a breach could seriously affect you, the clinic notifies you within 24 hours of discovery through available direct contact and app channels, and the Personal Data Protection Unit within 72 hours, as Article 20 requires.
• The native app does not use cookies for its account session. The website and console use necessary session cookies and local language preferences. Cloudflare’s staff bot check and Daily’s embedded video have their own privacy and browser-storage terms. We add no advertising or behavioral analytics cookies.

We date and version updates. Small wording changes or removal of features do not require another acceptance when existing permission still covers the work. We request fresh consent before changes beyond that permission, such as new purposes, data categories, recipients, processing locations or retention. Original consent receipts remain unchanged, and withdrawal remains effective.

For privacy questions, requests or concerns, contact the clinic through More, support@hajjiriheart.app or +962 79 311 1123, or at the clinic in Amman. Emergency contacts can use these routes for their own data. If the clinic does not appropriately address a privacy complaint, you may refer it to Jordan’s Personal Data Protection Directorate under the Ministry’s published procedure.

Personal Data Protection Directorate, Ministry of Digital Economy and Entrepreneurship: PDP@modee.gov.jo · +962 6 580 5700.