Privacy Policy – Elaj Asan App

App name: Elaj Asan
Package name: com.akhsp.virtualdoc.patient
Last updated: 2 June 2026

This Privacy Policy applies only to the Elaj Asan mobile application (“App”). It explains what personal and health-related information we collect, why we collect it, how we use and share it, and what choices you have.

1. Who this policy applies to

This policy applies to patients and authorized family members who use the Elaj Asan Patient App to book virtual consultations, manage appointments, access medical information, receive notifications, and use related patient services offered by AKUH.

2. Information we collect

Depending on how you use the App, we may collect the following categories of information:

• Account and identity information: name, mobile phone number, email address (if used), profile details, and family member information you provide during registration.

• Authentication information: one-time passwords (OTP) sent via WhatsApp or SMS for login verification, and optional biometric login data stored locally on your device through your phone’s secure biometric system (we do not receive your fingerprint or face data).

• Health and medical information: appointment details, consultation history, medical documents, prescriptions, pharmacy orders, surveys, assessments, and other health-related records you access or submit through the App.

• Audio and video data: camera and microphone data during live video consultations with healthcare providers.

• Images and files: photos or documents you upload (for example profile photos, medical reports, or pharmacy-related images).

• Location information: approximate or precise location when you use map or pharmacy delivery features, only if you grant location permission.

• Device and technical information: device model, operating system, app version, IP address, network information, crash logs, and app usage analytics.

• Communications and notifications: push notification tokens and notification-related metadata used to deliver appointment reminders, incoming call alerts, and service messages.

• Advertising/analytics identifiers: the App may use Google Firebase Analytics, which can access device advertising or analytics identifiers for app performance and usage measurement. The App does not display third-party advertisements.

3. How we collect information

• Information you enter directly in the App (registration, profile updates, appointments, uploads).

• Information generated when you use App features (video calls, pharmacy orders, surveys).

• Information collected automatically through the App, our servers, and integrated service providers.

• Information from WhatsApp OTP messages when you choose login via WhatsApp. If you enable notification access on your device, the App may read WhatsApp notification text only to detect and autofill the OTP code for login convenience. The App does not read your other WhatsApp chats.

4. Why we use your information

We use your information to:

• create and manage your patient account;

• verify your identity using OTP, email, or biometric login;

• book, manage, and conduct virtual medical appointments;

• provide video consultation services between patients and healthcare providers;

• store and display medical records, documents, prescriptions, and appointment history;

• process pharmacy orders and related delivery/location services;

• send notifications about appointments, calls, and service updates;

• maintain App security, prevent fraud, and troubleshoot technical issues;

• improve App performance and user experience through analytics;

• comply with legal, regulatory, and hospital policy requirements.

5. Permissions the App may request

The App may request device permissions including:

• Internet and network access – required for App functionality.

• Camera – video consultations and photo/document upload.

• Microphone – audio during video consultations.

• Location – maps and pharmacy/location-based services.

• Notifications – appointment and incoming call alerts.

• Biometric authentication – optional faster login.

• Notification listener access (optional) – only if you enable it, to autofill WhatsApp OTP codes during login.

• Phone state / accounts (where applicable) – for device and authentication-related functions supported by integrated SDKs.

You can manage or revoke permissions in your device settings. Some features may not work if required permissions are denied.

6. How we share information

We do not sell your personal information. We may share information only as needed to operate the App and provide healthcare services, including with:

• AKUH healthcare teams and authorized staff involved in your care or appointment management.

• Service providers and technology partners that help us host, secure, and deliver App services, such as:

  • Google Firebase (authentication, database, storage, messaging, analytics)

  • Agora (real-time audio/video consultations)

  • Turn.io / WhatsApp messaging services (OTP delivery)

  • Google Maps / Google Play services (maps and device services)

  • Cloud hosting, security, and IT support providers engaged by AKUH

• Legal and regulatory authorities when required by applicable law, court order, or to protect rights, safety, and security.

All third-party providers are required to process data only for authorized purposes and in accordance with applicable privacy and security obligations.

7. Data storage, security, and retention

We use administrative, technical, and organizational safeguards to protect your information, including encryption in transit where supported, access controls, and secure cloud infrastructure.

We retain personal and health information only for as long as necessary to provide services, meet legal and medical record retention requirements, resolve disputes, and enforce our policies. Retention periods may vary depending on the type of data and applicable law.

8. International and cross-border processing

Some of our technology service providers may process data on servers located outside Pakistan. Where this occurs, we take steps to ensure appropriate safeguards consistent with applicable law and hospital policies.

9. Your choices and rights

Subject to applicable law and clinical record requirements, you may have the right to:

• access and update your profile information in the App;

• request correction of inaccurate information;

• withdraw optional permissions (such as location, notifications, or biometric login) through device settings;

• request information about how your data is used;

• request deletion or restriction of certain data where legally permitted (some medical records must be retained by law).

To exercise your rights, contact us using the details in Section 13.

10. Children’s privacy

The App is intended for use by patients and authorized family members under applicable hospital policies. If you register a minor family member, you confirm that you are legally authorized to provide their information. We handle children’s information in accordance with applicable law and hospital consent requirements.

11. Third-party links and services

The App may contain links or integrations with third-party services (for example maps, payment pages, or informational web content). This Privacy Policy does not apply to third-party websites or services outside our control. Please review their privacy policies separately.

12. Changes to this policy

We may update this Privacy Policy from time to time. When we do, we will update the “Last updated” date above. Material changes may also be communicated through the App or other appropriate channels. Continued use of the App after an update means you accept the revised policy.

13. Contact us

If you have questions, concerns, or requests regarding this Privacy Policy or your personal data, contact:

The Aga Khan University Hospital, Pakistan
Stadium Road, Karachi, Pakistan
Phone: +92 21 111 911 911
Website: https://hospitals.aku.edu/pakistan

14. Google Play Data safety alignment

For transparency with Google Play users, the data practices described in this policy are intended to align with the App’s Google Play Data safety section, including collection of personal information, health information, device identifiers, photos/videos, audio, location, and app activity for App functionality, account management, analytics, and communications.

© The Aga Khan University Hospital, Pakistan. All rights reserved.