Privacy notice

1.1Who we are

Dawaaka Rx is operated by Novantria Health LLC, a limited liability company organized in the United States ("Novantria", "we", "us"). Contact: hello@dawaaka.com. Data Protection Officer: dpo@dawaaka.com. As a foreign company serving users in Egypt, we will appoint a representative in Egypt as Egypt's Personal Data Protection Law No. 151 of 2020 ("PDPL") requires, and publish their details on this page.

1.2Our two roles

(a) Controller: we decide how to use the data of website visitors and account holders (doctors, pharmacists, clinic staff, students, partners). (b) Processor: for prescriptions and patient details, the doctor or clinic decides what to record and why; they are the controller and we process the data only on their documented instructions, under our Clinic Data Processing Agreement. A patient who wants to exercise a right over a prescription should contact their doctor first; we will help the doctor respond.

1.3Data we collect

• Website forms: name, organization, role, mobile, email, governorate, message, and the page and button you came from.
• Accounts: name, role, mobile, email, specialty, governorate, syndicate or licence number (to verify professionals), login and security records.
• Verified doctor profiles: the details the doctor chooses to publish (name, specialty, clinic, address, hours, optional phone and photo).
• Prescriptions (only after the conditions in 1.5 are met): patient name, age or date of birth, sex, mobile (optional, for reminders), medicines and directions, follow-up date, the issuing doctor, and an audit log of who viewed, changed, verified or queried it.
• Pharmacy verification: the prescription code checked, the pharmacy, time and result.
• Technical data: IP address, device and browser type, pages viewed, error logs, and essential cookies.

We do not knowingly collect national ID numbers, payment card numbers or full medical histories, and we ask you not to enter patient data in website forms.

1.4Why we use it (and the legal basis)

• To answer your request and run the waitlist: your consent and our legitimate interest in responding.
• To create and secure your account and verify that professionals are licensed: performance of our contract with you and legal obligation.
• To issue, verify and log prescriptions: on the doctor's instructions, with the patient's explicit consent as the PDPL requires for health data.
• To send follow-up reminders: only with the patient's explicit opt-in, which they can withdraw at any time.
• To bill subscriptions and keep tax records: contract and legal obligation.
• To keep the service safe, detect misuse and fix errors: legitimate interest and legal obligation.

We do not sell personal data, we do not use patient data for advertising or marketing, and we do not let pharmaceutical companies target patients. Drug information for doctors is shown only where Egyptian law allows and never uses patient data.

1.5Health data safeguards

Health data is sensitive personal data under the PDPL. We will not process real patient data until (a) we hold the licence from Egypt's Personal Data Protection Center ("PDPC") or written confirmation from Egyptian counsel that one is not yet required for that activity, (b) the clinic has signed our Data Processing Agreement, and (c) the patient has given explicit consent. Until then, the demos use placeholder data only.

1.6HIPAA-aligned safeguards

The U.S. Health Insurance Portability and Accountability Act ("HIPAA") governs U.S. health plans, providers and their business associates; it generally does not govern care delivered in Egypt. We still apply safeguards modelled on the HIPAA Security Rule, because they are a recognized standard for protecting health information:

• a written risk analysis, reviewed at least once a year;
• unique user accounts, role-based access and the "minimum necessary" rule (each role sees only what it needs);
• multi-factor sign-in for clinic and admin accounts;
• encryption in transit (TLS 1.2 or higher) and at rest (AES-256);
• audit logs of every access to and change of a prescription, kept for 6 years;
• automatic sign-out after inactivity;
• staff confidentiality agreements and annual privacy and security training;
• a written incident response plan and the breach notices in 1.10.

We describe this as HIPAA-aligned, not HIPAA-certified; there is no official HIPAA certification.

1.7Who receives data

• The people the patient or doctor chooses: the issuing doctor and their clinic team, and a licensed pharmacy the patient shares the prescription with or that scans its code.
• Our service providers, under written contracts that bind them to confidentiality and security: cloud hosting and database, email and SMS or WhatsApp messaging, error monitoring, and, once billing starts, a licensed payment provider.
• Authorities, when Egyptian or U.S. law requires it, and only what is required.
• A successor, if Novantria is merged or sold, under the same protections; we will notify you first.

1.8Where data is stored and transfers

Website and account data is hosted with cloud providers that may store it outside Egypt, including in the European Union and the United States. Before any patient data is processed, it will be hosted in Egypt or transferred abroad only under a cross-border transfer permit from the PDPC and with safeguards at least equal to the PDPL. Patient identity is never sent to artificial intelligence or translation services outside Egypt.

1.9How long we keep data

• Website form submissions: 12 months, then deleted.
• Accounts: while the account is active, then 90 days after closure.
• Prescriptions: for the retention period the doctor or clinic sets to meet Egyptian medical record-keeping rules (default 5 years from issue), then deleted or returned to the clinic.
• Audit and verification logs: 6 years.
• Billing and tax records: 5 years, or longer if Egyptian or U.S. tax law requires.
• Backups: overwritten within 35 days.

1.10Breaches

If a breach affects personal data, we will notify the PDPC within 72 hours of becoming aware of it, notify affected clinics without undue delay and in any case within 72 hours, and help them inform patients. We will tell you what happened, what data was involved and what we are doing about it.

1.11Your rights

Under the PDPL you can ask to know what data we hold, get a copy, correct it, delete it, restrict or object to its use, withdraw consent, and be told of any breach. Send requests to dpo@dawaaka.com. We confirm receipt within 3 business days and answer within 30 days. You may also complain to the PDPC.

1.12Children

Accounts are for adults aged 18 or over. A patient under 18 is recorded only by their doctor, with the consent of a parent or legal guardian.

1.13Cookies

We use essential cookies for sign-in, security and language, and privacy-friendly aggregate analytics. We do not use advertising or cross-site tracking cookies.

1.14Changes

We will post any change here with a new version number and date, and email account holders at least 30 days before a material change takes effect.