Privacy policy

Health data is sensitive personal data

Under Act 843, information about your health is a special category of personal data. We treat it accordingly: it is collected only for the purpose of providing care, accessed only by the people described in Who can see your data below, and is never sold or used for advertising.

What we collect

• • Account details: name, your phone number and/or email address (whichever you sign up with), your chosen language (English or Twi), an optional profile photo, and (for providers/pharmacies/labs) license or registration information
• • For providers specifically: a photo of your current MDC license renewal certificate, used to automatically verify your credentials against the Medical and Dental Council's own registry
• • What you tell us about your concern before a consultation, any pre-screen answers, and, if you choose to record one instead of typing, a short voice note describing your concern
• • The consultation record: notes, prescriptions, and referrals your provider creates, including any lab test referral and the results you choose to upload. This becomes part of your medical passport, so a provider you see on a later visit can see relevant history from a previous one, not only the provider from that earlier visit
• • Consult chat messages, which may be automatically checked for safety and for compliance with our terms
• • Your phone number is verified by a one-time SMS code at sign-in, delivered through our SMS provider, Arkesel
• • If you sign in with your email address instead, we email a one-time code to it. These emails are sent through our email provider, Resend, on behalf of our sign-in service, Supabase
• • Women's Health: if you use the Women's Health portal, the cycle dates, symptoms, flow, mood, notes, pregnancy details and reminder settings you enter. This stays on your account and is not visible to providers, pharmacies or labs unless you choose to share a summary with a doctor
• • Live calls: during an audio or video consultation, your phone's microphone and camera carry the call to your provider in real time through our calling provider, LiveKit. We do not record calls
• • Photos and files you choose to add, such as a profile photo or a lab result you upload
• • Sign-in and security records: the devices signed in to your account (device type, IP address and last activity). If you report suspicious activity, we keep the report and the IP address and device details it was sent from, so we can secure your account
• • On your phone only: if you choose to add reminders to your phone's calendar, the app writes them to your calendar and does not upload your calendar. Face ID or fingerprint unlock is handled by your phone, and we never receive your face or fingerprint data
• • Payment metadata (amount, timestamp, method): full card or Mobile Money credentials are handled by our payment processor, Paystack, not stored by us
• • If you join through a doctor's invite link or code, a record of which doctor invited you, so the discount can be applied and the doctor can see how many people joined. To connect a link you opened to the app you install, we briefly keep a scrambled (hashed) form of your network address for 30 minutes and then delete it
• • If you join through a school or employer's partnership code, a record that your account redeemed it and when. See Institutional partnerships below for what that partner does and doesn't see
• • If you register for a SabiDoc webinar on our website: your name, email address, and phone number, used only to run that webinar, email you a confirmation, the join link and a reminder, and let the team follow up on the session. The doctor hosting it sees how many people registered, not who
• • If you sign up as an early tester, for example by scanning a QR code at one of our events: your name, email address, phone number, the type of phone you use (Android or iPhone) and anything you choose to tell us. We use it only to invite you to test the app and to tell you when it launches, and we delete it if you ask us to
• • A device push-notification token, so we can notify you about a consult update or an upcoming appointment; you can turn this off in your device settings at any time
• • Basic device and usage data needed to keep the service reliable and secure, including crash and error reports

Why we collect it

To match you with an appropriate, verified provider; to let that provider review your history and prepare for your visit; to generate a prescription any pharmacy can verify; to process payment; and to maintain your portable health record across visits, and to keep the service safe and reliable.

Who can see your data

The provider you're matched with sees your intake, pre-screen answers, and medical passport history relevant to your care, including any lab results you upload in response to their referral. This is what lets a doctor you see for the first time still have useful context from an earlier visit, even one with a different provider. A pharmacy you route a prescription to sees only that prescription. A lab partner you route a referral to sees only that referral. SabiDoc staff can access records only as needed to operate the platform (for example, reviewing a complaint, a flagged chat message, or a support ticket you filed) or where required by law. If you contact support or a ticket you filed is updated, your email address and the ticket contents are sent to our transactional email provider, Resend, solely to deliver that notification to you.

Automated processing of your data

Some of what you write, such as a description of your concern or a message to Ask Sabi (our in-app assistant) or the support team, is processed by automated software to draft a note for your provider, suggest how soon a doctor is needed, or answer a general question about how the app works or your account. That processing is performed by Groq Inc., a US-based provider acting as our sub-processor, which does not use your data to train its models. Nothing this software produces becomes part of your clinical record until a licensed provider has reviewed and approved it.

Cookies and analytics

We use a small number of cookies to keep you signed in and our own first-party analytics to understand how the service is used. We don't use third-party advertising trackers, and none of this includes your health data. You can control cookies through your browser settings. The Cookie policy lists each one.

Institutional partnerships

If your school or employer has a partnership with SabiDoc, redeeming their code only records, on our side, that your account is eligible for the associated benefit and for how long. The institution does not receive your health information, your consultation history, or anything a provider wrote about you. At most, and only under the terms of our agreement with them, they may see how many people from their organization are using the benefit in aggregate, never which individual accessed what care.

Where your data is processed

Our infrastructure providers may process data outside Ghana, including in the United States and the European Union (our database is hosted in the EU). These include Supabase (database and authentication), Vercel (web hosting), Paystack (payments), Arkesel (SMS verification codes), Resend (email), Groq (described above), LiveKit (audio and video calls), Cloudflare (bot protection on our website forms and sign-in), Expo (delivering push notifications to your device), and Sentry (technical crash and error reports, used to fix bugs, not your consultation content). Each is bound by its own data protection obligations to us as a condition of processing your data.

How we protect your data

Your data is encrypted in transit, and sensitive health information is also encrypted at rest. Access to records is restricted by role. No system is perfectly secure, but we take reasonable technical and organisational measures to protect your data.

Your rights

Under Act 843 you can ask to access, correct, or request deletion of your personal data, and object to specific processing. You can request deletion yourself at any time from Settings in the app, or on the web at sabidoc.com/delete-account, without needing to contact us first. Because Ghanaian medical record-keeping practice, and the possibility of a future dispute, can require that a clinical record survive the account that created it, deleting your account removes your name, phone number, and other identifying details rather than the underlying clinical record itself, which is retained in de-identified form. A member of our team reviews each request before it's completed, and you can cancel a pending request yourself at any point before then. For anything this self-service flow doesn't cover, contact us using the details below.

Children and family members

SabiDoc accounts are for adults. A parent, guardian or carer can add family members, including children, to their own account to manage their care. We collect a family member's information from the account holder, not from the family member, and we record that the account holder confirmed they are allowed to manage that person's care. Information about a child, and information about a person's health, is special personal data under Ghana's Data Protection Act, so we use it only to provide care, with the account holder's consent. The account holder is responsible for the accuracy of what they enter.

Retention

Different kinds of data are kept for different, deliberately limited periods: a voice note describing your concern is deleted within 7 days of the consultation it was for; webinar registrations are deleted 90 days after the webinar; product analytics events are kept for up to 13 months; messages sent through our contact form are kept for up to 24 months; job applications (the details and CV you submit on our Careers page) are used only to consider you for the role and to contact you about it, and we delete them if you ask. Your clinical and account records are kept while your account is active, so your record stays portable across visits and providers, and are anonymized (not simply left in place) once a deletion request you make is completed, as described above. Sign-in session records last only while a session is active. Reports of suspicious activity are kept for as long as needed to investigate and protect the account. Records we are required to keep for legal accountability, such as accepted terms, are kept as the law requires.

If something goes wrong

If a data breach is likely to put your rights at risk, we'll notify the Data Protection Commission and affected users without undue delay, as required under Act 843.

Contact

Questions about this policy or your data can be sent to privacy@sabidoc.com.