Privacy policy

Health data is sensitive personal data

Under Act 843, information about your health is a special category of personal data. We treat it accordingly: it is collected only for the purpose of providing care, accessed only by the people described in Who can see your data below, and is never sold or used for advertising.

What we collect

• • Account details: name, phone number, and (for providers/pharmacies/labs) license or registration information
• • For providers specifically: a photo of your current MDC license renewal certificate, used to automatically verify your credentials against the Medical and Dental Council's own registry
• • What you tell us about your concern before a consultation, any pre-screen answers, and, if you choose to record one instead of typing, a short voice note describing your concern
• • The consultation record: notes, prescriptions, and referrals your provider creates, including any lab test referral and the results you choose to upload. This becomes part of your medical passport, so a provider you see on a later visit can see relevant history from a previous one, not only the provider from that earlier visit
• • Consult chat messages: monitored for platform-safety purposes, including attempts to share contact details to move a paid consultation off SabiDoc; messages that appear to do this are blocked and a record of the attempt is kept
• • Your phone number is verified by a one-time SMS code at sign-in, sent via our payment processor Hubtel's SMS gateway
• • Payment metadata (amount, timestamp, method): full card or Mobile Money credentials are handled by our payment processor, Hubtel, not stored by us
• • If you subscribe to SabiDoc Plus or Family, your subscription status and billing history (start date, renewal date, and whether a payment succeeded or failed), not stored any differently from a one-off consultation payment
• • If you join through a school or employer's partnership code, a record that your account redeemed it and when. See Institutional partnerships below for what that partner does and doesn't see
• • A device push-notification token, so we can notify you about a consult update or an upcoming appointment; you can turn this off in your device settings at any time
• • Basic device and usage data needed to keep the service reliable and secure, including crash and error reports

Why we collect it

To match you with an appropriate, verified provider; to let that provider review your history and prepare for your visit; to generate a prescription any pharmacy can verify; to process payment, including recurring Plus or Family billing if you choose to subscribe; and to maintain your portable health record across visits. Wellness tips shown in the app are the same generic content for every patient. We do not use your health record to personalize non-clinical content without a deliberate, separate decision to do so.

Who can see your data

The provider you're matched with sees your intake, pre-screen answers, and medical passport history relevant to your care, including any lab results you upload in response to their referral. This is what lets a doctor you see for the first time still have useful context from an earlier visit, even one with a different provider. A pharmacy you route a prescription to sees only that prescription. A lab partner you route a referral to sees only that referral. SabiDoc staff can access records only as needed to operate the platform (for example, reviewing a complaint, a flagged chat message, or a support ticket you filed) or where required by law; every such lookup of your most sensitive records is itself logged and reviewed. If you contact support or a ticket you filed is updated, your email address and the ticket contents are sent to our transactional email provider, Resend, solely to deliver that notification to you.

Automated processing of your data

Some of what you write, such as a description of your concern or a message to Ask Sabi (our in-app assistant) or the support team, is processed by automated software to draft a note for your provider, suggest how soon a doctor is needed, or answer a general question about how the app works or your account. That processing is performed by Groq Inc., a US-based AI infrastructure provider acting as our sub-processor. Groq does not use your data to train its own models, and nothing this software produces becomes part of your clinical record until a licensed provider has reviewed and approved it. Ask Sabi is told to answer only from what it actually knows about your account and about how SabiDoc works, and to say so rather than guess when it doesn't know something.

Cookies and analytics

We use a small number of cookies to keep you signed in and our own first-party analytics, built and stored on our own infrastructure, to understand which pages and campaigns lead people to sign up, so we can spend our limited marketing budget on what actually works. We don't run Google Analytics, Meta/Facebook Pixel, or any third-party advertising tracker on SabiDoc, and none of this includes your health data. You can control cookies through your browser settings.

Institutional partnerships

If your school or employer has a partnership with SabiDoc, redeeming their code only records, on our side, that your account is eligible for the associated benefit and for how long. The institution does not receive your health information, your consultation history, or anything a provider wrote about you. At most, and only under the terms of our agreement with them, they may see how many people from their organization are using the benefit in aggregate, never which individual accessed what care.

Where your data is processed

Our infrastructure providers may process data outside Ghana, including in the United States and the European Union (our database is hosted in the EU). These include Supabase (database and authentication), Vercel (web hosting), Hubtel (payments and SMS verification), Resend (email), Groq (described above), Expo (delivering push notifications to your device), and Sentry (technical crash and error reports, used to fix bugs, not your consultation content). Each is bound by its own data protection obligations to us as a condition of processing your data.

How we protect your data

Sensitive fields (including your stated concern, consult notes, chat messages, and medical passport entries) are encrypted at rest, not just in transit. Access to patient records is restricted by role, so a pharmacy sees only the prescription routed to it and a provider sees only patients they are actually matched with or have previously treated. We rate-limit and monitor the platform against abuse. No system is perfectly secure, but this is the standard we hold ourselves to.

Your rights

Under Act 843 you can ask to access, correct, or request deletion of your personal data, and object to specific processing. You can request deletion yourself at any time from Settings in the app, without needing to contact us first. Because Ghanaian medical record-keeping practice, and the possibility of a future dispute, can require that a clinical record survive the account that created it, deleting your account removes your name, phone number, and other identifying details rather than the underlying clinical record itself, which is retained in de-identified form. A member of our team reviews each request before it's completed, and you can cancel a pending request yourself at any point before then. For anything this self-service flow doesn't cover, contact us using the details below.

Children and dependents

A family plan lets one adult account holder add dependents, including minors, to manage their care. In that case, we collect a dependent's data from the adult account holder, not directly from the dependent, and the account holder is responsible for the accuracy of the information they provide on a dependent's behalf and for deciding when a dependent is old enough to use SabiDoc directly rather than through a managing account.

Retention

Different kinds of data are kept for different, deliberately limited periods: a voice note describing your concern is deleted within 7 days of the consultation it was for; product analytics events are kept for up to 13 months; messages sent through our contact form are kept for up to 24 months. Your clinical and account records are kept while your account is active, so your record stays portable across visits and providers, and are anonymized (not simply left in place) once a deletion request you make is completed, as described above. Records of who accessed a sensitive lookup, and of accepted or declined legal terms, are kept indefinitely and are not editable by anyone, including us, since their purpose is accountability.

If something goes wrong

If a data breach is likely to put your rights at risk, we'll notify the Data Protection Commission and affected users without undue delay, as required under Act 843.

Contact

Questions about this policy or your data can be sent to privacy@sabidoc.com.