Privacy Policy

1. Who we are

The DrOnline.io website and platform were created and are hosted and managed by Digital Platform Commercial Brokerage and Trading and Services (the "Platform Operator"), a company registered in the State of Qatar with its registered office at Al Jazeera Tower, Building 186, Street 836, Zone 61, West Bay, Doha, State of Qatar.

Responsibility for your data is split between two parties. The Platform Operator controls your account, order, delivery and payment data. The licensed partner clinic that reviews your consultation controls your clinical record — the medical history you submit, the doctor's assessment, and any prescription issued. The Platform Operator holds that clinical record only on the clinic's behalf and processes it on the clinic's instructions; it does not read it for its own purposes and makes no clinical decision based on it. Both categories are stored on servers located in the State of Qatar.

In this policy, "we", "us" and "our" refer to Digital Platform Commercial Brokerage and Trading and Services as the Platform Operator, and to the licensed partner clinic as the controller of the clinical record, as the context requires. "You" means the person whose personal data is processed — typically a patient, prospective patient, or visitor to the platform.

DrOnline.io is a technology platform; it is not itself a medical clinic and does not make medical decisions. The treating doctors, operating under the licensed partner clinic, are responsible for clinical decisions, prescriptions and the medical records they create.

2. Scope and lawful basis

This policy is written to comply with Qatar's Personal Data Privacy Protection Law (Law No. 13 of 2016, the "PDPPL") and supporting regulations. We rely on the following lawful bases:

• Explicit consent for sensitive personal data, including all health and medical information, photographs and identity documents.
• Performance of a contract with you, to provide the platform services and arrange medication delivery.
• Legal obligation, where retention or disclosure is required by Qatari law or by the healthcare regulator that licenses the licensed partner clinic.
• Legitimate interests, for limited purposes such as security, fraud prevention and service improvement, balanced against your rights.

3. Who can use the platform

The platform is for adults aged 18 and over. We do not knowingly collect information from anyone under 18. If you believe a minor has submitted information, contact us at privacy@dronline.io and we will delete it.

4. What we collect

• Identity and contact details — name, email, phone, date of birth, gender, delivery address, and (where the clinic requires identity verification) Qatar ID or equivalent identity document.
• Medical history — questionnaire answers including conditions, medications, allergies, and lifestyle questions relevant to your consultation.
• Photographs — for refills, medication-box photos; for visual-assessment treatments, face or body photographs you choose to upload.
• Consultation interactions — messages, video-call session metadata (duration, participants), and any notes the doctor or clinic adds to your record.
• Payment information — processed by our payment provider; we do not store full card numbers.
• Technical data — IP address, device and browser information, session logs, used for security, fraud prevention and reliability monitoring.

5. How we use photographs

Photographs are used only for the following purposes:

• To allow the reviewing doctor to identify the medication or assess suitability for treatment.
• For weight-management consultations, to generate an AI "before and after" visualisation that you choose to view as part of the experience.

Original uploaded photographs are deleted from the platform once the reviewing doctor has completed their review. You do not have to ask — this is automatic. The AI-generated visualisation is retained with your consultation record and can be deleted on request.

Where AI generation is used, your photograph is sent securely to a third-party AI image provider through an approved AI gateway. The provider is contractually required not to use your image for model training and not to retain it beyond the single generation request.

6. Who we share data with

We do not sell or rent your data. We share only what is necessary, with:

• The treating doctor, operating under the licensed partner clinic, who reviews your consultation. The licensed partner clinic is the controller of the resulting clinical record.
• The licensed pharmacy partner dispensing your medication.
• The delivery partner — name, address and phone number only, for the purpose of completing delivery.
• The payment processor, for processing your payment.
• Cloud and infrastructure providers we use to host the platform.
• The AI image provider described above, for the single purpose of generating your visualisation.
• Qatari regulatory authorities, where we are legally required to disclose.

7. International transfers

Your account, order and clinical records are stored on servers located in the State of Qatar, and are not hosted outside it. A limited set of supporting services does process data outside Qatar: automated analysis of the photographs and documents you upload, transactional email, WhatsApp notifications, delivery mapping, and video-call connectivity. Only the data each of those needs is sent, never your full record. Every such provider maintains internationally recognised security standards and is bound by data-processing terms requiring protection equivalent to the PDPPL.

8. How long we keep your data

See our separate Data Retention Policy for full retention schedules. In summary:

• Uploaded photographs — deleted automatically after doctor review.
• Medical consultation records — retained by the clinic for the period required by Qatar Ministry of Public Health guidance (typically 10 years from last activity for adult records).
• Account details — kept while your account is active; deleted on request, subject to records we are legally required to retain.
• Payment records — retained for the period required by Qatari tax law.

9. How we protect your data

See our separate Security Policy for the controls in place. Highlights:

• TLS encryption in transit and encryption at rest in our database.
• Private, access-controlled storage for photographs and identity documents.
• Role-based access; only staff and clinicians who need your data can see it.
• Multi-factor authentication for administrative and clinical accounts.
• Logging of access to medical records.

10. Your rights

Under the PDPPL you have the right to:

• Access the personal data we hold about you.
• Correct inaccurate or incomplete data.
• Request deletion, subject to regulatory retention requirements.
• Withdraw consent for any processing based on consent.
• Receive a copy of your data in a portable format.
• Complain to Qatar's Compliance and Data Protection Department if you believe your rights have been breached.

To exercise any right, email privacy@dronline.io. We aim to respond within 30 days. Requests that relate to the clinical record itself may be referred to the licensed partner clinic, since it is the controller of that record. We will route the request for you and tell you which clinic it went to.

11. Cookies and local storage

See our separate Cookie Policy. We use a small number of strictly-necessary cookies and browser local storage (for example, to keep you logged in or to save a partially-completed consultation). We do not use third-party advertising or cross-site tracking cookies.

12. Changes to this policy

If we make material changes we will notify active users by email and update the "Last updated" date at the top of this page. Minor clarifications may be made without notice.

13. Contact

Controller of the clinical record: the licensed partner clinic
Platform Operator (host & technology): Digital Platform Commercial Brokerage and Trading and Services

Digital Platform Commercial Brokerage and Trading and Services
Al Jazeera Tower
Building 186, Street 836, Zone 61
West Bay, Doha
State of Qatar

Privacy team: privacy@dronline.io
General support: support@dronline.io