Privacy Policy

1. Who we are

The DrOnline.io website and platform were created and are hosted and managed by Digital Commercial Brokerage and Trading Services (the "Platform Operator"), a company registered in the State of Qatar with its registered office at Al Jazeera Tower, Building 186, Street 836, Zone 61, West Bay, Doha, State of Qatar.

All personal and medical data collected through the platform is controlled and stored under the authority of Royal Link Healthcare Services (the "Data Controller"), the licensed healthcare provider under which the treating doctors operate. The Platform Operator provides and maintains the technology only, and processes personal data on behalf of, and under the instructions of, Royal Link Healthcare Services.

In this policy, "we", "us" and "our" refer to Royal Link Healthcare Services as the Data Controller and to Digital Commercial Brokerage and Trading Services as the Platform Operator acting on its behalf, as the context requires. "You" means the person whose personal data is processed — typically a patient, prospective patient, or visitor to the platform.

DrOnline.io is a technology platform; it is not itself a medical clinic and does not make medical decisions. The treating doctors, operating under Royal Link Healthcare Services, are responsible for clinical decisions, prescriptions and the medical records they create.

2. Scope and lawful basis

This policy is written to comply with Qatar's Personal Data Privacy Protection Law (Law No. 13 of 2016, the "PDPPL") and supporting regulations. We rely on the following lawful bases:

• Explicit consent for sensitive personal data, including all health and medical information, photographs and identity documents.
• Performance of a contract with you, to provide the platform services and arrange medication delivery.
• Legal obligation, where retention or disclosure is required by Qatari law or by the regulator of Royal Link Healthcare Services.
• Legitimate interests, for limited purposes such as security, fraud prevention and service improvement, balanced against your rights.

3. Who can use the platform

The platform is for adults aged 18 and over. We do not knowingly collect information from anyone under 18. If you believe a minor has submitted information, contact us at privacy@dronline.io and we will delete it.

4. What we collect

• Identity and contact details — name, email, phone, date of birth, gender, delivery address, and (where the clinic requires identity verification) Qatar ID or equivalent identity document.
• Medical history — questionnaire answers including conditions, medications, allergies, and lifestyle questions relevant to your consultation.
• Photographs — for refills, medication-box photos; for visual-assessment treatments, face or body photographs you choose to upload.
• Consultation interactions — messages, video-call session metadata (duration, participants), and any notes the doctor or clinic adds to your record.
• Payment information — processed by our payment provider; we do not store full card numbers.
• Technical data — IP address, device and browser information, session logs, used for security, fraud prevention and reliability monitoring.

5. How we use photographs

Photographs are used only for the following purposes:

• To allow the reviewing doctor to identify the medication or assess suitability for treatment.
• For weight-management consultations, to generate an AI "before and after" visualisation that you choose to view as part of the experience.

Original uploaded photographs are deleted from the platform once the reviewing doctor has completed their review. You do not have to ask — this is automatic. The AI-generated visualisation is retained with your consultation record and can be deleted on request.

Where AI generation is used, your photograph is sent securely to a third-party AI image provider through an approved AI gateway. The provider is contractually required not to use your image for model training and not to retain it beyond the single generation request.

6. Who we share data with

We do not sell or rent your data. We share only what is necessary, with:

• The treating doctor, operating under Royal Link Healthcare Services, who reviews your consultation. Royal Link Healthcare Services is the controller of the resulting clinical record.
• The licensed pharmacy partner dispensing your medication.
• The delivery partner — name, address and phone number only, for the purpose of completing delivery.
• The payment processor, for processing your payment.
• Cloud and infrastructure providers we use to host the platform.
• The AI image provider described above, for the single purpose of generating your visualisation.
• Qatari regulatory authorities, where we are legally required to disclose.

7. International transfers

Some of our service providers (including the AI image provider and parts of our cloud infrastructure) process data on servers outside Qatar. Where this happens we use providers that maintain internationally recognised security standards and are bound by data-processing terms requiring them to protect your data to a standard equivalent to the PDPPL.

8. How long we keep your data

See our separate Data Retention Policy for full retention schedules. In summary:

• Uploaded photographs — deleted automatically after doctor review.
• Medical consultation records — retained by the clinic for the period required by Qatar Ministry of Public Health guidance (typically 10 years from last activity for adult records).
• Account details — kept while your account is active; deleted on request, subject to records we are legally required to retain.
• Payment records — retained for the period required by Qatari tax law.

9. How we protect your data

See our separate Security Policy for the controls in place. Highlights:

• TLS encryption in transit and encryption at rest in our database.
• Private, access-controlled storage for photographs and identity documents.
• Role-based access; only staff and clinicians who need your data can see it.
• Multi-factor authentication for administrative and clinical accounts.
• Logging of access to medical records.

10. Your rights

Under the PDPPL you have the right to:

• Access the personal data we hold about you.
• Correct inaccurate or incomplete data.
• Request deletion, subject to regulatory retention requirements.
• Withdraw consent for any processing based on consent.
• Receive a copy of your data in a portable format.
• Complain to Qatar's Compliance and Data Protection Department if you believe your rights have been breached.

To exercise any right, email privacy@dronline.io. We aim to respond within 30 days. Requests that relate to the clinical record itself may be referred to Royal Link Healthcare Services, since it is the controller of that record.

11. Cookies and local storage

See our separate Cookie Policy. We use a small number of strictly-necessary cookies and browser local storage (for example, to keep you logged in or to save a partially-completed consultation). We do not use third-party advertising or cross-site tracking cookies.

12. Changes to this policy

If we make material changes we will notify active users by email and update the "Last updated" date at the top of this page. Minor clarifications may be made without notice.

13. Contact

Data Controller: Royal Link Healthcare Services
Platform Operator (host & technology): Digital Commercial Brokerage and Trading Services

Digital Commercial Brokerage and Trading Services
Al Jazeera Tower
Building 186, Street 836, Zone 61
West Bay, Doha
State of Qatar

Privacy team: privacy@dronline.io
General support: support@dronline.io