Privacy Policy Agreement
Last updated: July 29, 2026
1. Introduction
This Privacy Policy Agreement is a legally binding document between you ("User") and ZoctorAi. By accessing or using our services, you explicitly agree to the terms of this Agreement without any recourse or claim against the Company.
The Company is committed to protecting your privacy and ensuring the security of the data you share with us. This Agreement outlines the types of data we collect, how it is used, and your responsibilities as a User.
2. Data Collection
We collect and process personal data provided by the User. This includes, but is not limited to:
2.1 Personal Identification Information
- Full name, contact details (email, phone number, address).
- Demographic information such as age, gender, and nationality.
2.2 Health and Medical Data
- Medical records, prescriptions, and appointment history.
- Health conditions, treatment preferences, and diagnostic reports.
2.3 Payment Information
- Credit/debit card details, billing address, and transaction history.
2.4 Behavioral Data
- Interaction logs, browsing patterns, and service preferences.
2.5 Device and Location Data
- IP address, device information, and geolocation data (where applicable).
3. Purpose of Data Usage
We use the collected data for the following purposes:
3.1 Service Delivery
- To provide personalized and efficient services.
- To schedule and manage appointments and consultations.
3.2 User Experience Enhancement
- To analyze usage patterns and improve service quality.
- To offer tailored recommendations and insights.
3.3 Regulatory Compliance
- To adhere to legal and regulatory requirements specific to healthcare and data protection.
3.4 Business Development
- To conduct research, generate reports, and develop new offerings.
4. Legal Basis for Processing
We process personal data in compliance with applicable laws, including but not limited to:
4.1 General Data Protection Regulation (GDPR)
Applicable to Users in the European Union. Ensures data processing is lawful, transparent, and for legitimate purposes.
4.2 Health Insurance Portability and Accountability Act (HIPAA)
Governs the handling of health information for Users in the United States.
4.3 Personal Information Protection and Electronic Documents Act (PIPEDA)
Governs the handling of personal data for Users in Canada. Ensures data is collected, used, and disclosed responsibly and transparently.
4.4 DIFC Data Protection Law (Dubai, UAE)
Ensures compliance with the Dubai International Financial Centre data privacy framework, including principles of accountability, transparency, and lawful processing.
4.5 Saudi Arabia's Personal Data Protection Law (PDPL)
Applies to the collection, processing, and storage of personal data for Users in Saudi Arabia. Ensures the safeguarding of personal data in alignment with local cultural and legal expectations.
4.6 Other Local Jurisdictional Laws
Compliance with relevant laws based on the User's location.
5. Data Sharing and Disclosure
The User consents to their data being shared under the following circumstances:
5.1 With Affiliated Entities
Sharing data with subsidiaries, affiliates, and trusted partners for service delivery.
5.2 Third-Party Providers
Authorized sharing with service providers for payment processing, analytics, or other operational needs.
5.2.1 Optional Public-Site Analytics
On public marketing pages, ZoctorAI may use Google Analytics and Google Ads measurement only after the User grants the relevant optional consent. These services receive restricted page and interaction events without report text, uploaded filenames, chat content, biomarker values, diagnosis information, account or profile identifiers, contact-form values, or private health-workflow URLs. Analytics and advertising tags remain disabled on authenticated report, profile, upload, chat, and medical-tourism intake pages.
The User can accept, reject, or revise optional analytics choices through the public-site privacy controls. Advertising personalization remains disabled. Browser Global Privacy Control or Do Not Track signals disable optional analytics and advertising in the ZoctorAI public-site integration.
5.3 Legal Obligations
Disclosure to comply with court orders, law enforcement, or regulatory requirements.
Indemnification: The Company is not responsible for misuse of data by third parties. The User waives all rights to seek recourse against the Company for such instances.
6. Data Security
The Company implements robust security measures, including:
- End-to-end encryption for data transmission.
- Access control mechanisms to restrict unauthorized data access.
- Regular security audits and vulnerability assessments.
Despite these measures, no system is entirely secure, and the Company is not liable for breaches caused by cyberattacks or unauthorized access.
7. Data Retention
We retain User data:
- For the duration required to fulfill the purposes outlined in this Agreement.
- To comply with legal obligations and for archival purposes.
- Anonymized data may be retained indefinitely for analytics and research.
8. User Obligations
The User is responsible for:
- Providing accurate and truthful information.
- Updating their personal data to reflect changes.
- Ensuring that their use of our services complies with this Agreement and applicable laws.
Failure to meet these obligations may result in service termination without notice or liability.
9. Limitation of Liability
The Company disclaims liability for:
- Direct, indirect, or consequential damages resulting from service use.
- Losses due to third-party actions or external data breaches.
- Interruptions or errors in service delivery beyond the Company's reasonable control.
10. Modifications to the Agreement
The Company reserves the right to:
- Amend this Agreement at its sole discretion.
- Notify Users of significant changes through the website or other communication channels.
Continued use of services constitutes acceptance of updated terms.
11. Governing Law and Jurisdiction
This Agreement is governed by the laws and jurisdiction identified in the applicable ZoctorAI terms presented to the User. Mandatory rights under applicable data-protection law are not limited by this section.
12. Entire Agreement
This Agreement constitutes the entire understanding between the User and the Company regarding privacy practices. It supersedes all prior agreements and communications.