TabeebX Privacy Policy

Last updated: 11 October 2026

TabeebX is a healthcare app operated by Baru for Medical and Therapeutic Services, Human Resources Development, Exhibitions and Conferences LLC ("Baru Medical", "we"), Baghdad, Iraq, registered with the Registrar of Companies at the Ministry of Trade under certificate M.Sh/15764 of 19 December 2021.

This policy explains what we collect about you, why, who can see it, where it is kept and for how long, and what you can do about it. It applies to the TabeebX app and to the panels doctors and laboratories use. It is written to be read, not signed.

1. What we collect

Your account

• Your mobile number — required, because it is how you sign in; we send a one-time code to it.
• Your name, date of birth, sex and the language you use the app in.
• Family members you add to your account — their name, relationship to you, date of birth and sex — so you can book care for them.

Addresses and location

• The addresses you save for home visits and home sample collection.
• Your phone's location is optional. It is asked for only when you press "use my current location" on the address form, to pin that address. The app never tracks you in the background.

Your health information

• The services you book, and your appointments.
• What the doctor, nurse or therapist writes after a visit: clinical notes, prescriptions, requests for tests and investigations.
• The laboratory analyses you choose, and the result files a laboratory uploads for you.
• A diagnosis, where one is attached to an insurance claim.
• The reviews you write about your visits.
• Calls: when you start or answer a call with your doctor, the microphone — and the camera, if you choose video — is used for the call only. We record neither sound nor picture; we keep that the call took place, its kind and its time.

Payments and cover

• Invoices, payments and refunds.
• Your insurance policy if you have one, or your membership of an employer's package if you are on one.
• When you pay by card you enter the card details on Qi Card's own payment page. We never see or keep your card number; we receive only whether the payment succeeded and its reference.

If you are a doctor or a laboratory

• Your licence number, the licence or syndicate document you upload, the addresses and hours of your clinics or branches, your fees or prices, and what you are owed.
• Patients see your name, specialty, photo, the location of your clinic or laboratory, and your rating.

Technical information

• Crash reports when the app stops (the error, the screen, the phone's system and the app's version) and a few usage events (the app opened, a sign-in or a booking started or completed) so we can tell what is not working. They contain no medical details.
• A notification token, if you allow notifications (section 4).
• A record of your consents: which version of this policy and of the terms and conditions you accepted, and when.

What we do not collect

We do not record calls, do not read your contacts, do not track your location in the background, use no advertising identifiers, embed no advertising or marketing trackers, and do not sell your data to anyone.

2. Why we use it

• To provide the care you book: to schedule it, send the right clinician or laboratory to the right address, and keep the record of what was done — because you asked for the service.
• To call or message you about a booking: to confirm, change or redirect it.
• To invoice, take payment and refund — an accounting obligation.
• To keep the medical record — a professional and legal obligation of whoever treats you.
• To apply your insurance or your employer's package — at your request.
• To keep the service safe and working: preventing misuse, investigating faults, and the audit log described in section 3.

We do not use your information for advertising, and we make no automated decisions about your care.

3. Who can see it

• The clinician or laboratory caring for you — what they need for that visit or that analysis. Whoever is sent to your home sees your name and the address of that visit, not your medical record.
• TabeebX's operations team — by role, not everyone. Every time a member of staff opens a patient's file, their name and the time are written to an audit log that cannot be edited.
• Your insurer — only if a claim is made for your visit, and only what the claim concerns.
• Your employer, if you are on a company package — sees how many people used the package and what it cost. It does not see who was treated or for what, which clinician, which diagnosis, or when. That is enforced by the database itself, not only promised here.
• Other users — if you write a review and it is published, it appears on the clinician's page with your first name only.
• The service providers listed below, each only for the part they carry out for us.
• Authorities — only when Iraqi law obliges us to, and only what it obliges.

We do not sell, rent or trade your information.

Service providers

• OTPIQ delivers your sign-in codes by WhatsApp or text message (your number and the code).
• Qi Card processes card payments on its own page (the amount and the payment reference; your card details go to Qi Card, not to us).
• Google (Firebase) and Apple carry notifications to your phone (section 4).
• WhatsApp: if you finish a consultation on WhatsApp instead of the app's call, it is between your account and the doctor's, under WhatsApp's own terms and privacy policy. We do not record it.
• Google Fonts: the app downloads its typefaces from Google the first time it opens, as a web page does, so Google receives your phone's internet address with that request.
• Contabo rents us the server your information is kept on (section 5).

4. Notifications

If you allow notifications, we keep an identifier for the app on your phone so we can send your notifications to it, and delete it when you sign out or delete your account. What appears on your lock screen is a short title such as "Booking confirmed" and a fixed line — never the service, the time or anything medical; the details stay inside the app, behind your sign-in. General announcements from TabeebX may show their text.

5. Where it is kept and how it is protected

Your information is kept in Germany, on a server dedicated to TabeebX that we rent from Contabo GmbH, with a nightly backup on the same server kept for fourteen days. Your information is therefore stored outside Iraq.

• Every connection to the server is encrypted (HTTPS), and calls pass only through our own server, encrypted on the way, and are not recorded.
• Who can read which record is decided by rules inside the database itself, not by the app. The app holds no key — only a sign-in token of your own.
• Laboratory result files are kept privately and open only through a link that works for five minutes.
• Staff access is by role, and every opening of a patient's file is recorded.

6. How long we keep it

• The medical record — kept. A medical record is not the patient's alone to erase from those who wrote it, and the doctor who prescribed remains accountable for having prescribed.
• Invoices and payments — kept as accounting records.
• Identifying details — removed when you delete your account (section 7), so nothing that is kept can be linked back to your name.
• Your addresses, notifications and notification tokens — deleted when you delete your account.
• Crash reports and usage events — kept to find and fix faults; they contain no medical details.
• The record of your consents — kept, as evidence of what you agreed to and when.

7. Your rights

• Access — your medical record and your results are in the app, under "My medical record". You may also ask us for a copy of what we keep about you.
• Correction — edit your details under "Account", or write to us.
• Deleting your account — in the app: Account → Delete my account, or through baru-healthservices.com/tabeebx/delete-account. Your upcoming appointments are cancelled, your addresses deleted, your name and identifying details removed and your number released; what section 6 says is kept stays, no longer linked to you.
• Turning notifications off — in your phone's settings, at any time.
• Objections and complaints — write to us at the address below; we answer within thirty days.

8. Children

An account is for people aged 18 and over. A parent or guardian may add their children and other dependants to their own account and book care for them, and remains responsible for the information they give about them.

9. Changes to this policy

This policy has a version number and a date. When we change it we publish a new version here and ask you to read and accept it in the app before you continue. Earlier versions are kept, with the date each person accepted each version.

10. Contact

Baru for Medical and Therapeutic Services, Human Resources Development, Exhibitions and Conferences LLC

Baghdad, Iraq — Registrar of Companies, Ministry of Trade, certificate M.Sh/15764 of 19 December 2021

info@baru-healthservices.com