ShebaMitro Patient Privacy & Data Protection Policy

1. Information We Collect

We collect information necessary to deliver quality digital healthcare services and verify identities.

• Personal Identifier Data: Name, mobile phone number, email address, national ID (NID) for doctors.
• Protected Health Information (PHI): Medical history, vitals, lab reports, prescribed medications, diagnostic biomarker records.
• Technical Data: IP address, device telemetry, browser type, and geolocation for security audits.

2. Cryptographic Security & Encryption Standards

ShebaMitro employs bank-grade 256-bit SSL/TLS encryption in transit and AES-256 encryption at rest for all stored patient medical files and prescriptions.

• Prescriptions are hashed using SHA-256 for public verification without exposing full patient identities.
• Public verification endpoints display HIPAA-masked patient initials (e.g. T. A.***).

3. How We Use Your Information

Your data is used strictly for medical consultation, order fulfillment, diagnostic lab reporting, and system security monitoring. We never sell or rent patient health data to third-party advertisers.

4. Information Sharing with Authorized Partners

We share necessary data only with authorized healthcare ecosystem providers required to complete your requested service:

• Assigned BMDC doctors during active video consultations.
• Licensed phlebotomists & lab technicians for sample collection.
• Model pharmacies for medicine delivery verification.
• MFS Payment gateways (bKash/Nagad) for transaction processing.

5. Patient Control & Data Rights

Patients retain full ownership of their medical records. You have the right to access, download PDF copies, or request account deletion at any time through your dashboard.

6. Updates to Privacy Policy

We may update this policy periodically to comply with new Bangladesh DGHS health regulations or data protection directives. Material updates will be notified via SMS and email.