Privacy Policy

This Privacy Policy explains how Doctorz (“Doctorz”, “we”, “us”) collects, uses, protects and shares your personal information when you use our website and apps. We follow the Personal Data Protection Ordinance 2025 and other applicable laws of Bangladesh.

1. Who we are

Doctorz is an online platform that connects patients with BMDC-registered doctors for chamber visits and video (telemedicine) consultations, and provides digital prescriptions and follow-ups.

• Operator: Doctorz (Sole proprietorship (Trade Licence holder))
• Registered address: Available on request
• Trade Licence: — · DBID: —
• Data-protection officer: Our data-protection contact

2. Information we collect

• Account details — your name, phone number, email and password.
• Patient profile — age/date of birth, gender, and the family members you add to your account.
• Health information — symptoms, consultation records, and the digital prescriptions your doctor issues to you. This is sensitive personal data and is treated with extra care.
• Booking & payment data — appointments, wallet balance, transactions and payout requests. Card and mobile-wallet details are handled by our licensed payment partners, not stored by us.
• Doctor information — for doctors: BMDC registration, qualifications, chambers, fees and profile content.
• Doctor identity photographs — for doctors only: photographs of the doctor’s face, taken during registration and compared against the photograph held on the BMDC register to confirm that the person registering is the doctor they claim to be. These are biometric data and are treated as sensitive personal data. They are never shown to patients, are stored on private storage that is not publicly reachable, and are used for identity verification and fraud prevention only. See Data Retention & Deletion for how long they are kept.
• Documents you upload — for doctors: certificates and registration documents. For patients: any medical report you choose to share with a doctor for a consultation.
• Technical data — device, browser and usage information, including cookies (see our Cookie Policy).

3. How we use your information

We use your data to create and secure your account, let you find and book doctors, run consultations, deliver and store your prescriptions, process payments and payouts, provide support, send service notices, prevent fraud and abuse, and meet our legal obligations.

4. Our role: custodian, not owner of your clinical record

For your medical and prescription records, the treating doctor is the controller of that clinical information. Doctorz acts as a custodian and processor: we securely store and transmit these records so you and your doctor can access them. Our staff access to clinical content is limited to what is necessary to run and support the service, and we do not use your health data for any secondary purpose such as advertising.

5. Consent and legal basis

We process your personal data on the basis of your explicit, informed and revocable consent, which you give when you register and book. You can withdraw consent at any time (see Your rights below); withdrawing consent may mean we can no longer provide certain services.

Doctors and identity photographs. A doctor gives separate, explicit consent to the capture of their identity photographs at the point of taking them. Because this check is what allows us to tell patients a doctor is verified, a doctor who withdraws that consent cannot continue to be listed and consult on Doctorz; the photographs are then deleted with the account.

6. When we share data

We share data only as needed to provide the service:

• With the doctor you book — so they can consult with you and issue a prescription.
• With our payment processor — when you pay online you are taken to a secure page operated by SSLCOMMERZ (SSL Wireless), a payment gateway licensed by Bangladesh Bank. We pass them only what is needed to take the payment: your name, phone number, email address, the amount and our own reference for the order. Your card number, PIN, OTP and mobile-wallet credentials are entered on their systems and never reach Doctorz. Their handling of that data is governed by their own privacy policy, available at sslcommerz.com.
• With service providers who help us operate — for example the providers that deliver our SMS and email notifications, and that carry video consultations. They act on our instructions and may only use the data to provide that service.
• When required by law — to regulators, courts or authorities where legally obliged.

We never sell your personal or health data.

7. Messages we send you, and how to stop them

We send appointment confirmations, reminders, payment receipts and service notices. You control which channels we use, from Notification settings in your account:

• SMS, WhatsApp, Email and Push can each be switched off at any time. They are on by default so you do not miss an appointment.
• In-app notifications cannot be switched off. Every notice is written to your notification centre inside Doctorz regardless of the settings above, so there is always one place to find it.
• Security messages are always sent — login codes and verification codes ignore these settings, because they are what protects your account.

We do not sell your contact details, and we do not use them for third-party advertising.

8. Where your data is stored

Your data is hosted in Bangladesh (BDIX VPS). We keep at least one real-time copy within Bangladesh in line with the data-residency rule of the Personal Data Protection Ordinance 2025.

9. How long we keep it

Prescriptions you remove go to a trash window first — 30 days for patients and 60 days for doctors — after which they are permanently deleted (a patient always keeps their own copy even if the doctor removes theirs). We otherwise retain account and transaction records for up to 5 years. Doctor identity photographs are kept for as long as the doctor’s account exists, because they are the record of that verification, and are deleted when the account is deleted. Full details are on the Data Retention & Deletion page.

10. Your rights

Under the Personal Data Protection Ordinance 2025 you can:

• access the personal data we hold about you;
• correct inaccurate data;
• request erasure of your data;
• withdraw consent or object to certain processing.

To exercise any of these, please contact our data-protection officer. We aim to respond promptly and within the time limits set by law.

11. Security

We use technical and organisational measures — encryption in transit, access controls and audit logging — to protect your data. No system is perfectly secure, but we work to keep your information safe and to limit who can see it.

12. Children and minors

Patients under 18 may use Doctorz only under the supervision and consent of a parent or guardian, who is responsible for the account and the minor’s data.

13. Data breaches

If a breach affects your personal data, we will act to contain it and notify affected users and the relevant authority where the law requires.

14. Changes to this policy

We may update this policy from time to time. The current version is always shown here, and material changes will be highlighted.