Doctera (“we”, “us”) operates the Doctera platform for booking doctors and for doctors to run consultations. This policy explains what personal data we handle, why, and the choices you have. We are based in Beirut, Lebanon.
1. What we collect
Account data: name, email, phone/WhatsApp, password (stored hashed), and your role (patient, doctor, staff).
Health data: appointments, clinical notes, prescriptions, lab orders, vaccines, documents and any information a doctor records or you provide. This is sensitive data and we treat it with extra care.
Usage data: basic logs needed to keep the service secure and working (e.g. sign-in events, IP address for rate-limiting).
2. Why we use it (lawful basis)
To provide the service you asked for (booking, reminders, consultations, records) on the basis of our agreement with you.
To process health data, on the basis of your explicit consent and for the provision of care. You can withdraw consent at any time.
To keep the platform safe and meet legal obligations (security, fraud prevention, record-keeping).
We do not use your data for advertising, and we never sell it.
3. Who can see your data
The doctor(s) you choose. A patient grants a specific doctor access to their records and can revoke it at any time. A doctor only ever sees their own patients.
Service providers we rely on, only to deliver the service. Those that may receive personal data are listed below, with the country each company is based in. We do not use your medical data to train AI models.
Render (USA): runs the Doctera application, on servers in Frankfurt, Germany.
Neon (USA): hosts our database, on servers in Frankfurt, Germany.
Cloudflare (USA): delivers and protects the doctera.app website, stores uploaded files (R2), counts visits without cookies (page views and page speed, no personal data) and receives email sent to our addresses.
Anthropic (USA): the AI service that drafts notes and suggestions for doctors from what the doctor has recorded.
Deepgram (USA): turns consultation audio into text when a doctor uses dictation. We have opted out of Deepgram using this audio to improve its models.
Brevo (France): sends our emails, such as reminders and account emails. If Brevo is not set up, Resend (USA) sends them instead.
WhatsApp (Meta) (USA): delivers WhatsApp messages if you agree to receive them, under its own terms.
Google (USA): only if you choose to sign in with your Google account, to confirm who you are.
Jitsi Meet (8x8) (USA): carries video consultations, when a doctor offers them.
Sentry (USA): receives technical error reports, when we switch error monitoring on.
OpenStreetMap (United Kingdom): your browser loads maps directly from OpenStreetMap, which therefore sees your IP address.
QR Server (goQR.me) (Germany): makes the QR code on a doctor's printable profile cover; it receives the doctor's public profile address.
We disclose data to authorities only where strictly required by law.
4. AI features
When a doctor uses Doctera’s dictation, Deepgram turns the consultation audio into text, and a recording is kept with the visit in the doctor’s record. When the doctor uses the AI tools, what that doctor has recorded about you (such as notes, measurements and the transcript) is sent to Anthropic to draft text for the doctor, who reviews everything before it is saved. Records kept by other doctors are used only if you have given this doctor access to your full history.
5. Keeping it safe
We encrypt data in transit (TLS), our database and file-storage providers store it encrypted, and we isolate each account, log changes to medical records and rate-limit abuse. See our Security & privacy page for details.
6. How long we keep it
We keep your data for as long as your account is active and as needed to provide care and meet medical record-keeping requirements. If you ask us to close your account, we delete your account data; medical records your doctors keep about you may have to be kept for the period the law requires.
7. Your rights
You can ask to see, correct, get a copy of or delete your data, and withdraw consent at any time. From your account you can update your profile and withdraw a doctor’s access to your full history; for anything else, contact us (section 12) and we handle the request by hand. We respond within a reasonable time.
8. Cookies
We use only essential cookies, to keep you signed in and the site secure. We do not use tracking or advertising cookies. Google Analytics runs only if we switch it on in the site's build settings, and it is off today. Maps, and the positions of doctors on the search map, are loaded by your browser directly from OpenStreetMap, so OpenStreetMap sees your IP address.
9. Children
Accounts are for adults. A parent or guardian may manage bookings and records for a child as a family member (beneficiary) on their own account.
10. International transfers
Most of the providers listed in section 3 are companies based outside Lebanon, mainly in the United States. Our application and database run on servers in Frankfurt, Germany, and the AI and speech-to-text services are run by US companies, so your data is transferred to and processed in those countries.
11. Lebanese data-protection law (Law No. 81/2018)
Doctera processes personal data in line with Lebanon’s Law No. 81 of 10 October 2018 on Electronic Transactions and Personal Data (Part V — Personal Data Protection). In particular:
We collect data fairly, for specified and legitimate purposes, keep it accurate, and retain it no longer than needed (Arts. 87 & 90).
Health data is processed to provide care and on your explicit consent, as permitted by Art. 91, and only by, or for, the treating healthcare professional.
You may access, correct, complete, update and delete your data, and object to processing (Arts. 92 & 99–101); we act on such requests free of charge and within the legal time-limits.
We apply technical and organisational measures to keep your data secure and confidential (Art. 93).
Where the law requires it, the processing is declared to or authorised by the competent authority (the Ministry of Economy and Trade, or the Ministry of Public Health for health data); you may also lodge a complaint with it.
12. Contact
For any privacy request or question, contact us. If you believe we have not handled your data properly, you may also contact the competent authority.
We may update this document; material changes are announced in the app. Questions? Contact us.