Privacy Policy

1. Information we collect

• Account & profile: name, email, mobile, username, role(s), and for professionals: qualifications, registration/licence numbers, specialty, and facility affiliations.
• Health information: records you or your treating professionals/facilities add — e.g. demographics, allergies, conditions, prescriptions, lab and imaging results, appointments, and admission/billing data.
• Usage & device: log data, device/browser type, and actions taken, used to operate and secure the service.
• Communications: messages and requests you send us.

2. How we use your information

• to provide the platform — discovery, bookings, records, billing, and operations;
• to connect you with the professionals and facilities you choose to engage;
• to secure the service, prevent fraud/abuse, and maintain audit trails;
• to communicate service information and respond to your requests;
• to improve the platform; and
• to comply with legal and regulatory obligations.

3. Legal bases

Where data-protection laws such as the GDPR apply, we rely on: your consent; performance of a contract with you; our legitimate interests in running a safe, reliable platform; compliance with a legal obligation; and, for emergencies, protection of vital interests. Health data is processed for the provision of care and with appropriate safeguards and, where required, your explicit consent.

4. How we share information

• With providers you engage: the professionals and facilities you book or register with can access the records needed to care for you.
• Service providers (processors): vetted infrastructure and tooling vendors acting on our instructions under confidentiality obligations.
• Legal: where required by law or to protect users, the public, or our rights.
• We do not sell your personal or health data, and we do not use it for third-party advertising.

5. Data retention

Healthcare data is never silently hard-deleted; it is archived and retained as required by applicable medical-records law (generally up to 7 years, or longer where the law requires). Non-health account data is kept while your account is active and for a reasonable period afterwards, then deleted or anonymised.

6. How we protect your data

• encryption of sensitive data in transit and at rest;
• optional two-factor authentication (2FA) on accounts;
• tenant isolation so each facility's data is segregated;
• role-based access controls and audit logging of access to records;
• the principle of least privilege across our systems.

7. Your rights & choices

Subject to applicable law, you can request to access, export (data portability), correct, restrict, or delete your data, object to certain processing, and withdraw consent. You can manage much of this yourself in Settings → Privacy & data (which includes data export), or email support@biomedixai.com and we will respond within the time required by applicable law. Note that legally-mandated medical-records retention may limit deletion of certain clinical data.

8. International transfers

BioMedixAI serves Bangladesh and other countries. Where data is transferred across borders, we apply appropriate safeguards consistent with applicable data-protection law.

9. Cookies & similar technologies

We use only the cookies/local storage needed to sign you in, remember your preferences, and keep the service secure. We do not use third-party advertising or cross-site tracking cookies.

10. Children

BioMedixAI is not intended for self-registration by anyone under 18. Records for minors are created and managed by a parent, guardian, or a treating facility on their behalf.

11. Changes to this Policy

We may update this Policy. We will revise the “Last updated” date above and, for material changes, provide additional notice.

12. Contact us

For privacy questions or to exercise your rights, contact LifeLink Innovation at support@biomedixai.com. See also our Terms of Service.