Privacy Policy

Last updated: August 9, 2026

BisaDoc ("we", "us", or "our") is a digital health platform based in Ghana that helps patients find doctors, check symptoms, book appointments, manage medical records, and consult with healthcare professionals via video call. We take your privacy — especially your health data — seriously.

This Privacy Policy explains what personal data we collect, why we collect it, how we use and protect it, and your rights over it. It applies to all users of bisadoc.com and the BisaDoc mobile application.

By using BisaDoc, you agree to the collection and use of your data as described in this policy. If you do not agree, please do not use the platform.

1. Who We Are

BisaDoc is operated by Asare Berchie Brothers, based in Accra, Ghana. We are the data controller responsible for your personal data processed through this platform.

For privacy-related questions or requests, contact us at: privacy@bisadoc.com

2. What Data We Collect

2.1 Account & Profile Data

Full name, email address, phone number
Password (stored securely as a hash — never in plain text)
Account role (patient, doctor, hospital administrator)
Date of account creation

2.2 Appointment Data

Appointment date, time, and specialist type
The specific doctor and hospital selected
Appointment status and notes provided at booking
Payment method chosen (Pay Now or Pay at Clinic)
Paystack payment reference number (we do not store card details)

2.3 Medical Records (Patient-Entered)

Patients may voluntarily enter and maintain their own medical profile, including:

Blood type, date of birth, sex, height, weight
Allergies, chronic conditions, past surgeries
Current medications (name, dosage, frequency)
Family medical history and personal health notes
Emergency contact information

This data is entirely patient-controlled. You choose what to enter, can edit it at any time, and can delete it.

2.4 Uploaded Medical Files

Files you upload: lab results, scans, prescriptions, discharge summaries
File metadata: name, type, size, upload date, optional description
Files are stored in a private, encrypted storage bucket and are never publicly accessible

2.5 AI Symptom Chat Sessions

Messages you send to the BisaDoc AI Health Navigator
The AI's responses and urgency assessments
These sessions are processed by Anthropic's Claude API (see Section 4)
Session data may be stored to improve service quality

2.6 Doctor Profile Data

Doctors registered on BisaDoc provide: full name, medical specialty, years of experience, consultation fee, hospital affiliation, availability schedule, and a profile photo. This information is displayed publicly on the BisaDoc platform.

2.7 Record Access Log

Every time a doctor accesses a patient's medical records, we log: which doctor accessed the records, which patient's records were accessed, which appointment authorised the access, and the date and time of access. Patients can request this log at any time.

2.8 Technical Data

IP address and browser/device type (standard web logs)
Cookies used for authentication sessions only
We do not use tracking cookies or advertising cookies

3. How We Use Your Data

Purpose	Legal Basis
Creating and managing your account	Contract performance
Booking and managing appointments	Contract performance
Processing payments via Paystack	Contract performance
Sending appointment confirmations via email and WhatsApp	Contract performance
Providing AI symptom assessment	Consent (you initiate the session)
Enabling video consultations with doctors	Contract performance
Storing and displaying your medical records to you	Consent + Vital interest
Sharing your records with your appointed doctor during a visit	Consent + Vital interest
Logging doctor access to your records	Legal obligation + Legitimate interest
Sending appointment reminders	Legitimate interest
Improving platform performance and reliability	Legitimate interest
Complying with legal obligations in Ghana	Legal obligation

4. Third-Party Services

BisaDoc uses the following third-party services to operate. Each service processes only the data necessary for its function.

Supabase

Database, authentication, and file storage

Data shared: All user data, medical records, and uploaded files

Location: EU (Ireland)

Anthropic (Claude API)

AI symptom assessment and health navigation

Data shared: Symptom chat messages you send to the AI

Location: United States

Daily.co

Video consultation calls between patients and doctors

Data shared: Video and audio streams during consultations

Location: United States

Paystack

Payment processing

Data shared: Payment reference, email, amount. Card details go directly to Paystack — we never see or store them.

Location: Nigeria / Ghana

Twilio

WhatsApp appointment notifications

Data shared: Your phone number and appointment details

Location: United States

Email (SMTP)

Appointment confirmation and notification emails

Data shared: Your email address and appointment details

Location: Varies by provider

Vercel

Web application hosting and deployment

Data shared: Standard request logs (IP, browser type)

Location: United States / Global CDN

We do not sell your data to any third party, ever. We do not use advertising networks or tracking services.

5. Doctor Access to Your Medical Records

BisaDoc is designed so that doctors can only access your medical records when you have an active appointment with them. Specifically:

A doctor can access your records only on the day of a confirmed appointment, during an active consultation, or within 24 hours after a completed appointment.
After that window closes, the doctor's access is automatically revoked at the database level.
Every access is permanently logged in our audit trail.
You can request a copy of the access log at any time by emailing privacy@bisadoc.com.
Doctors see: your structured medical profile, uploaded files, prescription history, and past appointment history across all BisaDoc visits.
Clinical diagnosis notes from previous doctors are not currently shared between doctors.

This model is aligned with the patient-controlled longitudinal record standard used by Poland's national eHealth system (IKP).

6. How Long We Keep Your Data

Account and profile dataUntil you delete your account, plus 30 days

Appointment records7 years (medical record retention standard)

Medical records and uploaded filesUntil you delete them, or until account deletion

Prescriptions7 years (legal and medical requirement)

Record access logs7 years (audit and legal compliance)

AI symptom chat sessions90 days, then anonymised or deleted

Payment references7 years (financial record requirement)

Technical logs (IP, browser)90 days

7. Your Rights

Under Ghana's Data Protection Act 2012 and in alignment with GDPR principles, you have the following rights:

Right to access: Request a copy of all personal data we hold about you.

Right to correction: Correct inaccurate or incomplete data. You can edit most of this directly in your dashboard.

Right to deletion: Request deletion of your account and personal data. Medical records required by law (prescriptions, access logs) may be retained for the legally required period.

Right to data portability: Request your data in a machine-readable format (JSON or CSV).

Right to restrict processing: Ask us to stop processing your data in certain circumstances.

Right to object: Object to processing based on legitimate interest.

Right to withdraw consent: Withdraw consent for optional processing (e.g. AI symptom sessions) at any time.

Right to know about access: Request the record access log showing every time a doctor has viewed your medical records.

To exercise any of these rights, email privacy@bisadoc.com. We will respond within 30 days.

If you believe we have not handled your data correctly, you may lodge a complaint with Ghana's Data Protection Commission.

8. How We Protect Your Data

All data is transmitted over HTTPS (TLS encryption in transit).
All data is stored in Supabase with encryption at rest.
Medical files are stored in a private storage bucket — never publicly accessible. Files are accessed only via short-lived signed URLs that expire after 60 seconds.
Row-Level Security (RLS) is enforced at the database level — even if application code had a bug, the database would refuse unauthorised reads.
Passwords are hashed using industry-standard algorithms. We never store plain-text passwords.
Doctor access to patient records is enforced by database policy, not just application logic.
We maintain an immutable audit log of all doctor access to medical records.

No system is 100% secure. In the event of a data breach that affects your personal data, we will notify you within 72 hours as required by applicable law.

9. Children's Privacy

BisaDoc is not intended for children under 16 years of age. We do not knowingly collect personal data from children under 16. If you are a parent or guardian and believe your child has provided us with personal data, please contact us at privacy@bisadoc.com and we will delete it promptly.

10. Changes to This Policy

We may update this Privacy Policy from time to time. When we do, we will update the "Last updated" date at the top of this page and notify registered users by email if the changes are material. Continued use of BisaDoc after changes are posted constitutes your acceptance of the updated policy.

11. Contact Us

BisaDoc Privacy Team

privacy@bisadoc.com

Accra, Ghana

We aim to respond to all privacy requests within 30 days.

← Back to BisaDoc Read our Terms of Service →