Privacy policy

• Clinics own their patient records. Wareed processes them on the clinic’s behalf and only to run the service the clinic uses.
• We do not sell personal information, show advertising, or use patient records or conversations to train AI models.
• AI features (Fatma on WhatsApp and the visit scribe) prepare drafts and replies; staff stay in charge, and doctors sign every visit note.
• The visit scribe records only after the patient’s consent is recorded, and clinics choose how long audio is kept.
• Our website sets no advertising or cross-site tracking cookies.

Wareed provides clinic software to healthcare organizations in Egypt and the GCC. This policy applies to visitors of our website, to clinic staff who use Wareed, and to patients whose information a clinic keeps in Wareed or who contact a clinic through a Wareed channel such as WhatsApp or an online booking page.

For patient information, the clinic is responsible (it is the data controller) and Wareed acts on its instructions (as a data processor). Patients should contact their clinic first about their records; we will help the clinic respond. For website visitors and clinic staff accounts, Wareed is responsible.

Clinic staff accounts

• Account details: name, email address, phone number, role, the clinics you belong to and your sign-in history.
• Work in Wareed: appointments, visits, notes, invoices, templates, settings and other records you create, with an activity and audit log of who changed what.
• Product usage: inside the signed-in workspace we use product analytics to see which features are used and where errors happen. These events carry your role and language, not your name or email.

Patients, on behalf of clinics

• Identity and contact: name, phone number, and, when the clinic collects them, date of birth, gender, national ID and insurance details.
• Care records: appointments, pre-visit forms, visit notes, prescriptions, files the clinic uploads, invoices and payments.
• Messages: WhatsApp conversations with the clinic, including replies prepared by Fatma, and booking confirmations and reminders.
• Visit recordings: when a clinic uses the visit scribe and the patient consents, audio of the visit and its transcript.
• Consent choices: data-processing consent and, separately, any optional analytics consent given on a booking page.

Website visitors

• Basic request data (IP address, browser and pages requested) in server and security logs, kept for a short period to keep the site running and protect it from abuse.
• Anything you choose to send us, for example a WhatsApp message to our sales number or an email.

• To run Wareed for clinics: bookings, reminders, the WhatsApp inbox, visits and notes, billing and reports.
• To keep the service secure: authentication, permissions, rate limits, bot protection, abuse investigation and audit logs.
• To support clinic teams when they ask for help, and to fix problems we detect.
• To improve the product using aggregated usage information from the signed-in workspace.
• To meet legal obligations, such as keeping financial records or responding to lawful requests.

We do not sell personal information or use it for advertising. We do not use patient records, conversations or recordings to train AI models.

Fatma answers patients on WhatsApp for clinics that turn her on. She replies from the facts the clinic approved, books through the same rules as staff, and hands the conversation to a person when she cannot help safely. The visit scribe transcribes a visit, with the patient’s recorded consent, and drafts notes that only become part of the record after the doctor edits, approves and signs them.

To do this, only the text or audio the feature needs is sent to the AI and speech-to-text providers we use (for example OpenAI and ElevenLabs), with settings that keep it out of model training wherever the provider offers that choice. AI features act within each staff member’s own permissions, and their actions appear in the clinic’s activity and audit logs.

We use a small number of providers to run Wareed, each receiving only what its job needs:

• Cloud hosting, database and file storage (including Cloudflare R2) for the service and its backups.
• WhatsApp, operated by Meta, and our messaging gateway, to send and receive clinic messages.
• AI and speech-to-text providers for Fatma and the visit scribe, as described above.
• Email delivery (Resend) for account and notification emails.
• Cloudflare Turnstile to tell people from bots on sign-in and public forms.
• PostHog for product analytics inside the signed-in workspace.

Some providers process data outside the patient’s or clinic’s country. Where that happens we rely on contractual and technical safeguards required by applicable law.

Clinic records are kept for as long as the clinic’s subscription is active and the clinic keeps them, then deleted or returned under the clinic’s agreement, except where the law requires us to keep something longer. Visit audio is kept for the period the clinic sets, which can be none at all. Security logs are kept for a short, limited period.

Wareed uses encrypted connections, role-based permissions, HttpOnly session cookies, rate limits and audit logs, and separates each clinic’s data from every other clinic’s. No system is perfectly secure; if we learn of a breach affecting personal information we will tell the affected clinics without undue delay so they can meet their own duties. Read more on our security page.

• Session cookies keep clinic staff signed in. They are HttpOnly and cannot be read by page scripts.
• Language and theme: we remember your language (a cookie and local storage) and light or dark mode (local storage).
• We do not use advertising cookies or track you across other sites. Booking pages only load a clinic’s optional analytics after the patient opts in.

Depending on where you live, including under Egypt’s Personal Data Protection Law (Law No. 151 of 2020) and the data protection laws of GCC countries, you may have the right to access, correct or delete your personal information, to object to or restrict some processing, and to withdraw consent.

Patients: please contact your clinic, which controls your records; we will support it. Clinic staff and visitors: email privacy@wareed.io. We may need to confirm your identity first. You can also complain to your local data protection authority.

Clinics may keep records for patients under 18, with a parent or guardian acting for them. Wareed accounts are for clinic staff only and are not intended for children.

We will update this page when our practices change and change the date at the top. For significant changes we will also tell clinic administrators in the product or by email.

Privacy questions: privacy@wareed.io. Please do not send patient information by email. Security concerns: security@wareed.io.