MySheba Professionals Privacy Policy

At MySheba Professionals, we are committed to protecting your privacy and ensuring the security of your personal and professional information. This Privacy Policy explains how we collect, use, share, and protect your data when you use our healthcare professional portal.

1. Information We Collect

1.1 Professional Information

When you register as a healthcare professional, we collect:

• Account Information: Full name, email address, phone number, and password (encrypted using bcrypt hashing)
• Professional Credentials: Medical license number, registration authority, specialization, and qualifications
• Practice Details: Years of experience, professional bio, consultation fees, and availability schedule
• Verification Documents: Professional certificates and licenses for verification purposes
• Profile Information: Profile photo and professional description displayed to patients

1.2 Patient Consultation Data

Through your consultations, you will access and generate:

• Patient appointment details and consultation history
• Prescriptions you write for patients
• Diagnoses and medical notes
• Chat messages and communications with patients
• Medical files and attachments shared during consultations
• Video call recordings metadata (duration, timestamps)

1.3 Device and Technical Information

We automatically collect:

• Device information including FCM (Firebase Cloud Messaging) tokens for push notifications
• Platform type (Android/iOS) and device name
• Geolocation data (country, city, region) for service optimization
• IP address and session information
• Call history and consultation logs

2. How We Use Your Information

We use your information for the following purposes:

• Service Delivery: To connect you with patients, manage appointments, facilitate video consultations, and enable prescription writing
• Professional Verification: To verify your credentials and maintain the integrity of our healthcare network
• Communication: To send appointment notifications, patient requests, and platform updates via push notifications
• Patient Matching: To display your profile to patients seeking healthcare services in your specialization
• Healthcare Delivery: To enable secure video consultations, real-time chat, and medical record sharing with patients
• Quality Assurance: To maintain consultation records and ensure service quality
• Legal Compliance: To comply with healthcare regulations and professional licensing requirements

3. Your Responsibilities as a Healthcare Professional

As a healthcare professional using our platform, you acknowledge and agree to:

• Patient Confidentiality: Maintain strict confidentiality of all patient information accessed through the platform
• Data Protection: Not share, copy, or distribute patient data outside the platform without proper authorization
• Professional Standards: Adhere to medical ethics and professional standards when handling patient information
• Secure Access: Keep your login credentials secure and not share access with unauthorized individuals
• Accurate Records: Maintain accurate and complete medical records for all consultations

4. Authentication and Security

4.1 Authentication Methods

Important: MySheba Professionals does NOT use Facebook Login or any social media authentication.

We use only email and password-based authentication with enhanced security measures:

• Passwords are encrypted using bcrypt hashing with salt rounds
• Professional-only login endpoint with role verification
• Session-based authentication using Redis for secure session storage (NOT JWT tokens)
• Sessions expire after 7 days for security
• HTTP-only cookies to prevent XSS attacks
• Secure cookies (HTTPS only) in production environments
• SameSite cookie policy for CSRF protection

4.2 Data Security

We implement industry-standard security measures:

• MySQL database with SSL encryption for data transmission
• Secure file storage using AWS S3 with access controls
• Redis session store with connection pooling and encryption
• End-to-end encrypted video calls through Agora
• Secure real-time messaging through Ably
• Regular security audits and updates

5. How We Share Your Information

We share your information only in the following circumstances:

5.1 Patients

Your professional profile information (name, specialization, qualifications, fees, and availability) is displayed to patients seeking healthcare services.

5.2 Third-Party Service Providers

We use the following trusted third-party services:

• Firebase (Google): For push notifications (FCM tokens) to send appointment alerts and patient requests
• AWS S3: For secure storage of prescriptions, medical files, and consultation attachments
• Agora: For video calling functionality during telemedicine consultations
• Ably: For real-time chat messaging with patients

5.3 Regulatory Bodies

We may share your professional information with medical regulatory bodies for license verification or compliance purposes.

5.4 Legal Requirements

We may disclose your information when required by law, court order, or government regulations.

6. Data Retention

We retain your information for the following periods:

• Professional Account Data: Until you request account deletion or deactivation
• Consultation Records: As required by healthcare regulations (typically 7-10 years)
• Prescriptions: As required by medical record retention laws
• Session Data: 7 days from creation
• Chat Messages: Until consultation completion or as required by regulations
• Call Logs: For quality assurance and dispute resolution purposes
• FCM Tokens: Until device unregistration or token expiry

7. Your Rights

You have the following rights regarding your personal information:

• Access: Request a copy of your personal and professional data
• Correction: Update or correct inaccurate information
• Profile Management: Update your professional profile, fees, and availability
• Deletion: Request deletion of your account (subject to legal retention requirements for medical records)
• Opt-Out: Disable push notifications through device settings
• Data Portability: Request your data in a portable format

8. Professional Licensing

By using MySheba Professionals, you confirm that:

• You hold a valid medical license to practice in Bangladesh
• Your credentials and qualifications are accurate and up-to-date
• You will notify us immediately if your license status changes
• You will comply with all applicable medical regulations and ethical standards

9. International Data Transfers

Your information may be transferred to and processed in countries outside Bangladesh where our service providers operate. We ensure appropriate safeguards are in place for such transfers.

10. Changes to This Policy

We may update this Privacy Policy periodically. We will notify you of significant changes through the app or email notifications. Your continued use of MySheba Professionals after changes constitutes acceptance of the updated policy.

11. Contact Us

If you have questions about this Privacy Policy or wish to exercise your rights, please contact us: