Your privacy, and your patients’.

Who we are

MedBoox is a product of Com2pme, registered under commercial registration number [number] in [place], with its registered office at [address]. Code S.A.R.L builds and hosts it for Com2pme. You can reach us at [email protected] or +961 79 164 130.

This policy explains what information MedBoox handles, why, who receives it, and the rights of the people concerned under Lebanese Law No. 81 of 10 October 2018 on Electronic Transactions and Personal Data.

Two kinds of information, two roles

• Practitioners’ accounts. For the doctors and therapists who use MedBoox and their practice details, MedBoox decides how the information is used and is responsible for it.
• Patients’ information. Each practice decides which patients it records and what it records about them. MedBoox stores and processes that information only to provide the service to the practice, following its instructions and the data processing terms. A patient who has a question about their information should first contact the practice that recorded it.
• Patient accounts. A patient can choose to create a MedBoox account, to see their visits and what their practices share with them. For that account, MedBoox decides how the information is used and is responsible for it.

What we handle

For practitioners: name, email address, password (stored only as a secure hash), sign-in codes and trusted devices, the practice’s name, specialty, address, phone number, working hours, days off and settings, the licence and its payments, and technical records of sign-ins (date, browser and device type, network address).

For people who ask for a demo on this website: the name, phone number and specialty they give, and, if they add them, their email address, city and note. With the request we also record its language, the first page of their visit to this website and the name of the website that led them there, if any, to know which pages bring requests; no cookie is used for this. Requests are kept for one year.

For patients, as recorded by the practice: name, WhatsApp number, date of birth, language, tags, whether they agreed to WhatsApp appointment messages, appointments and their status, fees and payments, and, if the practice uses them, session notes and attached files. MedBoox also keeps the WhatsApp messages sent to each patient, their delivery status, and the replies or button taps the patient sends back.

For patients who create a MedBoox account: name, email address, WhatsApp number (proved with a code), date of birth, language, password (stored only as a secure hash), sign-in codes, trusted devices and phones, and technical records of sign-ins. If they use these features, also: the family members they add (name, date of birth, relationship, optional phone number), the medical profile they write (allergies, conditions, medicines, blood type), the documents they send to a practice, their requests for a visit, the exercises they tick as done, and the people they invite to follow someone on their account.

A patient does not need an account: a practice’s reminders reach them without one. MedBoox never contacts patients for its own purposes.

Why we use it

• To provide the practice workspace: calendar, patient files, payments and settings.
• To send the WhatsApp appointment messages the practice has switched on (confirmations, reminders, follow-ups, missed-appointment and cancellation messages, and check-up reminders for patients who agreed to them) and to record the patient’s answers.
• To provide patient accounts: showing a patient, and the family they look after, their visits and what each practice chose to share, and passing on what they send to a practice.
• To secure accounts: email sign-in codes, trusted devices, rate limits and records that help investigate misuse.
• To manage licences, support and our legal obligations.

We do not sell information, do not show advertising, do not use analytics or advertising trackers, and do not use patients’ information to send promotional messages. Check-up reminders, which WhatsApp classes as marketing messages, go only to patients who agreed to them separately.

Health information

Appointments with a practitioner, and especially session notes and files, can reveal information about a person’s health. Under Article 91 of Law 81/2018, such information may only be processed with the person’s explicit consent or when it is necessary for diagnosis or treatment by a healthcare professional, among other limited cases. Each practice is responsible for having a valid basis before recording a patient, and for obtaining the patient’s agreement before MedBoox sends them WhatsApp messages. MedBoox provides a patient notice that practices can use for this.

We recommend that practices record only what they need. Session notes and uploaded files are stored encrypted, and WhatsApp messages never contain clinical details.

Who receives it

Information is only available inside the practice that recorded it, to the people that practice has given access to. Within a practice, a doctor’s notes, prescriptions and files are private to that doctor; secretaries see contact details, the calendar, payments and the WhatsApp replies patients send about their visits, and no clinical records. Information is never shared with another practice. MedBoox staff do not look at patient records except when a practice asks for help or the law requires it, and are bound by confidentiality.

With a patient account, a practice’s file is linked to the account by the patient’s proved WhatsApp number and their name, and the patient is asked when only the number matches. The patient then sees their visits, their payments and what the doctor chooses to share. The patient’s medical profile is shown only to a linked practice the patient agreed to share it with, and they can stop sharing it at any time, and a document goes only to the practice the patient chooses. Someone the account holder invites to follow a family member sees that person’s visits, shared records and payments, and can change nothing.

To provide the service, MedBoox uses these providers:

Because some of these providers operate outside Lebanon, information can be transferred abroad. We choose providers with strong security commitments and only send them what they need.

We may also disclose information when Lebanese law or a court requires it.

How long we keep it

• Practitioner accounts and practice data are kept for as long as the practice uses MedBoox. When a licence ends and is not renewed, the workspace turns read-only and nothing is deleted until MedBoox closes the practice and emails its doctors the date. The practice can export its data for [30] days after closing; it is then deleted, and removed from backups within [90] days.
• A practice can archive a patient, or delete a patient’s whole file for good at any time.
• A patient can close their MedBoox account at any time, in Account. The account, its family members and their medical profiles are deleted; each practice keeps its own file, and the patient should ask the practice directly to delete it. An account whose email was never proved is removed after a day.
• Raw WhatsApp delivery records from Meta are kept for 30 days. Security records of sign-ins are kept for [12 months]. The activity log of each practice (who opened, changed or deleted which record, and when, without the content of notes, files or messages) is kept for [24 months].
• Where the law requires longer retention, we keep the information only for that purpose.

Security

MedBoox uses encrypted connections (HTTPS), two-step sign-in with an email code, encryption of session notes and uploaded files, separation of each practice’s data, restricted administrator access, regular backups and server protection. No system is perfectly secure; if an incident affects your information, we will tell the practices concerned without undue delay.

Your rights

Under Law 81/2018 (Articles 99 to 102), a person can ask:

• to know whether information about them is processed, and to receive an intelligible copy of it, including any encrypted notes;
• to have inaccurate, incomplete, outdated or unlawfully processed information corrected, completed or deleted;
• to object, for legitimate reasons, to the processing of their information.

Patients should send their request to the practice that recorded their information; MedBoox helps the practice answer within the ten days the law provides. A patient can also stop all WhatsApp messages from MedBoox at any time by replying STOP. A patient with a MedBoox account can correct their details and close the account themselves, and can write to [email protected] about it.

Practitioners can update their name in Settings and write to [email protected] for anything else. We answer within ten days. If you think your rights were not respected, you can also bring the matter before the competent Lebanese courts.

Cookies

MedBoox only uses the cookies needed to sign you in, keep you secure and remember your language. See the cookie policy.

Changes

We will update this policy when the service or the law changes, and tell practitioners of important changes before they apply. The date at the top shows the latest version.

Languages

This policy is available in English, French and Arabic. If the versions differ, the [English] version prevails, unless Lebanese law requires otherwise.

Draft for legal review. Items in [brackets] must be completed, and the policy reviewed by a Lebanese lawyer, before launch — in particular whether a declaration to the Ministry of Economy and Trade or a licence from the Ministry of Public Health (Law 81/2018, Articles 94 to 97) is needed.