Privacy Policy
Last updated: 25 September 2026 — Version: 2.4
1. Who We Are and What This Policy Covers
Mawaeidk for Services W.L.L., commercial registration No. 228056, incorporated in the State of Qatar ("Mawaeidk", "we", "us"), is the controller of the personal data we process through the Mawaeidk app, the website mawaeidk.com, and the messages connected to them.
This Policy explains what data we collect, why, who we share it with, how we protect it, and your rights. It is governed by Law No. 13 of 2016 on the Protection of Personal Data Privacy and its regulations in the State of Qatar. We process your data on the legal bases set out in Section 8.
2. The Nature of Some of Your Data
Linking your name to the health service you book (for example a cardiology consultation or a dental cleaning) may be personal data of a special nature under Article 16 of Law No. 13 of 2016. We process it only to execute and manage your booking, under the strict controls described in this Policy.
We do not use the service or specialty you book to target you with advertising, and we do not send it to advertising partners from your account or your bookings. However, advertising partners' tools on the website can see the addresses of the pages you open, including specialty, clinic and booking pages, whose addresses can contain the codes of the specialty, service and doctor you select (Sections 3.2 and 9.4).
3. Data We Collect
3.1 Data you provide
- Phone number: to create and verify your account with a one-time code.
- Name, gender and date of birth: required to complete your profile.
- Email address and profile photo: optional.
- Booking details: clinic, doctor, service, specialty, date and time, booking status, any cancellation reason, and the time you arrived at the clinic.
- Ratings and comments: if you choose to post them.
- Messages you send us through the contact form: name, phone and message text.
- Waitlist entries and favourites.
- Your WhatsApp number and your choice to receive booking notifications on WhatsApp: on the website, optional.
- AI assistant text: what you write in the optional guidance feature. We do not store it (Section 6).
3.2 Data collected automatically
- Notification token: to deliver booking notifications to your device.
- Crash reports: technical data about the error (device type, system and app version, error trace), with personal fields removed.
- Your connection (IP) address and technical request data, in server logs.
- Location, only with your permission, for three purposes:
- showing nearby clinics and sorting them by distance;
- showing your area name, which your device's system (Apple or Google) works out;
- confirming your arrival at the clinic. When the app is opened within about two hours before or after a confirmed appointment, it compares your position with the clinic's. We do not save the coordinates to your account; we keep only the arrival time, which the clinic sees. Coordinates may appear briefly in technical server logs.
Advertising measurement in the app: the app sends Meta generic events (app install, app open, and making a booking) without any details. Each event carries a technical identifier created by Meta's tool and general technical data (device type, system, version, language, connection address). We do not send your name, phone number or email, the specialty, service, doctor, clinic or price, or AI assistant text. We do not collect the advertising identifier (IDFA on iOS, Google advertising ID on Android), and we do not request tracking permission on iOS. Meta may associate these events with other information it holds, under its own policy. The app also includes a TikTok measurement tool that is currently switched off and will not be switched on before the notice period in Section 16 has passed; when on, it sends similar generic events (sign-up, sign-in, booking started, booking made) without details.
Website and cookies: the website uses essential operational cookies and advertising-measurement tools from Meta (loaded directly by the website) and TikTok (loaded through Google Tag Manager, a Google service). These tools receive:
- page visits and full page addresses; on booking pages the address includes the codes of the specialty, service and doctor, and the date and time, that you select;
- button taps, such as calling a clinic, choosing a time, or starting or cancelling a booking;
- their own cookies;
- your browser's technical data.
TikTok's tool currently also reads email addresses and phone numbers typed into website forms, in encoded (hashed) form, and the text of buttons you tap. You can control or delete cookies in your browser settings. The cookies we use:
- mw_token: session token, not readable by scripts on the page, 30 days.
- mw_user: your name and phone number, shown on the website and readable by scripts on the page, 30 days.
- mw_otp: the code verification step, 10 minutes.
- A language preference cookie.
- Meta cookies (_fbp and _fbc) and TikTok cookies (_ttp and click ID), for advertising measurement.
3.3 What we do not collect
We do not collect medical records, test results, diagnoses or prescriptions, and we do not store bank card details. Payment is currently made at the clinic; online payment is not offered at present.
4. Purposes of Processing
- A) Operating the service:
- creating and verifying your account;
- executing, confirming and cancelling bookings;
- sharing what is necessary with the clinic;
- sending booking notifications and reminders;
- showing nearby clinics and confirming arrival.
- B) WhatsApp notifications:
- alerting the clinic to each new booking;
- sending you your booking notifications on WhatsApp, if you choose this on the website.
- C) Support and communication: answering your enquiries and complaints, and notifying you of material changes to the service or this Policy.
- D) Development and security:
- detecting and fixing faults;
- protecting accounts and preventing fraud and fictitious bookings;
- producing aggregated statistics.
- E) Measuring our advertising campaigns: knowing how many people installed the app, visited the website or booked through our ads, using the minimum data described in Section 3.2.
- F) Legal compliance: responding to official requests in the State of Qatar, and establishing or defending legal rights.
5. Marketing Messages and Ads in the App
5.1 We do not currently send promotional marketing messages. Before we do, we will ask for your separate prior consent in accordance with Article 22 of Law No. 13 of 2016, and provide an easy way to stop them.
5.2 We may send general announcements about the service itself, such as updates and operational notices, which do not promote any clinic, offer or service. Booking notifications, such as confirmations, reminders and cancellations, are an essential part of the service and are not marketing.
5.3 The app does not show third-party ads.
6. AI Assistant (Initial Guidance Feature)
6.1 An optional feature that suggests the most suitable specialty and available doctors from a short description you write. It is a guidance tool, not medical advice or a diagnosis. In an emergency, call 999 immediately.
6.2 From version 1.2.16 (now being released on the App Store and Google Play), the app asks for your consent before first use, and you can choose "Not now". If you have an older version, we recommend updating the app.
6.3 The text is sent to our AI service provider in the United States for real-time processing, under these controls:
- Your current message is sent together with up to 6 earlier messages from the same chat.
- Your name, phone number, account ID and location are not sent with it.
- We do not store the chat text. Our technical logs record only your account ID, a chat session code and the message length, not the content.
- The provider may keep the text for a limited period under its terms.
- Automated emergency screening runs before anything is sent. If an emergency is suspected, you are directed to call 999 and the text is not sent.
6.4 Please do not write names, ID numbers or other identifying details about yourself or others. You can stop using the feature at any time.
7. Anonymised and Aggregated Data
We may produce aggregated or anonymised statistics from which you cannot be identified, use them for development, reporting and business purposes, and never re-link them to your identity.
8. Legal Bases for Processing
We process your data with your consent or for the following legitimate purposes:
- Performance of our contract with you: managing your account, executing your bookings and their notifications, and alerting the clinic to your booking.
- Your consent: location permission, the AI assistant, WhatsApp notifications to you, and any future marketing messages.
- Legitimate interest, in a way that does not override your rights: service security and fraud prevention, crash monitoring, and measuring our advertising with minimum data, with your right to object (Section 13).
- Legal obligation: where a competent authority requires it.
9. Who We Share Your Data With
9.1 The clinic you book with
We share with the clinic what is necessary for your appointment:
- your name and phone number;
- your email and photo, if provided;
- the service, doctor, date and time;
- the booking status and your arrival time.
The clinic may receive a WhatsApp alert (a Meta service) about your new booking, containing your name, phone number, the doctor, service, date and time. After receipt, the clinic is an independent controller under its own professional and legal obligations.
9.2 Technical service providers (processing on our behalf and on our instructions)
- Google Cloud: hosting, in Doha, Qatar.
- Google Firebase Cloud Messaging and Apple Push Notification Service: notification delivery.
- Ooredoo: verification-code SMS, in Qatar.
- Sentry (Functional Software Inc.): error monitoring, on servers in the European Union.
- AI service provider: AI assistant, in the United States.
- Meta Platforms (WhatsApp Business): WhatsApp notifications.
- Resend: operational email.
- DeepL: translating clinic, doctor and service names between Arabic and English, with no patient data.
- Google Maps Platform: maps.
- Google Tag Manager (Google): loading the website's measurement tools.
- Local payment gateways: only if online payment is enabled in future.
9.3 Professional advisers, corporate transactions and authorities
We share data with:
- lawyers, accountants and auditors where needed, within confidentiality;
- a successor entity in a merger or acquisition, subject to this Policy;
- competent authorities in the State of Qatar, where there is a legal request.
9.4 Advertising measurement partners
We use measurement tools from Meta Platforms (Facebook and Instagram) and TikTok to learn whether an app install, website visit or booking came from one of our ads. These partners receive only what is described in Section 3.2, and use it under their own policies as independent controllers:
- Meta Privacy Policy: facebook.com/privacy/policy
- TikTok Privacy Policy: tiktok.com/legal/privacy-policy
9.5 What we do not do
We do not sell, rent or trade your data. We do not send your name, phone number, the text you write to the AI assistant, or your booking records from our systems to advertising partners or insurance companies. Partners' tools on the website can still see what is described in Section 3.2, including page addresses.
10. Data Location and Transfers Outside Qatar
10.1 Our servers and database are hosted in Doha, Qatar, on Google Cloud, and backups are kept with the same provider. Verification-code SMS messages are sent through a local provider.
10.2 Some data is transferred to providers whose servers may be outside Qatar, only in these cases:
- Notifications: device token, notification text and booking number.
- Error monitoring: technical data with personal fields removed, in the EU.
- AI assistant: under Section 6, in the United States.
- WhatsApp:
- the clinic alert under Section 9.1;
- your notifications if you choose them, showing the booking number, clinic, date and time.
- Advertising measurement: under Sections 3.2 and 9.4.
- Operational email, maps, your device's area-name lookup (Apple or Google), and Google Tag Manager.
10.3 Any transfer outside Qatar takes place in accordance with Law No. 13 of 2016 and with the necessary contractual and security safeguards.
11. Retention
- Account: while active. When you delete it, your identifying details are erased immediately (Section 14).
- Past bookings: kept no longer linked to your name, phone number or other contact details, for records and dispute resolution. The clinic keeps its own records under its obligations.
- Ratings and comments: remain published without your name or photo.
- Contact messages: as long as needed to handle and follow them up.
- Unfinished sign-ups: deleted automatically after 24 hours.
- Dashboard export files: deleted after one day.
- Server logs: 14 days; older logs from before this version are being deleted.
- Crash reports: a limited period set by the error-monitoring provider's plan.
- Backups: up to 30 days.
- Data held by advertising partners, WhatsApp and the AI provider: under their policies.
- AI assistant text: not stored by us.
We may keep specific data longer where the law requires it, or where it is needed to establish or defend a right.
12. Security
12.1 We apply appropriate technical and organisational measures, including:
- encrypted connections;
- a website session token that scripts on the page cannot read;
- encryption of your WhatsApp number in the database;
- limits on verification-code attempts, with the code cancelled after repeated wrong entries;
- role-based access to the clinic dashboard, with clinics' data kept separate;
- backups and periodic system reviews.
12.2 No method of electronic transmission or storage is one hundred per cent secure.
12.3 If a breach affects your personal data, we will notify the competent authority in the State of Qatar and notify you within the periods and procedures prescribed by law.
13. Your Rights
Under Law No. 13 of 2016 you have the right to:
- know that your data is being processed;
- access it and obtain a copy;
- correct it;
- request its erasure;
- object to or restrict processing;
- withdraw your consent at any time;
- lodge a complaint with the authority competent for personal data privacy in the State of Qatar.
To exercise them, write to us at the address in Section 17.
Controlling the use of your data for advertising, the website and notifications:
- The app's advertising measurement does not use your device's advertising identifier. Device settings (iOS: Privacy & Security → Tracking; Android: Settings → Privacy → Ads) limit how Meta and TikTok may use device data for advertising under their own policies.
- On the website: through your browser's cookie settings.
- WhatsApp notifications: from your profile on the website.
- Location: in your device settings.
14. Deleting Your Account
You can delete your Mawaeidk account (Mawaeidk for Services W.L.L.) in any of these ways:
- In the app: Profile → "Delete Account" → confirm.
- On the website: sign in at mawaeidk.com/en/profile with your phone number and verification code, then choose "Delete account".
- By emailing info@mawaeidk.com with your registered phone number. We may confirm the request with a code sent to that number, then carry it out the same way.
What happens immediately:
- Your upcoming bookings are cancelled and the clinic is told.
- Notifications stop on all your devices.
- Your favourites, waitlist entries, notifications and photo are deleted.
- Your identifying details are erased: name, phone, email, gender, date of birth and WhatsApp number.
If you later sign in with the same number, a new, empty account is created.
What remains:
- Your past booking history, no longer linked to your name, phone number or other contact details.
- Ratings and comments, without your name or photo.
- Past contact messages.
- Backups, for up to 30 days.
- Technical server logs, for up to 14 days.
- Data already held by advertising partners, WhatsApp (Meta) and the AI provider, under their policies.
- Records the clinic keeps under its own obligations.
15. Children's Privacy
The app is intended for people aged eighteen or over. A minor's legal guardian may book an appointment for them and is responsible for the accuracy of the data provided. If we learn that we have collected data from a minor without their guardian's authorisation, we delete it.
16. Changes to This Policy
16.1 We publish any update to this Policy in the app and on the website, with a revised "last updated" date.
16.2 We notify you of this version through the app and the website. For material changes in future, such as new processing purposes or new sharing parties, we will notify you through the app or the website and seek your consent where the law requires it, and we do not switch on a new sharing party until fifteen days after that notice.
16.3 This Policy is read together with the Terms of Use. If the language versions differ, the Arabic version prevails.
17. Contact
For any enquiry, request or complaint about the privacy of your data: info@mawaeidk.com
Mawaeidk Clinic app (for clinic staff)
The Mawaeidk Clinic app is for clinic staff only, not for patients. The clinic administrator creates staff accounts through Mawaeidk. The app has no self-registration.
Data the app processes
- The staff member's email, name and account identifier, for sign-in.
- The push-notification token of the staff member's device, used to send operational alerts: a new booking request, a cancellation, or a reminder that a response deadline is close.
- Booking information the clinic already holds, shown to authorised staff only.
- When staff create a booking for a walk-in patient: the patient's name and phone number, as entered by staff.
The app contains no advertising or tracking tools, and we do not sell any data.
Data kept on the device is minimal and stored in encrypted storage. It is cleared when the staff member signs out and expires after 24 hours.
Push notifications can be turned off at any time in the phone settings.
Account deletion and data requests
The clinic administrator removes the staff account from the clinic panel, or the staff member contacts support to ask for the account to be deleted or for a copy of their data.
Contact support: support@mawaeidk.com · +974 5583 1633
This section added: 9 October 2026