What we collect, why, and who sees it

Who we are

Mawid is a service run by Photonect in Iraq. For anything about privacy: email contact@photonect.net, or WhatsApp and phone +964 782 403 3490.

What this policy covers

• The website. Mawid's public pages, in Arabic and English.
• The clinic app. The calendar, patient list, messages and owner dashboard used by a clinic's staff.
• Clinics' WhatsApp messages. Appointment confirmations and reminders, patients' replies to them, and the booking assistant if a clinic turns it on.
• The doctor-booking service. Mawid's own WhatsApp number, where a patient asks for a doctor and chooses one, and Mawid contacts that doctor.

What we collect

• Clinic staff. Name, email, password (we store only a hash of it, never the password itself) and preferred interface language.
• Clinics' patients. Name, phone number, appointments, logistical notes written by the clinic, and messages exchanged with the clinic's WhatsApp number. The clinic enters this data and is responsible for it; Mawid processes it on the clinic's behalf and only to serve it.
• People who ask Mawid for a doctor. Phone number (or, when WhatsApp withholds it because the person has a WhatsApp username, the ID WhatsApp sends instead and a contact number we ask them for), the patient's name and age, a description of the problem in their own words, their area or a shared location (rounded to about 100 metres), the specialty and how soon, the doctors they were shown, the doctor who accepted, and the conversation.
• Doctors in Mawid's directory. Name, specialty, place, address, WhatsApp number, where the listing came from (the doctor's own request, or public sources), their replies to requests, and how often they were shown to patients.
• Website visitors. We use no analytics or advertising trackers. The “Book a demo” and “Join as a doctor” forms send nothing to our servers — they open WhatsApp with a message you can choose to send.
• Technical data. Server logs needed to run and secure the service, and error reports with request bodies and cookies removed.

Cookies

We use strictly necessary cookies only: the clinic app sign-in session (mawid_session), the admin console session (mawid_admin_session) and the interface language (mawid_locale). No advertising or third-party cookies.

How we use it

We do not sell data, use it for advertising, or diagnose anyone. A description of the problem is passed as written to the doctor the patient chooses. The automated assistant may suggest a specialty from the description, but never chooses one for the patient: the patient accepts the suggestion or picks another.

• To book appointments, confirm them and remind patients, and to read patients' replies.
• To show nearby doctors to someone asking for one, contact the doctor they chose, and tell both sides the outcome.
• To run, secure and support the service, and to invoice clinics by message volume.

Who sees it

• The clinic. Sees its own patients, appointments and messages only — never another clinic's.
• The doctor a patient chooses. Sees the first name, age, description, area and urgency — not the phone number. If they accept, they receive the patient's name and number to agree the appointment, and the patient receives the doctor's name and address.
• The Mawid team. Reads doctor-booking requests and their conversations to follow them up. A clinic's patient data is read only for one clinic at a time, with a written reason, for fifteen minutes, and the access is logged under the person's name before it happens.
• Service providers. Meta (WhatsApp Business Platform) or Twilio to carry messages, the hosting provider our servers run on, and an error-monitoring service that receives reports with personal data removed. Each processes data only to provide its service to us.
• Google (Gemini). When the automated assistant is on — on Mawid's number, or at a clinic that switched it on itself — the text of a message is sent to Google to be read and to word the reply. The phone number is not sent, and the model that words replies never sees the patient's name or words. We use Google's paid service, under whose terms this data is not used to improve Google's products. The assistant never picks an appointment or confirms a booking: that is always a reply the patient or doctor types.
• Authorities. Only where the law requires it.

WhatsApp

Messages with a clinic's number or Mawid's number travel through WhatsApp, owned by Meta, and are also subject to WhatsApp's own terms and privacy policy.

How long we keep it

• Message text is deleted after 90 days; a record of each message (date, status, type) stays for billing and as proof of delivery.
• Doctor-booking request details are kept unless deletion is requested.
• A clinic's data and its patients' data are kept while the clinic uses Mawid, and deleted or handed to the clinic on its request when it leaves.
• The log of actions by the Mawid team is kept for security and accountability; it contains no message text.
• The log of the automated assistant's use keeps only the time, duration and outcome of each request — never the message text or a phone number.

How we protect it

• Connections are encrypted (HTTPS); passwords and session tokens are stored hashed, never as they are.
• Each clinic's WhatsApp credentials are stored encrypted.
• Every clinic is isolated from every other, and every change the Mawid team makes to a clinic's settings is logged under the person who made it.

Your choices and rights

• You can ask for a copy of your data, or for it to be corrected or deleted.
• If you are a patient of a clinic that uses Mawid, the clinic manages your data: contact the clinic, or contact us and we will pass your request on.
• To cancel a doctor-booking request, write “إلغاء” (cancel) in the conversation at any time.
• If you are a doctor and do not want requests, reply “إيقاف” (stop) to any message from us: we will not show you to patients or message you again.

Requesting deletion of your data

Write to contact@photonect.net or on WhatsApp to +964 782 403 3490, giving the phone number you used with us (or the clinic account's email). We confirm the request is yours, delete or anonymise the data within 30 days, and tell you when it is done. We keep only what the law requires us to keep.

Children

The service is meant for adults. A parent or guardian may book for a child; they are responsible for what they send about the child, and may ask for it to be deleted.

Where data is kept

Data may be stored or processed outside Iraq, by our hosting provider and the service providers named above, under the same protections described on this page.

Changes to this policy

If we change what we collect or how we use it, we update this page and the date at its top. If the change is material, we tell clinics before it takes effect.