Privacy Policy
Applies to patients, caregivers, doctors, assistants and visitors using HelloDoctor's websites, PWA and authorised communication channels.
Effective date: 24 August 2026 | Last updated: 24 August 2026
1. Scope and consent
This Privacy Policy explains how HelloDoctor HealthTech Limited collects, uses, discloses, stores and protects personal information. By using the Platform or submitting information, you acknowledge this Policy. Where consent is required for sensitive information, cookies or another activity, HelloDoctor will seek it through an appropriate notice or control.
Explicit informed consent must be obtained before a telemedicine consultation and documented in the patient's records. Accepting this Privacy Policy or the Terms & Conditions does not by itself constitute consent to a clinical consultation or to recording an audio or video call.
2. Information we may collect
Patient and caregiver information may include name, age, sex, phone, email, location, account details, guardian relationship, symptoms, medical history, medicines, allergies, pregnancy information where relevant, chats, audio/video-related records, reports, images, prescriptions, consultation and follow-up information, serial requests, booking status, consent, complaints and support records.
Consultation records may include the communication mode used, relevant dates and times, clinical notes, the patient's consent and how it was obtained, and the reason for changing between video, audio and text. Audio/video-related records do not necessarily mean a recording of the call itself. The recording requirements in section 12 apply to any proposed recording.
Doctor and assistant information may include name, photograph, phone, email, BMDC number and registration data, submitted documents, qualifications, specialty, training, experience, workplace, chamber, map location, schedule, fees, assistant/chamber contact, posts, responses, activity, subscription and payment information.
Payment and transaction information may include amount, method, status, transaction ID, payer identifier, time, refund information and confirmation evidence. HelloDoctor does not ask for or intentionally store mobile-banking PINs, card PINs, OTPs, passwords or full secret card credentials. Payment gateways and financial providers process their own secure payment data under their policies.
Technical and usage information may include IP address, browser/device type, operating system, cookie or device identifiers, page views, clicks, search filters, referral/campaign source, approximate or consented location, PWA token, security events and service logs.
3. Public and non-public information
A doctor's approved profile may publicly display name, photograph, BMDC verification status or partial/full number as configured, professional description, qualifications, specialty, experience, workplace, chamber address, schedule, fee, posts, views, follows, reactions and booking availability. Doctors should not submit private information for public fields.
A non-public assistant/chamber contact number provided for serial coordination will be available only to authorised HelloDoctor staff/systems and the relevant doctor/chamber, unless the provider separately authorises public display. Patient health records, phone numbers and booking details are not public.
Verification selfies are separate from public profile photographs and are not published on a doctor’s profile. Access through the Platform is restricted to authorised HelloDoctor personnel for verification, security and related complaint review, and access is logged. Any disclosure remains subject to section 6.
4. How we use information
We may use information to create and secure accounts; review and verify doctors; publish approved profiles; search and rank relevant doctors; route and confirm serial requests; conduct online consultations; identify participants; obtain consent; communicate with doctors, assistants and patients; process payment/refund; send service notices; moderate content; prevent fraud; investigate complaints; keep appropriate records; improve service; measure campaigns; maintain security; and comply with law.
Consultation-mode and consent records may be used for care continuity, patient safety, professional record-keeping, complaint review and dispute resolution. Where a patient requests audio or text because of privacy concerns or other practical difficulties, the record should contain only the information reasonably necessary to document that request, the consent obtained and the doctor's decision about suitability.
5. Doctor verification
HelloDoctor may compare submitted identity and BMDC information with available official records, keep verification evidence and dates, request corrections or further proof, and re-check or suspend a badge. Only information reasonably necessary for verification and safety should be collected.
Our review team manually examines verification selfies alongside submitted identity and BMDC information. These images are stored on our server as evidence for identity verification, impersonation prevention and the review of later identity-related complaints or discrepancies. A verification badge, including a green tick, does not cause the selfie to be deleted or prevent further review. When a replacement selfie is permitted, earlier submissions remain stored for comparison.
6. Sharing for care and operations
Information may be shared, on a need-to-know basis, with the assigned or selected doctor; an authorised assistant/chamber for a serial request; HelloDoctor clinical, care, support, operations, finance, moderation and security personnel; and vendors supporting payments, SMS/telecom, hosting, backups, cybersecurity, email, maps, analytics or communications.
We may disclose information to regulators, courts, law-enforcement or other authorities when required or permitted by law, or where reasonably necessary to address safety, fraud, legal claims or professional misconduct. HelloDoctor does not sell personal or health information. Service providers may use it only for instructed services and lawful purposes, subject to appropriate safeguards.
7. Payment gateway and financial processing
Payments may be processed by SSLCOMMERZ and participating cards, banks or mobile financial services. HelloDoctor may receive transaction status and reference information needed for fulfilment, accounting, fraud control and refund. Users should review the payment provider's own privacy and security notices and never share a PIN or OTP with HelloDoctor personnel.
8. Cookies, analytics and advertising measurement
HelloDoctor may use necessary cookies and, where permitted, analytics or advertising measurement tools such as Meta Pixel to understand visits, clicks, referrals and campaign performance. Users can control non-essential cookies through available preferences or browser settings. Identifiable health messages, reports or consultation content will not be used to build unrelated advertising audiences or shared for unrelated advertising without valid consent.
9. AI-assisted and automated processing
Automation or AI may assist doctor search, routing, chamber-information responses, support, moderation, transcription or summarisation. HelloDoctor will use reasonable controls, human review where appropriate and data minimisation. We will not intentionally provide identifiable health records to an unrelated third-party AI service for its independent model training. Automated output does not replace a doctor's final clinical judgment.
Any proposed recording or live transcription of an audio or video consultation is subject to the separate notice and consent requirements in section 12. Consent to receive a consultation does not automatically authorise these activities.
10. Data location and cross-border processing
HelloDoctor intends to store and handle patient and medical information within Bangladesh where required by applicable health guidance or law. If an approved provider processes information outside Bangladesh, HelloDoctor will use an appropriate lawful basis, notice, contractual and technical safeguards, and any required authorisation. Users should be told when a chosen third-party messaging platform independently processes data under its own rules.
11. Retention
Information is kept only as long as reasonably necessary for consultation and booking continuity, professional or medical record obligations, verification, accounting, fraud prevention, complaints, audit, legal claims, security and applicable law. After the purpose ends, information may be securely deleted, anonymised, archived or access-restricted. Account deletion does not require removal of records that must lawfully or safely be retained.
Verification selfies and their submission history remain stored after verification approval, with no fixed automatic deletion schedule in the current system. Their continued retention remains subject to the purposes described above and applicable law. Requests for access, correction or deletion are considered under section 13, including any relevant verification, security, complaint or legal requirements.
Consultation notes, communication-mode records and consent records are subject to the same purpose-based retention principles. Keeping a consent record does not require recording an entire call. Any separately authorised call recording or transcript must be retained only for its disclosed purpose and any applicable professional or legal requirements.
12. Security
HelloDoctor uses reasonable administrative, organisational and technical safeguards, including access controls, authentication, secure transmission where supported, logging, backup and vendor controls. No internet, cloud, phone or messaging system can be guaranteed completely secure. Users should protect devices and credentials, verify official channels and report suspicious activity promptly.
Patients and doctors should use a private setting for consultations where practicable and tell the other participant if an authorised caregiver, interpreter or other person is present. Only information reasonably necessary for care and authorised operations should be shared.
An audio or video consultation must not be recorded or live-transcribed by HelloDoctor or its consulting doctor merely because the patient has accepted these policies or consented to the consultation. Before any proposed recording or live transcription begins, the patient must receive a separate explanation of its purpose, who will have access, any relevant service provider and the applicable retention arrangements, and give explicit consent. Other participants' consent must also be obtained where required. Any processing legally required without consent must have a documented lawful basis and remain subject to applicable safeguards and notice requirements.
13. User rights and choices
Subject to identity verification, applicable law and legitimate retention needs, a user may request access to, correction of or deletion of personal information; withdraw consent for future optional processing; restrict non-essential marketing; or raise a privacy complaint. A doctor may update public profile information and request review of inaccurate verification data. Withdrawal does not invalidate processing already lawfully completed and may make a requested service unavailable.
A patient may decline an optional call recording or live transcription without that refusal alone preventing an otherwise suitable consultation. A patient may also withhold or withdraw consent to teleconsultation. The doctor may recommend an alternative communication mode or in-person care where appropriate. Existing clinical and consent records may still need to be retained as described in section 11.
14. Children and persons needing support
Where a patient is a child or cannot provide valid consent, a parent, legal guardian or responsible adult should participate as appropriate. HelloDoctor may verify age or authority and limit collection to what is necessary for safe service.
15. Security incidents
If HelloDoctor becomes aware of a material personal-data incident, it will take reasonable steps to contain, investigate and remediate the incident and provide notices to affected persons or authorities where required by applicable law.
16. Policy updates
This Policy may be updated as services, vendors or legal requirements change. Material changes will be published with a revised date and, where required, an additional notice or renewed consent.
Privacy contact
Company HelloDoctor HealthTech Limited
Registered address House-28, Kanchan House, Baitun Najat Jame Masjid Road, Chalaban, Dakshinkhan, Dhaka-1230, Bangladesh Email support@hellodoctor.org Phone 01400004101, 01805486027, 01805486028 Websites hellodoctor.org and hellodoctor.net
- Trade License No.
- TRAD/DNCC/046572/2025
