1. Who we are and our two roles
MaffeiCare Plus is provided by MaffeiTech Information Technology L.L.C, Dubai, United Arab Emirates ("MaffeiTech", "we"). We have two different roles:
- For patient information that clinics enter, the clinic decides what is collected and why. The clinic is the controller and we are its processor: we handle that information only to run the Service and on the clinic's instructions, under our Data Processing Agreement. If you are a patient, please contact your clinic about your information.
- For information about clinic staff (account holders), clinic sign-up and billing, support and our website, we are the controller and this policy applies directly.
2. Information we collect
- Account information: name, email address, phone number, role, and your login and two-factor settings.
- Clinic and verification information: clinic name, address and contact details, licence number, issuing authority and expiry, and the documents you upload for verification (such as an identity document, licence to practise, clinic licence and the owner's photo).
- Billing information: subscription and invoice details. Card payments are handled by our payment provider; we do not store full card numbers.
- Patient information entered by clinics: identity and contact details, appointments, medical history, clinical notes and charts, prescriptions, photos and documents, treatment plans, invoices and payments.
- Information patients enter themselves: when a clinic uses self-registration, a patient can fill in their own details (and add a photo) through the clinic's registration link or QR code. This information goes to that clinic, which reviews it, and is handled like any other patient information the clinic keeps.
- Technical information: IP address, browser and device information, login history and an activity (audit) log of actions taken in the Service.
- Communications: messages you send to our support team, and messages your clinic sends to patients through the Service (by email, or by WhatsApp where the clinic has switched it on), and patients' answers to appointment reminders.
3. How we use information
- To provide, maintain and support the Service.
- To verify that clinics are licensed healthcare providers.
- To keep the Service and your data secure: two-factor authentication, login protection, fraud prevention and a tamper-evident activity log.
- To bill subscriptions and keep financial records.
- To send service messages such as sign-in codes, security alerts and notices about your account. We send marketing only where you have agreed to it.
- To find and fix errors, using error reports from which personal data is removed as far as possible.
- To meet our legal obligations.
We do not sell personal information and we do not use it for advertising.
4. AI features
AI features are off by default and are switched on only for clinics that ask for them. When a clinic uses them, the information needed to answer the request — which can include patient information — is sent to our AI provider, Anthropic, to produce the answer. Anthropic does not use this information to train its models. AI features do not make decisions with legal or similar effects about anyone; clinicians review and decide.
5. WhatsApp messages
WhatsApp messages are off by default. Each clinic decides whether to switch them on. When a clinic switches them on, we send its appointment reminders through the WhatsApp Business Platform, which is operated by Meta Platforms.
- What is sent: the patient's WhatsApp or phone number, the patient's first name, the clinic's name, the doctor's name, and the appointment date and time. Medical information is never sent by WhatsApp.
- Replies: each reminder has Confirm and Cancel buttons. When the patient taps one, Meta passes the answer to us and we record it on the appointment, with the time. A reply of STOP or START is also acted on (see below). Other replies are not read or stored by the Service.
- Purpose: only the clinic's own appointment reminders and replies about them. We do not send marketing on WhatsApp.
Meta handles these messages under its own WhatsApp terms and privacy policy. A patient who does not want WhatsApp messages can reply STOP at any time, or ask the clinic to stop them; either way no more WhatsApp messages are sent to that patient, and the change is recorded. Replying START turns them back on.
7. Where information is stored
Our main servers and database are in the European Union (the Netherlands). Uploaded files are kept in cloud storage operated by Cloudflare. Some providers, such as our email, WhatsApp and AI providers, process information in the United States or in other countries. Transfers outside your country are protected by our contracts with these providers. A clinic in the United Arab Emirates should note that its data is currently hosted outside the UAE.
8. How long we keep information
- While a clinic's account exists, its records are kept. Patient, clinical and financial records are never erased by the clinic or automatically; they can only be archived, which hides them from daily views but keeps them stored.
- When a clinic's account is closed or its subscription ends without renewal, we keep the clinic's data for 90 days so the clinic can ask for a copy, then MaffeiTech deletes it, unless the law requires us to keep it longer.
- Deleted information can remain in encrypted backups for a limited time until those backups expire.
- Verification documents from applications that were declined or abandoned are kept only as long as needed, and then deleted by our team.
9. How we protect information
We use encryption in transit and at rest, separate each clinic's data, offer two-factor authentication to every user, keep a tamper-evident activity log and take regular encrypted backups. More detail is on our Security page.
10. Your rights
Depending on the law of your country, you may have the right to access, correct or delete your personal information, to object to or restrict some uses, and to withdraw consent. Clinic staff can exercise these rights by writing to support@maffeitech.com.
Patients: the clinic controls your records. Please contact your clinic first; we help clinics answer such requests.
You may also complain to the data-protection authority in your country.
12. Children
Account holders must be adults. Clinics may keep records about patients who are children; the clinic is responsible for any consent from a parent or guardian that its law requires.
13. Changes to this policy
We may update this policy. For important changes we will tell clinics by email or in the Service before they take effect. The date at the top shows the latest version.
14. Contact
MaffeiTech Information Technology L.L.C, Dubai, United Arab Emirates. Email: support@maffeitech.com.