Privacy Policy and Data Protection Statement for the Hayai Platform

سياسة الخصوصية وحماية البيانات لمنصة حياي

Last updated: 27 September 2026

Preamble

The Hayai platform is committed to respecting and protecting the privacy of its users, and undertakes to process the personal and health data collected, made available or shared through the platform in accordance with the laws and regulations governing the protection of personal data in force in the Arab Republic of Egypt, foremost among them Personal Data Protection Law No. 151 of 2020, and with due regard to the sensitive nature of health data, the limits on its use, and the legitimate purposes for which it may be processed.

The purpose of this Policy is to explain the kinds of data the platform may collect or process, the purposes of that processing, the legal bases on which it rests, the rights of users in relation to their data, and the measures taken to protect it, all within the informational and technical role the platform performs, and without the platform carrying on any medical, therapeutic, diagnostic or pharmaceutical activity.

The platform's services may include, at the user's choice and with the user's consent where consent is required, automated processing of certain health data for the purpose of producing informational and guidance outputs as set out in this Policy and in the Terms of Use, without those outputs amounting to the practice of medicine, to a diagnosis, or to a treatment decision.

This Policy applies to all personal and health data collected or processed through the Hayai platform, whether obtained directly from the user, indirectly through the user's use of the platform's services, through the user's dealings with the healthcare providers the user chooses, or through what a provider records within the limits of the grant given to it, in each case to the extent required by the nature of the platform's operation and of its services.

Using the platform, registering with it, or benefiting from any of its services constitutes the user's acknowledgement that the user has read this Policy, understood it and agreed to what it contains, to the extent necessary for the operation of the platform and the provision of its technical services, while the user retains every right afforded by law in respect of the user's personal and health data.

For the avoidance of doubt, and by way of advance disclosure, the platform states that it does not sell personal or health data, does not rent it out, and does not make it available to data brokers; that it uses no advertising-tracking tool and no third-party analytics inside either of its apps; that it displays no advertising from external ad networks; that it does not tailor what the user is shown on the basis of the user's health data; and that it collects no payment or card data, all as detailed in clause 13.

1. The scope of this Policy, and the apps and services it covers

This Policy applies to the two apps the platform operates on a single server, namely:

• HAYAI — the app for patients, their families and visitors coming for treatment; its identifier on the app stores is com.hayai.app
• HAYAI Partner — the app for healthcare providers and for the authorised team members who act for them; its identifier is com.hayai.partner

Both apps run on the same server (api.hayaihealthcare.com), and they are therefore governed by a single policy. Where the data collected or processed differs between the two apps, this Policy says so expressly in the relevant place.

"User" in this Policy means every person who creates an account on either of the two apps or uses it, whether a patient, a member of a patient's family, a visitor coming for treatment, a healthcare provider, or a team member authorised by a provider. "Healthcare provider" means every entity or person licensed to provide a health service or a service connected with one, and who lists itself or its facility on the platform.

The sectors in which the platform gives access to providers are: hospitals, clinics, doctors, laboratories, pharmacies, home care, physical therapy, medical devices, blood banks, ambulances, intensive-care centres, medical tourism, insurance companies and charities, together with the jobs board through which providers advertise their vacancies and job seekers apply for them.

In all of these sectors the platform's role remains an informational and technical one, directed at coordination, at making information available and at enabling contact, without carrying on any medical, therapeutic, diagnostic or pharmaceutical activity, and without the platform being a party to the professional relationship between the user and the provider the user chooses.

Neither app is directed at anyone under 18, and by creating an account you confirm that you have reached that age, as set out in clause 16.

2. The types of data collected and processed

In operating the Hayai platform and providing its informational and technical services, the platform may collect and process several types of personal data, to the extent necessary to achieve the legitimate purposes of operation and coordination, and without exceeding the nature of its role or the limits of its functions.

2.1 Account data

In both apps: username, email address, telephone number, password, nationality, date of birth, gender and account type.

The password is stored in hashed form on the server and is not kept as readable text, so the platform's personnel cannot read it.

The user may instead sign in with a Google account. In that case the platform receives from Google the name, the email address and the account picture only; it receives neither the password of the Google account nor any other content from it.

2.2 The medical file, in the patient app

The medical file comprises what the user enters personally and what a healthcare provider records in it after the user has given that provider a QR grant, as set out in clause 6, including:

• Medical history: chronic conditions, surgical operations, allergies and medical reports.
• Vital measurements: weight, height, temperature, pulse, blood pressure, blood sugar, oxygen saturation and hours of sleep.
• Medicines and their times, prescriptions, medical orders, and laboratory and imaging results.
• The women's health section, for those who use it: menstrual-cycle data, pregnancy status and expected dates, the history of previous births including the child's sex and date of birth, the attending doctor, the hospital, and the method and date of delivery, and uploaded ultrasound images. All of it forms part of the medical file, so any provider holding a grant in force reads it, as set out in clause 6.2.
• The children's files the user creates inside the user's own account.
• Uploaded attachments: photographs of reports, PDF files and images of scans.

2.3 Data of the provider and of its facility, in the partner app

The facility's name and particulars, opening hours, services and their prices, branches, photographs and introductory videos; the particulars of the team members the owner of the facility invites and the permissions of each of them; and subscription data and its status. And for doctors: professional documents — the national identity number, the syndicate card and certificates — where the doctor chooses to upload them.

It must be pointed out that the greater part of the facility's profile is displayed publicly to users of the patient app, that being its very purpose, including the facility's name, its address, its location on the map, its means of contact, its opening hours, its services and prices, its photographs and videos, and the names of the doctors listed with it.

2.4 Transaction and request data

Booking and appointment requests; requests for intensive-care beds and ambulances; home-care and physical-therapy requests; sample-collection requests and prescriptions sent to pharmacies; medical-device requests; medical-tourism bookings; ratings and comments; support messages; and the user's messages to the AI assistant.

2.5 The health-insurance card and emergency contacts

As detailed in clause 9.

2.6 Job applications

On applying for a vacancy from the jobs board: full name, telephone number, email address, years of experience, and the CV as a file the applicant uploads, as set out in clause 7.

2.7 Records of patients who hold no account on the platform

As detailed in clause 8.

2.8 Technical data

Technical usage data connected with the user's interaction with the platform, such as sign-in logs, the internet protocol (IP) address, the time of the request, the type of device, the operating system and general usage data, together with the device's notification token (FCM token), all for operational, security and improvement purposes.

Neither app, and no part of the platform at the application level, keeps a record of what a user types into a search box: there is no search-history table and no query log. The web server that stands in front of the platform does, however, record the full address of every request in its access log, and where a search has been carried out that address contains the search term. Those server logs are kept for about fourteen days and are then overwritten. They are used for operation and security and for nothing else, and they are not shared with anyone.

2.9 The data used in the automated review service

This covers the health data or medical files the user chooses to select, to submit or to make subject to that service, to the extent necessary to carry out the review the user has requested, as set out in clause 5.

2.10 Inferred data and outputs

These cover the indicators, patterns, trends and preliminary observations that arise out of the automated review, including an indication that a review by a particular health specialty, or a further specialist assessment, may be appropriate. Such outputs remain associated with the user concerned and receive protection commensurate with their nature and with the sensitivity of the data from which they were derived.

2.11 Children's data

Where the service relates to a child, the processing may cover the child's age, health data, information relating to growth or development, and any other information provided by the person holding the legal capacity, in each case within the limits necessary for the service chosen.

The platform collects and processes no health data save within the limits the user determines and on the basis of the user's express consent, or within the limits of the grant the user gives to a particular provider. The entry, updating and deletion of such data remain subject to the user's will and responsibility, within the limits established by law.

3. Device permissions, and what the app does not request

The app reads nothing from the user's device except what the user expressly permits, and for a purpose apparent to the user at the time the permission is requested:

• Location. Requested when the user selects "nearest to me" or when the user marks a location on the map, whereupon the coordinates are sent to the platform's server in order to rank nearby results or to save a service address. Location is never read in the background; it is read only on the user's initiative and while the app is open in front of the user.
• Camera. Requested when photographing a document or an account picture, and when scanning a QR code. The camera does not operate of its own accord.
• Photos and files. Requested when the user selects a file to upload. Only the file the user selects is read; the rest of the device's contents are not browsed.
• Notifications. A device notification token is stored in order to send medicine reminders and updates on requests.
• Exact alarm, in the patient app only. To fire a medicine reminder at its appointed time.

As regards medicine reminders in particular, there are two routes. One is an alert fired by the user's own device at the time saved on it, which works without an internet connection and does not pass through the platform's server at the moment it fires. The other is an alert sent by the platform's server to the device as a notification. The medicine schedule itself is saved in the user's account on the server, so that the user finds it on any device from which the user signs in.

What neither app requests at all: contacts, text messages, the call log, the microphone, and location in the background. The user can verify this from the app-permissions page on the user's device.

The user may withdraw any of these permissions at any time from the settings of the user's device, in the knowledge that withdrawing a permission may disable the function that depends on it.

4. The purposes of processing and the legal basis for processing

The Hayai platform processes users' personal and health data within the limits of the legitimate purposes connected with operating the platform and providing its informational and technical services, consistently with the nature of its role as a technical intermediary for coordination and for making information available, and without exceeding the limits established by law or determined by the user.

The purposes of processing include, by way of example and not of limitation: enabling the user to create an account and use the platform's features; facilitating access to the health information made available; organising the channels of contact and coordination with healthcare providers, pharmacies and the other sectors set out in clause 1; enabling medical files to be uploaded and shared with the parties the user chooses; administering providers' accounts, their subscriptions and the permissions of their teams; together with the operational and security purposes necessary to ensure the stability of the platform, to protect its systems and to improve the quality of its services.

The legal basis for each purpose is as follows:

• Account data — to create the account, to sign in and to recover the password. Basis: performance of the contractual relationship arising out of use of the platform.
• Telephone number and email address — to verify the account, to notify the user about requests, and for contact and support. Basis: performance of the contractual relationship.
• The medical file and its attachments — to display them to the user and to share them with the providers the user chooses. Basis: the user's express consent, which the user may withdraw.
• Submitting health data to the automated review service — to generate the guidance outputs. Basis: express consent, which has the independent effect set out in clause 15.
• Location — to rank results by proximity and to save the address for a home service. Basis: the user's consent.
• The facility's profile and its service and price data — to display the facility to patients inside the app. Basis: performance of the contractual relationship with the provider.
• Subscription data and its records — to operate the provider's account and to meet legal and accounting obligations. Basis: performance of the contractual relationship, and legal obligation.
• Technical logs — to protect accounts against unauthorised access attempts and to diagnose faults. Basis: the platform's legitimate interest, to the extent that it does not prejudice users' rights or fundamental freedoms.

The processing of health data, being sensitive personal data, takes place within the limits the user determines and for the purposes connected with uploading and storing the user's medical files and sharing them with the healthcare providers the user chooses, and further, where the user chooses the automated review service, analysing the specified data for the purpose of producing informational or preliminary guidance outputs, without that data being used by the platform to take any final medical, therapeutic, diagnostic or pharmaceutical decision.

Health data enters into no marketing processing whatsoever, and is used only for the purpose for which the user entered it.

It is understood and acknowledged that the user has the right to withdraw consent to the processing of the user's health data at any time, within the limits permitted by law, in the knowledge that withdrawing consent may result in the user being unable to continue benefiting from some or all of the platform's services which by their nature depend on that processing.

5. Automated processing and artificial-intelligence technologies

Where the user chooses the automated review service, the platform, or the technical service providers on which it relies, depending on the technical architecture in use, process the health data the user specifies by automated means which may include artificial-intelligence technologies, for the purpose of analysing the information provided and generating the guidance outputs described in the Terms of Use.

This processing is confined to the defined purpose of the service the user has chosen. It is not directed at issuing any final medical diagnosis or any final medical, therapeutic, pharmaceutical or professional decision, and the resulting guidance outputs do not take the place of examination or assessment by a licensed healthcare provider.

Automated processing may lead to the generation of inferred information or indicators about the user, including patterns, trends, preliminary observations, or an indication that a review by a particular health specialty or a further assessment may be appropriate. Such information and outputs are treated as data associated with the user, and are protected commensurately with their nature and with the sensitivity of the health data from which they were derived.

5.1 What is sent, and where

By way of disclosure of the technical architecture of this service in particular:

• The app sends the text of the user's message, and any file the user attaches to it, to the platform's server. Neither the user's name, nor the user's email address, nor the user's telephone number, nor the user's date of birth is attached to the question. That statement has two qualifications, and both are set out below.
• The platform's server in turn sends the question to OpenAI, a company based in the United States of America, in order to generate the answer. This means that this data is transferred outside the Arab Republic of Egypt, as set out in clause 12.
• Before sending the question to OpenAI, the platform's server attaches to it a summary drawn from the user's own health record, and it does so in the health assistants — medical review, nutrition, women's health, child health, medication and the like — because the answer cannot be produced without it. What that summary may contain is set out here in full: age, sex, nationality and governorate; blood type, allergies and health problems, operations, and medicines and their doses; vital signs and their trends, height and weight, and laboratory results; dental records and women's-health records, including pregnancy and the menstrual cycle; children's records and their vaccinations, including the child's name; the insurance provider and the status of the card; medical orders; documents the user has uploaded, together with the text extracted from them and the original file name; and a record of the user's earlier use of the service. For that same reason, some assistants decline to answer until the user fills in the section required from the user's file, or updates it if it is out of date.
• Two things follow from the paragraph above, and are stated here expressly. The first is that a child's name is sent where the question concerns that child's file. The second is that a file name is sent as the user saved it, so that where a user has named a file after themselves, that name travels with it. A user who does not wish a name to leave their device should rename the file before uploading it.
• The directory assistants — pharmacies, charities, medical devices and insurance — read no medical file at all; what is sent in their case is confined to the text of the question and whatever the user attaches to it.
• The partner app contains an assistant specific to the doctor. When the doctor asks it about a particular patient, the question goes out together with that patient's identifier, and the platform's server attaches the patient's record to the question. This happens only for so long as the QR grant the patient gave the doctor remains in force, and the grant is re-verified with every question, so that the question is refused as soon as the patient withdraws the grant.
• Conversations are saved in the user's account so that the user may return to them, and the user may delete them.

The platform confines what it sends to the provider of the automated processing service to the amount necessary to answer the question put. The request is made to OpenAI's programming interface with storage switched off, and OpenAI states that data sent to that interface is not used to train its models unless the account holder chooses otherwise, and that it is retained for up to thirty days for the purpose of monitoring abuse and is then deleted. Beyond that, the platform has no technical authority over what happens on OpenAI's side, and relies in that respect on the terms in force between it and that company. The user is therefore advised not to include in a message anything the user does not wish to leave the user's device.

The assistant's answer is not a medical diagnosis, nor a substitute for consulting a licensed healthcare provider, and it may not be relied upon on its own in taking a treatment or medication decision.

6. Sharing the medical file with healthcare providers, and the grant code (QR)

The Hayai platform undertakes not to share or disclose users' personal or health data with any third party, save to the extent necessary to achieve the legitimate purposes of operating the platform and its technical services, in accordance with what the user expressly decides, and consistently with the applicable laws and regulations.

6.1 What the provider sees on the strength of the request alone

On a booking or on the sending of a request, the provider sees what is needed to carry out the request: the user's name, the means of contacting the user, the particulars of the request itself, and whatever the user attaches to it. The medical file is not opened to the provider by that alone.

6.2 The grant code, the only door to the medical file

The medical file is not opened to a doctor or a facility unless the user displays a QR code from the user's app and it is scanned. Searching for the user's name does not open the file, and the fact that the user was previously a patient of the provider does not open it; the grant alone opens it, and it is a single grant covering the whole file: the women's health section, the children's files and everything else in it, not one part and not another. Four kinds of provider can scan the code and open the file: the doctor, the clinic, authorised hospital staff, and the physiotherapist.

The user may withdraw the grant at any moment from within the app, whereupon it lapses immediately and at server level, so that the provider cannot thereafter open the file again.

The limits of that control must be stated precisely. Withdrawal ends every provider's grant at once: it is the only control the app offers today, and there is no way to withdraw from one provider and not another. Nor does the platform today show the user who currently holds a grant over their file. A grant also lapses of its own accord when the period the server sets on issuing it expires, without any withdrawal by the user.

As for what the provider had already seen or copied into its own records before the withdrawal, withdrawing the grant does not erase it from the provider's hands — a technical fact stated here expressly and without any assurance to the contrary; and the provider remains independently responsible for it under the rules of its profession and the data-protection laws governing its activity. The user is therefore advised not to display the code to anyone the user does not trust.

6.3 What the provider records in the medical file

Within the limits of a grant in force, the provider — the doctor, the clinic, authorised hospital staff, or the physiotherapist — can record entries in the user's medical file, comprising vital measurements, medical orders, prescriptions and matters connected with them. These entries appear in the user's file and the user sees them as any other entry. The platform does not intervene in the content of these entries nor in how they are used professionally, and the provider remains responsible for their accuracy and for its compliance with the data-protection laws governing its activity.

6.4 The facility's team

In the partner app, the owner of the facility invites the members of its team and determines the permissions of each of them. A member sees what concerns the facility within the limits of the permission granted to that member alone. The owner of the facility remains responsible for the choice of those it invites and for the acts of its team on the platform.

6.5 Sale of data, and disclosure required by law

The platform does not sell users' personal or health data, nor exploit it for marketing purposes independent of its services; nor is data disclosed to any governmental or judicial authority save within the limits imposed by law, or in execution of a judicial decision or an enforceable official request.

Apart from what is set out in this clause and in clause 7, the medical file reaches no party other than the technical parties set out in clause 12, and then only to the extent necessary for the operation of the service.

7. Content that is published publicly

Some of what the user enters is not private by its nature, and the user is entitled to know this before entering it:

• Ratings and comments. A user's rating and comment about a provider appear publicly to everyone who opens that provider's page, together with the name and the account picture registered with the platform. There is no button inside the app to delete a rating; re-rating updates the previous rating and takes its place. To have a published rating deleted, the user writes to the platform as set out in clause 18.

• Blood-transfusion requests — published by the provider, not by the patient. A user of the patient app cannot create a blood-transfusion request; they only read the board. The request is created and published by the hospital, from the partner app, and it carries: the blood type, the patient's condition, the contact telephone number, the location or address, and the report files attached to it where any have been uploaded. On publishing, the hospital chooses how widely it appears: to all signed-in users, or to hospitals only.

  This means health data about a named patient may be published without the patient ever touching the form. The publishing hospital is responsible for having a basis to publish that patient's condition and reports, and for attaching no more than the purpose requires. If you are the patient in a published request, write to the address in clause 18 and we will take it down. A request can be cancelled or closed, but what others saw before that cannot be recalled.

• Job applications. A job application — with the full name, telephone number, email address, years of experience and the CV as a file — reaches the employer that posted the vacancy, and it is the employer that reads it and accepts or rejects it, and it remains in the employer's hands. The platform does not examine its content and does not use it for any other purpose.

Beyond that, nothing is public: the medical file and its attachments — save for what the user personally attaches to a published blood-transfusion request as set out above — requests and bookings, a prescription sent to a pharmacy, uploaded professional documents, and AI assistant conversations: no one sees these except as set out in clause 6 and clause 12.

8. Records of patients who hold no account on the platform

This clause concerns a person who does not use the platform at all, and it is disclosed expressly because that person is entitled to know it.

A doctor using the partner app can keep on the platform a record of a patient who has no Hayai account, comprising: the full name, age, gender, condition, the date of the last visit, and clinical notes carrying a title, a diagnosis, a date and attachments. This record is kept on the platform's servers as part of the books of the doctor's clinic.

• This record is entirely separate from any medical file on the platform; it is not linked to a patient account, and nothing else in the app is built on it.
• The provider is the controller of this data and the party responsible for it: the provider collected it, must have obtained the necessary consent from the person concerned or have another legal basis for keeping it, and must handle it in compliance with the rules of its profession and with the data-protection laws governing its activity. The platform's role is confined to that of a processor storing the data on the provider's behalf; it does not examine the content and does not use it for any purpose of its own.
• If the reader is that person — that is, if health data about the reader has been recorded without the reader's knowledge or wish — the reader may write to the platform at the contact details set out in clause 19, and the platform undertakes to stop the processing, to delete the record, and to notify the provider concerned, all without prejudice to whatever the law may have required the provider to keep in its own records.

9. The health-insurance card and emergency contacts

9.1 The health-insurance card, in the patient app

The user can add the user's health-insurance card, and the data required comprises: the insurance company, the name written on the card, the insurance number, the expiry date, and a photograph of the card. This data is sent to the platform's server and is displayed to the insurance company concerned, which accepts or refuses the card.

This is a health card and not a means of payment; the platform collects no payment or bank-card data, as set out in clause 13. This feature is available in the patient app and not in the partner app.

9.2 Emergency contacts, in the patient app

The user can save the name and telephone number of another person to be contacted in an emergency. This is personal data belonging to a third person who took no part in entering it, and accordingly:

• The user acknowledges having informed that person, or having obtained that person's consent to the inclusion of their data for this purpose, and is responsible for the accuracy of that acknowledgement.
• The platform uses this data only for the purpose stated, and does not include it in any marketing activity.
• That person may request the deletion of their data by writing to the platform as set out in clause 19.

10. Emergency-service data

The platform makes it possible to search for intensive-care beds, ambulances and blood banks, and to send a request in respect of them. These are search-and-request services only; nothing is reserved and nothing is committed unless the provider expressly accepts the request.

Sending a request of this kind results in the user's data, the means of contacting the user, and the particulars of the condition stated in the request reaching the provider concerned, in the case of intensive-care and ambulance requests, Blood-transfusion requests, by contrast, are published by the hospital and not by the patient, as set out in clause 7.

In life-threatening situations, the ambulance service must be called directly on 123, and neither the platform nor waiting for a provider's reply through it may be relied upon.

11. Users of the partner app

What is set out in this Policy applies to providers and to the members of their teams as users holding accounts on the platform, and the following provisions apply to them in addition:

• A provider's account does not operate until it has been reviewed and approved by the platform's administration, and the application data and the approval status are processed for that purpose.
• The provider acknowledges and undertakes that its licence is in force and that it will remain in force throughout the provider's use of the platform, and that everything it displays — and in particular services, prices and opening hours — is correct and up to date. The platform may suspend the account where the contrary is established.
• The owner of the facility invites the members of its team and determines the permissions of each of them, and is responsible for their acts and for the limits of the data they may see, as set out in clause 6.
• Certain sections of the app are tied to the subscription plan. Where a section falls outside the plan, or where the subscription is not active, access to it is refused with a message stating as much (MODULE_NOT_IN_PLAN or PLAN_INACTIVE). The expiry of a subscription does not result in the deletion of the facility's data; rather, access to the sections tied to it is withheld until it is renewed, subject to the retention and deletion rules set out in clause 14.
• Subscriptions are agreed and paid for outside the app, between the platform and the provider. Neither app contains a payment gateway or a field for card data, and no payment data is collected through them. The platform keeps subscription records in order to meet its legal and accounting obligations.
• The provider undertakes not to use patient data reaching it through the platform for any marketing purpose, or for any purpose other than the one for which it reached the provider, and not to share it with others save on a legal basis.
• As regards records of patients who hold no account, the provider undertakes to comply with what is set out in clause 8.

12. The technical parties that process data on the platform's behalf, and transfers of data outside Egypt

The platform may rely on technical service providers acting on its behalf in operating, hosting or securing its services, or in carrying out certain automated processing functions, and this may require enabling them to process personal or health data to the extent necessary to provide the specified service. This takes place in accordance with the applicable contracts, instructions, and legal and regulatory controls, under which the service provider undertakes not to use the data for its own independent purposes and not to go beyond the scope of the instructions and of the specified purpose, unless there is an independent legal basis permitting otherwise.

By way of disclosure of these processors by name, being the principal parties currently taking part in operating the service, each within the limits of its task:

• Hostinger — hosting of the servers and the database, in its data centre in Frankfurt, Germany; the automatic copies Hostinger takes of the server are held in Vilnius, Lithuania. Everything saved in the user's account reaches Hostinger by the very nature of hosting, and the platform's outgoing email passes through it too.
• OpenAI — generation of the AI assistant's answers, as a service provider under the terms of OpenAI's programming interface. The text of the message reaches OpenAI, together with any file attached to it, and a summary drawn from the medical file in the health assistants, as detailed in clause 5.
• Firebase Cloud Messaging, of Google — delivery of notifications. The device's notification token and the text of the notification reach it.
• Google Maps and Geocoding — display of the map and conversion of coordinates into an address. Here the user's device communicates directly with Google when the map is opened, so that Google's privacy policy applies in this respect alongside this Policy.
• Google Sign-In — signing in with a Google account, where the user chooses that method.
• SMS Misr — sending verification messages by short text message, where that method is enabled. The telephone number and the text of the message reach it.
• YouTube, of Google — playback of introductory videos inside the app, which is subject to Google's privacy policy.

The platform does not put this list forward as an exhaustive list of every technical service provider, since it may rely on others in future to the extent necessary for operation, and it undertakes in that event to update this Policy and to apply the same controls set out above.

12.1 Where data is kept, and transfers of data outside Egypt

Data is kept on servers the platform leases from Hostinger, in its Frankfurt data centre in Germany; the automatic copies Hostinger takes of the server are held in Vilnius, in Lithuania. Some processing takes place outside the Arab Republic of Egypt, with the parties set out in this clause, most notably the automated processing carried out by OpenAI. The connection between the app and the server is fully encrypted (HTTPS/TLS).

Reliance on the parties named above results in some data being transferred outside the Arab Republic of Egypt, and in particular what is sent to OpenAI in the United States of America and what is sent to Google's services. The user's data is in any event held outside Egypt — in Germany, and in Lithuania — by the very nature of the hosting described above. These transfers take place within the limits necessary to provide the service the user has requested, on the basis of the user's express consent as regards health data, under contractual obligations of confidentiality and of confining processing to the specified purpose, and in accordance with the requirements of the applicable laws and regulations concerning the transfer of data abroad.

12.2 Leaving the app for another party

Some buttons take the user outside the app: opening a provider's website, messaging the provider on WhatsApp, calling the provider by telephone, or watching a video on YouTube. As soon as the app is left, the privacy policy of the party the user has moved to applies, and not this Policy, and the platform has no control over what that party collects.

13. The absence of advertising tracking, of analytics, and of payment data

By way of express disclosure, and corresponding to what the platform declares in the data safety form on the app stores:

• There is no advertising tracking. Neither app reads the Advertising ID, neither receives Install Referrer data, neither contains any measurement pixel or external ad network, and no advertising personalised on the basis of a user's data is displayed in them.
• As for the promotional content displayed inside the app — such as providers' advertisements for their services or their vacancies — its source is the providers listed on the platform, and it is displayed to all users alike without personalisation based on their health data or their medical files. The platform's server records the number of clicks on such content for operational purposes and in order to inform the provider of the number of clicks, and such a click is not sent to any external ad network.
• There are no third-party analytics or crash-tracking tools inside either app. The Firebase Analytics library was removed from both apps on 24 September 2026, and the Firebase libraries in use are confined to notifications (Cloud Messaging) and sign-in (Auth).
• No payment data is collected. There is no payment gateway, no field for a card number, no billing library and no purchase endpoint in either app. Any legacy value that may appear in certain requests for a "payment method" field carries no payment data, and payment — where there is any — takes place between the user and the provider outside the app, just as providers' subscriptions take place outside it as set out in clause 11.
• Data is not sold, not rented out, and not shared with data brokers. Without exception.

14. Retention and deletion of data, and deletion of the account

The Hayai platform retains users' personal and health data for no longer than the period necessary to achieve the purposes for which it was collected or processed, or to meet the applicable legal and regulatory obligations, in accordance with the principle of data minimisation and of not retaining data for longer than necessary.

In determining the retention period, regard is had to the nature of the data being processed, the extent of its sensitivity, the purpose of its use, and the relevant legal or regulatory requirements, with appropriate measures being taken to ensure that data is not used once its purpose has come to an end, whether by deleting it, by anonymising it, or by taking any other approved technical steps.

The retention and deletion rules apply likewise to the outputs of the automated review service and to the technical logs associated with it, for the periods necessary to achieve the purpose or as required by the applicable legal and regulatory requirements.

14.1 The two ways to delete an account

The user may delete the user's account by either of the following two ways, both of which lead to the same deletion:

1. From inside the app — Settings, then Account information, then Delete account.
2. From a browser, without needing to open the app — the account deletion page

This deletes the account and what the user saved in it: the medical file and its attachments, requests and bookings, AI assistant conversations, and the device's notification token. The deletion is final and cannot be reversed.

If the user is a member of a facility's team and does not find the deletion screen inside the app, the user may use the link above or write to the platform directly.

A deletion request is answered within three working days, and the deletion is completed within thirty days of the platform confirming the identity of the person making the request.

14.2 What may remain after deletion

• What the law requires the platform to keep, such as facilities' subscription records and accounting records, and for the period the law prescribes.
• What remains in the backups, which are taken nightly in order to protect data against loss. A backup is kept for ninety days and is then deleted, so that what was deleted from the account disappears from the backups too once that period has run.
• What a provider had copied into its own records before the deletion, which lies outside the platform's systems as set out in clause 6.
• Content previously published publicly, such as ratings and comments, which is not deleted automatically by the deletion of the account; to have it deleted, a request is made as set out in clause 18.

The deletion of data or the restriction of its processing is without prejudice to the platform's right to retain certain data to the extent necessary to meet binding legal obligations, to establish or protect its legal rights, or to give effect to decisions or orders issued by the competent authorities, within the limits established by law.

15. Users' rights in respect of their personal and health data

Users of the Hayai platform enjoy all the rights afforded to them under the laws and regulations governing the protection of personal data in the Arab Republic of Egypt, within the limits permitted by law and by the nature of the platform's operation and of its technical services.

These include:

• The right to be informed — that the user should know what the platform keeps about the user and how it processes it, and this Policy forms part of the discharge of that right.
• The right of access and to obtain a copy — that the user should have access to the user's personal or health data being processed through the platform. Most of it is displayed to the user directly inside the app, and the user may download the user's medical file in two formats: a PDF file for reading, or a ZIP file which also contains the original attachments the user uploaded.
• The right of rectification — that the user should correct any inaccurate or incomplete item of data, from the "Account information" screen or by writing to the platform. Where the incorrect item is an entry recorded by a provider in the user's medical file, the user may write to the platform, which will see to its correction by referring back to the provider concerned.
• The right of erasure and of restriction of processing — that the user should request the deletion of the user's data or the restriction of its processing in the cases permitted by law, and should delete the user's account as set out in clause 14.
• The right to withdraw consent — that the user should withdraw consent to the processing of the user's health data at any time, without prejudice to the lawfulness of processing carried out before the withdrawal. This includes withdrawing the sharing of the medical file by withdrawing the grant code, and withdrawing device permissions from the device's settings.
• The right to object and to complain — that the user should object to certain aspects of the processing of the user's data within the limits established by law, and should lodge a complaint as set out in clause 18.

The user may withdraw consent to the use of the user's health data in the automated review service in accordance with the legal requirements, and this does not affect the lawfulness of processing carried out before the withdrawal of consent. Refusing consent to the automated review service, or withdrawing it, does not deprive the user of the platform's other functions which by their nature do not depend on that processing.

Where the data being processed relates to a child, consent is obtained from the person holding the legal capacity in accordance with the rules established by law, and whoever provides the child's data undertakes to confirm the existence of the legal capacity or authority entitling that person to provide the data and to consent to its processing.

The platform undertakes to consider such requests and to respond to them within a reasonable period not exceeding 30 days, and in accordance with the relevant legal and regulatory requirements.

16. Children and the legal age for using the platform

Neither app is directed at children, nor at anyone under 18, and by creating an account you confirm that you have reached that age. The app does not verify this technically: it is your confirmation, not a control on our side.

A person holding the legal capacity — a guardian or a person with legal authority over a child — may create a file for that child inside the guardian's own account and record the child's health data in it. That data remains under the guardian's account and the guardian's responsibility, the basis for its processing is the guardian's consent, and it is deleted when the guardian's account is deleted.

Where the platform becomes aware that a child has created an independent account contrary to the above, it proceeds to delete it.

17. Security measures and data protection

The Hayai platform undertakes to take reasonable and appropriate technical and organisational measures to protect the personal and health data processed through the platform, with the aim of limiting the risks of unauthorised access, loss, damage or unlawful disclosure, consistently with commonly accepted standards and sound professional practice.

These measures include, according to the nature of the data and the sensitivity of the processing, the use of appropriate technical safeguards, access controls, operational security procedures, and the regulation of permissions to view data, together with the periodic review of security procedures, all without prejudice to the responsibility of the other parties dealing with the data — each within its own sphere — to take the measures required to protect the data reaching it through the platform.

These measures include, specifically:

• Encryption of every connection between the app and the server (HTTPS/TLS).
• Hashing of passwords and not storing them as readable text.
• Restricting access to the server to those who need it to operate the service, according to permission.
• Confining the sending of the session token to the platform's own server and to no other host.
• Termination of the session on signing out, or by the server invalidating it.

Where the platform relies on technical service providers to process personal or health data on its behalf, it undertakes to impose on them appropriate contractual and organisational obligations as to confidentiality, security, and the confinement of processing to the instructions and to the specified purpose.

It is understood and acknowledged that security measures, however extensive, cannot provide absolute protection against every technical risk, cyber-attack or failure beyond control, and that the platform does not guarantee absolutely that no breach or security incident will occur, provided that it has taken reasonable and appropriate measures in accordance with prevailing standards.

In the event of any serious security incident affecting personal or health data, the platform undertakes to take the steps necessary to deal with the incident and to limit its effects, and to notify users and the competent authority within the limits established by law, without being held liable for events not attributable to an established failure in the performance of its legal obligations.

18. Reporting content, complaints, and privacy requests

Content published by others can be reported from inside the app. Wherever such content appears there is a Report control on it — on an assistant's answer, on a blood-transfusion request, and on a provider's advertisement. Tapping it asks for the reason and allows a note, and the report reaches the platform at once. A report is not shown to whoever published the content.

Everything else is sent to the email address islam@hayaihealthcare.com. That covers, in particular, reporting a rating or a comment — for which no in-app control exists yet — and the requests of data subjects set out in clause 15, which are not content reports at all.

Either route covers: reporting a rating, a comment or any published content that infringes privacy or breaches the Terms of Use; requesting the deletion of published content; the requests of data subjects set out in clause 15; and requests from a person whose data has been recorded without their knowledge, as set out in clause 8 or clause 9.

In relation to reports concerning content, the platform undertakes to acknowledge receipt of a report to the person making it within 48 hours, and to decide on it within 7 days of receipt. Requests from data subjects are answered within the period set out in clause 15.

It must be pointed out that the review of content takes place when a report about it is received, and not before it is published; ratings, comments and blood-transfusion requests are published without prior review by the platform.

Without prejudice to the user's right to contact the platform, the user may lodge a complaint with the Personal Data Protection Centre in the cases and in accordance with the procedures established by law.

19. The data controller and contact details

The party responsible for processing the data (the "data controller") within the meaning of Personal Data Protection Law No. 151 of 2020 is:

• Full legal name of the company: Hayai Medical Tourism Services Company — شركة حياي لخدمات السياحة العلاجية
• Commercial register: 274471, Cairo Investment
• Address: 1 Mostafa El-Nahhas, intersection of Abbas El-Akkad, Madinat Masr, Cairo, Arab Republic of Egypt
• Email: islam@hayaihealthcare.com
• Telephone: +20 10 36570577

These are the approved channels of contact for all enquiries, complaints, privacy requests and data deletion requests.

20. Amendment of this Privacy Policy and its effect, and the governing law

The Hayai platform reserves the right to amend or update this Policy from time to time, whenever necessary, whether to keep pace with legislative or regulatory changes or with technical or operational developments in the platform's services, provided that users are notified of any material amendments through the platform or by the available means before they take effect, and the "Last updated" date recorded at the top of this page changes with each amendment.

The user's continued use of the platform after the amendments have been published is deemed an express acceptance of the amended Policy, and the most recent version of the Privacy Policy applies as from the date of its publication, unless expressly provided otherwise.

This Policy is to be read and construed in the light of the Terms and Conditions of use of the Hayai platform, consistently with the legal framework governing the nature of the platform and its informational and technical role, and in accordance with the provisions of the laws and regulations in force in the Arab Republic of Egypt; and the competent Egyptian courts have jurisdiction to hear any dispute arising out of its application or its construction.