Physiawy LLC Privacy Notice

Version: 1.1 Document date: 1 October 2026 Effective date: 10 October 2026. Operator: Physiawy LLC

This Privacy Notice explains how Physiawy LLC handles personal data when people use the Platform.

It applies to patients, prospective patients, representatives, guardians, clinic personnel, healthcare professionals, administrators, applicants, and other authorised users.

It must be read with the Terms of Service and any separate clinical consent.

1. Responsibility for personal data

1.1 Physiawy LLC is responsible for personal data for which it determines the purposes and means of processing.

1.2 This may include Platform accounts, identity and access management, security, audit, service coordination, support, Platform administration, and business operation.

1.3 A clinic or healthcare professional may be separately responsible for data used to assess, diagnose, plan, document, or deliver healthcare.

1.4 Depending on the activity and governing agreement, Physiawy LLC may act as:

an independent controller;
a joint controller; or
a processor acting on documented instructions.

1.5 The relevant clinic agreement and data-processing terms must accurately define the allocation of responsibility.

1.6 Nothing in this Notice transfers legal responsibility away from the party to whom the law assigns it.

2. Personal data that may be processed

Depending on the person’s role and use of the Platform, data may include:

Identity and contact information

name;
date of birth;
age;
email address;
telephone number;
address;
preferred language; and
verified representative or guardian details.

Account and verification information

account identifiers;
authentication-provider identifiers;
invitation status;
verification evidence;
professional role;
organisation membership;
permissions;
multi-factor-authentication status; and
account status.

Health and clinical information

symptoms;
diagnoses;
medical history;
medication;
allergies;
precautions;
referrals;
assessments;
care plans;
session records;
outcomes;
clinical documents; and
clinically relevant communications.

Location and home-visit information

service address;
geographic coordinates;
service-area results;
access instructions; and
relevant safety information.

Appointment and service information

requests;
availability;
booking details;
assigned clinic and professional;
attendance;
cancellation;
service status; and
workflow history.

Commercial information

quoted price;
currency;
applicable pricing rule;
commercial allocation;
invoice status;
payment status; and
transaction evidence.

The Platform does not currently process online card payments. Commercial-allocation records are administrative records used to operate the Platform. They are not the patient-facing price and are not shown to a patient except where law requires disclosure.

Professional and organisation information

qualification;
licence;
professional level;
specialism;
clinic relationship;
organisation role;
service areas;
schedule; and
organisation configuration.

Communications and support information

support requests;
messages;
complaints;
feedback;
correspondence; and
evidence submitted during an investigation.

Technical and security information

IP address;
device and browser information;
session information;
authentication events;
security alerts;
activity logs;
audit records; and
incident evidence.

Consent and policy information

policy kind;
exact policy version;
language;
acceptance time;
acceptance method;
withdrawal;
clinical-consent evidence; and
guardian authority where supported.

Governed outcomes and inferences

eligibility;
serviceability;
capacity;
safety;
fraud indicators;
scheduling results; and
other operational outcomes produced by governed rules.

Physiawy should not intentionally request data that is not reasonably necessary for an authorised purpose.

3. Sensitive personal data

3.1 Health data and other legally designated categories receive enhanced protection.

3.2 Children’s data, identity evidence, and certain authentication data may also require enhanced protection.

3.3 Sensitive data must be processed only when an appropriate legal basis and any required consent, licence, permit, professional safeguard, or regulatory authorization are in place.

3.4 Access must be limited according to role, organisation, care relationship, purpose, and necessity.

4. Sources of data

Data may be obtained:

directly from the person;
from an authorised representative or guardian;
from an inviting clinic or organisation;
from an authorised healthcare professional;
from an identity or authentication provider;
from Platform activity;
from a device or browser;
from a service-area or location check;
from a regulator, court, or public authority where lawful; or
from another person where the person has authority or another valid legal basis applies.

5. Purposes of processing

Personal data may be processed to:

create, verify, secure, and administer accounts;
manage roles, memberships, organisations, and permissions;
determine service eligibility and service-area availability;
coordinate requests, assessments, appointments, home visits, and follow-up;
support authorised healthcare assessment, treatment, care planning, records, continuity, and referrals;
present and preserve authorised prices and transaction evidence;
operate support, complaints, safeguarding, and incident response;
verify clinics and healthcare professionals;
protect patients, users, systems, and data;
prevent fraud, abuse, error, and unauthorised access;
maintain audit trails, security records, and protected-control evidence;
comply with healthcare, consumer, tax, accounting, court, regulatory, and professional obligations;
establish, exercise, or defend legal claims;
monitor reliability and diagnose technical faults;
improve the Platform using appropriately minimised or de-identified information where feasible; and
send marketing only where an appropriate legal basis and required consent exist.

Physiawy must not sell personal data or use health data for unrelated advertising.

6. Legal bases

Depending on the processing activity and applicable law, a legal basis may include:

taking steps at a person’s request;
performing a contract;
complying with a legal or professional obligation;
explicit consent where required;
authorised healthcare purposes;
protection of vital interests in a genuine emergency where permitted;
establishment, exercise, or defence of legal claims;
a lawful public-health or safety basis; or
a legitimate interest that is necessary, proportionate, and not overridden by the individual’s rights.

Consent must not be used as a substitute for another legal requirement.

Where processing relies on consent, withdrawal applies prospectively and does not make previous lawful processing unlawful.

Withdrawal may affect a service where the information is necessary for safe care, a contractual service, or a mandatory record.

7. Healthcare delivery and clinical records

7.1 Authorised clinics and healthcare professionals may access information necessary for an authorised request, assessment, appointment, treatment, follow-up, safety measure, or professional record.

7.2 Platform permissions must not be used to bypass professional confidentiality.

7.3 Access must be connected to an authorised role and purpose.

7.4 A clinic or healthcare professional may be required to retain clinical records after an account closes or consent is withdrawn.

7.5 Requests concerning an independently controlled clinical record may need to be addressed to the responsible clinic or professional.

7.6 Clinical data must not be used for unrelated employment, insurance, credit, or marketing decisions unless that separate use is independently lawful and transparently disclosed.

8. Location and home visits

8.1 A service address and geographic coordinates may be processed to:

check an approved service-area polygon;
route a request;
support an authorised visit;
provide access instructions; and
manage safety or incident concerns.

8.2 The ordinary home-visit workflow should not require continuous background location tracking unless a separately disclosed feature lawfully requires it.

8.3 Users should provide only location and access information reasonably necessary for the service.

9. Rules and automated processing

9.1 Governed rules may determine operational results such as:

whether a location is within a service area;
whether capacity is available;
whether a required policy has been accepted;
whether manual review is required; or
whether a request fails a safety or eligibility condition.

9.2 Automated results must not replace professional diagnosis or clinical judgement.

9.3 Where applicable law creates rights concerning a decision based solely on automated processing with legal or similarly significant effects, the person may request appropriate information, human review, and an opportunity to contest the result.

10. Recipients

Personal data may be disclosed, where reasonably necessary and subject to appropriate safeguards, to:

the clinic responsible for authorised care;
healthcare professionals involved in authorised care;
authorised clinic or Platform administrators;
authentication, database, hosting, security, communications, monitoring, support, and professional-service providers;
auditors, insurers, lawyers, and other advisers bound by confidentiality;
regulators, courts, law-enforcement bodies, or public authorities where disclosure is lawful or required;
a lawful successor in a corporate transaction, subject to continuing protection; or
another person acting under a valid documented instruction or authority.

A person’s claimed relationship with a clinic is not sufficient by itself. Identity, authority, purpose, and scope must be verified where appropriate.

11. Service providers and sub-processors

11.1 Service providers may process data only for authorised services and under suitable contractual, confidentiality, security, and data-protection obligations.

11.2 Where a service provider processes personal data, the arrangement is expected to identify:

legal entity;
service;
purpose;
data categories;
data-subject categories;
hosting and support locations;
sub-processors;
security controls;
deletion commitments;
transfer mechanism; and
contract status.

11.3 Service providers must not use health or account data for independent advertising.

12. International and cross-border processing

12.1 Platform infrastructure or support services may process data outside the country where a person is located.

12.2 This notice does not name a transfer mechanism, a permit, or a completed processor register.

12.3 Cross-border processing must occur only where permitted by applicable law.

12.4 This notice does not by itself authorise a cross-border transfer.

12.5 A cloud region alone must not be treated as proof of legal authority for a transfer.

13. Retention

13.1 Personal data must be retained only for as long as reasonably necessary for the disclosed purpose and applicable healthcare, legal, professional, tax, accounting, audit, security, complaint, and dispute requirements.

13.2 This notice does not state a fixed retention period. A later version may publish a schedule covering:

unaccepted invitations;
incomplete registrations;
active and closed accounts;
identity and authentication records;
MFA and security events;
memberships and permissions;
service requests and bookings;
clinical assessments and records;
care plans and session records;
clinical documents;
consent and policy acceptance;
communications and complaints;
pricing and transaction evidence;
financial records;
audit and protected-control records;
incidents and breaches;
application logs;
backups; and
legal holds.

13.3 When retention is no longer justified, data must be securely deleted, anonymised, or isolated from ordinary use.

13.4 Account closure does not automatically require deletion of records that must lawfully be retained.

14. Security

14.1 Physiawy uses organisational and technical safeguards appropriate to the nature and risk of the data.

14.2 Safeguards may include:

encryption in transit and at rest;
role-based access;
organisation isolation;
multi-factor authentication;
logging and audit controls;
environment separation;
secure development;
vulnerability management;
malware controls;
backups;
incident response; and
confidentiality obligations.

14.3 No system can guarantee absolute security.

14.4 Users must protect their credentials and devices and report suspected misuse.

14.5 A personal-data breach must be investigated, contained, documented, and notified to the competent authority and affected persons within the periods and manner required by law.

15. Individual rights

Subject to applicable law and lawful exceptions, a person may have the right to:

know whether and why personal data is processed;
access personal data;
receive a copy;
correct inaccurate or incomplete data;
request deletion where continued retention is not lawful or necessary;
withdraw consent where processing relies on consent;
object to or restrict certain processing;
request portability where applicable;
receive relevant information about automated processing;
request human review where applicable;
complain to Physiawy;
complain to the competent data-protection authority; and
exercise a right without unlawful retaliation.

A request may require verification of identity and authority.

Physiawy may retain information reasonably necessary to document the request and response.

If another controller is responsible for the requested record, the request may be directed or referred to that controller.

16. Children and guardians

16.1 A person must be at least 18 years old to independently create and control an account.

16.2 A service involving a minor may be supported only through a verified parent or legal guardian.

16.3 Required guardian authority, consent, child-data safeguards, and clinical controls must be implemented before such a workflow is enabled.

16.4 Until those controls are expressly enabled, Physiawy must not knowingly create an independent minor account or collect a child’s data through an unsupported workflow.

17. Cookies and similar technology

17.1 Strictly necessary technologies may be used for login, security, language, session continuity, and core operation.

17.2 Non-essential analytics, personalisation, or advertising technologies require appropriate notice and consent where required.

17.3 Third-party advertising technology must not use health information or clinical activity for behavioural advertising.

17.4 A separate cookie notice or preference tool should identify enabled technologies where required.

18. Communications and marketing

18.1 Physiawy may send necessary account, security, appointment, clinical-workflow, service, and legal communications.

18.2 Marketing is separate from necessary service communications.

18.3 A person may unsubscribe from marketing without losing necessary service communications.

18.4 Acceptance of healthcare, Terms, Privacy, or clinical consent must not automatically constitute marketing consent.

19. Complaints and regulatory contact

19.1 Privacy questions, personal-data requests, and privacy complaints may be sent to admin@physiawy.com. This version does not publish any other email address or a public telephone number.

19.2 A person may complain to the competent data-protection authority.

19.3 This version does not name a regulator or publish a regulator link.

19.4 A privacy complaint does not remove another remedy available under law.

20. Changes to this Notice

20.1 This Notice is versioned.

20.2 The active version and effective date must be displayed.

20.3 Material changes must be notified as required.

20.4 Fresh consent must be obtained where required by the changed purpose or law.

20.5 Earlier versions and acceptance records may be retained for audit and legal evidence.

21. Contact and company information

Operator: Physiawy LLC

The general public contact is admin@physiawy.com. This version does not publish a registered office, a registration number, a tax number, any other email address, a public telephone number, a named data-protection officer, a licence number, a regulator, a processor register, a transfer mechanism, or a retention period.

Language status

The English text and the Arabic text are intended to carry the same obligations. Neither language prevails over the other. A material inconsistency must be corrected in a later version. This document does not appoint one language as controlling. Withdrawing a privacy consent is not the same act as withdrawing clinical consent.