Privacy Policy

Last updated: 8 October 2026

Effective date: 8 October 2026

In short

Clinics control their patient records. Each Clinic decides what it records about its Patients and why. We store and process that information only to run the Service for the Clinic, on the Clinic's instructions.

We are responsible for account, billing, website and support data. We use it to run accounts, keep the Service secure, bill Clinics and answer questions.

We never sell personal data and we do not show advertising. We do not use Patient Data for marketing.

Where data lives: our main database is hosted in Frankfurt, Germany. Files such as documents and medical images are stored with Cloudflare, which chooses the storage location automatically, so they may be stored outside the European Union. Our AI provider, our waitlist provider and website analytics are based in the United States, and other providers may process data in other countries. We do not store data in Iraq. Section 16 explains these transfers.

The AI Clinic Assistant is optional. It is off until a Clinic switches it on. When it is on, information needed to answer a doctor's request, which can include Patient Data, is sent to an outside AI provider in the United States. It is an assistant, not a doctor.

Deleting a Clinic is not instant. A Clinic scheduled for deletion can be restored for 30 days. After that, its Patient Data, clinical records, files and staff memberships are permanently erased. We keep the Clinic's profile and our own billing records with the Clinic as our financial records. Copies in our database recovery history expire on a short rolling schedule.

Patients exercise their rights through their Clinic. If you are a patient, please contact the clinic that treats you first. We will help the Clinic respond.

Who we are and how to contact us
Our role: controller and processor
What this policy covers
Key terms
The personal data we handle
Where personal data comes from
Why we use personal data and our legal grounds
Health data and other sensitive data
The AI Clinic Assistant
Medical imaging and the imaging viewer
Public prescription verification
Emails and notifications
Cookies and similar technologies
Analytics and error monitoring
Who we share personal data with
International data transfers
How long we keep personal data
Deleting a Clinic, an account or a patient record
How we protect personal data
Security incidents and breach notification
Your rights and choices
Children and minors
Automated decisions and AI
No sale of personal data, no advertising
What we expect from Clinics
Changes to this policy
Contact us and complaints

1. Who we are and how to contact us

Nojdar Clinic is a clinic management service for private clinics and small and medium-sized hospitals in Iraq and the Kurdistan Region of Iraq. It is provided by Nojdar, the operator of the Nojdar Clinic service at nojdar.app ("Nojdar", "we", "us" or "our").

Data protection questions are handled by Nojdar's privacy contact, reachable at support@nojdar.app. You can contact us about privacy, and about anything else, at:

Email: support@nojdar.app

2. Our role: controller and processor

Privacy law usually distinguishes between the organization that decides why and how personal data is used (the controller) and the organization that handles personal data on the controller's behalf (the processor or service provider). Our role depends on the data.

The Clinic is the controller of Customer Data, including Patient Data. A Clinic decides which Patients it registers, what it records about their care, who on its staff can see it, how long it keeps it and whether to use optional features such as the AI Clinic Assistant or imaging uploads. We process Customer Data only to provide the Service to that Clinic, in line with the Clinic's documented instructions (which include the Clinic's use and configuration of the Service, section 17.2 of our Terms of Use and any Data Processing Addendum between us), and as required by law.

Nojdar is the controller of:

Account Data about Authorized Users, which we use to run accounts, sign-in and security, support and billing;
data about Clinics as our customers, such as billing contacts, invoices and payments for the subscription;
data from people who apply for access, join our waitlist or contact us; and
data about Website Visitors to nojdar.app.

3. What this policy covers

This policy explains how we handle personal data when:

you visit our marketing website at nojdar.app;
you join our waitlist, contact us or apply for access for your clinic;
you use the clinic application at clinic.nojdar.app or the imaging viewer at imaging.nojdar.app as an Authorized User;
a Clinic stores information about you as a Patient (or as a patient's relative, emergency contact or payer) in the Service; and
someone checks a printed prescription using its QR code.

This policy is provided for information. Our commitments to Clinics about Customer Data are set out in our Terms of Use and any Data Processing Addendum.

What this policy does not cover. This policy does not replace the privacy notice that each Clinic gives to its own Patients. Each Clinic is responsible for telling its Patients how it collects and uses their information, for having a lawful basis (including any consent required) to record it, and for answering their requests. We are not responsible for the privacy practices of a Clinic, or of any website or service we link to but do not control.

4. Key terms

These terms have the same meaning as in our Terms of Use:

"Service" means the Nojdar Clinic clinic application at clinic.nojdar.app, the imaging viewer at imaging.nojdar.app, the marketing website at nojdar.app, the related application programming interfaces (APIs), emails, generated documents, and any updates to them.
"Clinic" or "Customer" means the organization that holds a Nojdar Clinic account. Each Clinic is a separate account with its own subscription and its own data, even if the same people work at several Clinics.
"Authorized User" means a member of the Clinic's staff who has an account in the Clinic, in any role the Service offers: owner (always held together with the doctor or admin role), doctor, admin, assistant, receptionist, pharmacist, lab technician, finance and auditor.
"Patient" means an individual about whom the Clinic records information in the Service.
"Patient Data" means health and personal data that the Clinic or its Authorized Users enter, upload or generate in the Service about Patients, including medical history, visits, diagnoses, prescriptions, diagnostic results, dental charts, medical images and related billing records.
"Customer Data" means all data that the Clinic or its Authorized Users submit to, store in or generate through the Service, including Patient Data, staff and finance records, files, reports and audit records about the Clinic's activity.
"Account Data" means personal data about Authorized Users that we need to run their accounts, such as name, email address, sign-in credentials, security settings, session and device information, and notification preferences.
"Website Visitor" means a person who uses our marketing website at nojdar.app without signing in to the Service.

5. The personal data we handle

5.1 Website Visitors

Technical data: IP address, browser and device type, pages requested and the time of the request, recorded by our hosting provider when your browser loads the site.
Preferences: your language and theme choice, and your cookie choice.
Analytics data, only if you accept analytics cookies: pseudonymous identifiers and information about how you use the site, collected by Google Analytics (see Section 14).
Error reports: if a page fails, technical details of the error (see Section 14).

5.2 Waitlist subscribers

When you join the waitlist on nojdar.app, we collect your email address, name, preferred language, governorate and type of practice. This information is stored by our email waitlist provider, Kit, which also keeps a record of when and how you joined. We use it only to contact you about setting up your clinic on Nojdar and to tell you when the Service is ready for you. We do not send newsletters to waitlist subscribers.

5.3 People who contact us

When you use the contact form on nojdar.app, we collect your name, email address and message. The message is sent by email to our support mailbox. We do not store contact form messages in our application database. If you email us directly, we receive whatever you include in your email.

5.4 Clinic applicants

When you apply for access at clinic.nojdar.app/request-access, we collect:

required details: clinic name, contact person's name, phone number, email address, country, governorate or city and type of clinic;
optional details: clinic name in Kurdish and Arabic, address, preferred language, preferred currency and any note you add;
review information: the language you used, the status of your application, which member of our team reviewed it, internal review notes and, if it is declined, the reason; and
technical data: your IP address, used to limit repeated submissions; and
acceptance record: when you tick the box agreeing to our Terms of Use and acknowledging this Privacy Policy, we record which documents and versions this covered, the date and time, the email address you gave and that it was given on the application form.

We use this information to assess your application, contact you and, if approved, set up your Clinic. We keep an application even if the Clinic it created is later deleted, and we keep declined applications so that we can recognize a repeat application.

5.5 Authorized Users (Account Data)

Identity and contact: name, email address, username and optional profile photo.
Clinic membership: the Clinics you belong to, your role in each, invitations you sent or received and who invited you.
Sign-in and security: a securely hashed password (never the password itself), passkey public keys, two-factor authentication settings and backup codes, email verification and password reset tokens, session records (including IP address, browser and device information and session expiry), and records of security-related restrictions on an account.
Preferences: interface language, notification preferences and the last Clinic you used.
Activity in a Clinic: actions you take in a Clinic, recorded in that Clinic's audit log with your IP address and browser information (see Section 19), and records of which imaging studies you opened or downloaded. These records are part of the Clinic's Customer Data: the Clinic controls them, its authorized roles can view them, and requests about them should go to the Clinic. We also keep our own security records about sign-ins and sessions.
AI usage: your AI Clinic Assistant conversations and usage counts, if your Clinic has switched the assistant on and your role can use it (see Section 9).
Public items: if you upload a profile photo, it can be loaded by anyone who has its web address, without signing in. Your Clinic's logo is public and is served from cdn.nojdar.app. If you are a prescribing doctor, your name appears on the public prescription verification page (see Section 11).
Acceptance record: when you create your account from an invitation, when you accept an invitation to join another Clinic, and when the clinic app asks you to accept an updated version of our Terms of Use and this policy, we record that you agreed to our Terms of Use and acknowledged this Privacy Policy, with the document versions, the date and time, your email address and which of these it was. We ask again whenever either document changes, and you cannot continue using the clinic app until you do. A Nojdar administrator who signs in to your account to support your Clinic cannot give or record this acceptance for you.
Support communications: messages you exchange with our team.

5.6 Clinics as customers

Clinic profile: clinic name (in English, Kurdish and Arabic), logo, phone, email, address, country, city, type of clinic, time zone, currency, languages and settings.
Subscription and billing: plan, trial and subscription dates, invoices, payments recorded (amount, method, reference and date), charges, agreed prices and any plan limits we have adjusted for the Clinic.
Usage: counts used to apply plan limits, such as number of staff seats, visits per monthly usage cycle, storage used, imaging uploads and AI usage.

At launch, subscription payments are made in cash or by other offline methods and recorded manually by our team. We do not collect payment card details. If we introduce online payment methods, we will update this policy first.

5.7 Patients (Patient Data processed for Clinics)

Depending on how a Clinic uses the Service, Patient Data may include:

Identity and contact: name, patient code, date of birth, gender, national ID number, phone numbers, email address, address, governorate, city, occupation, preferred language and photo.
Emergency contact: the name and phone number of an emergency contact.
Health information: height, weight, body mass index, blood type, chronic diseases, allergies, regular medicines, family medical history, marital status, smoking and drinking habits, pregnancy and breastfeeding status and number of children.
Visits and care: appointments, visit reasons and complaints, history of the present illness, vital signs, examination findings, clinical notes, diagnoses (including ICD-10 codes), procedures, treatments, surgeries, follow-up dates and the doctor responsible.
Prescriptions: medicines, doses, frequency, duration, instructions and dispensing records.
Laboratory and diagnostic tests: requested tests, results, units, reference ranges, abnormal and critical flags, imaging findings and interpretations, and results from outside facilities.
Dental charts: tooth-level dental findings and their history.
Medical imaging: DICOM images and their embedded information (see Section 10) and 3D dental models.
Documents and notes: uploaded attachments, generated PDF documents (prescriptions, invoices, receipts and diagnostic reports) and notes written by clinic staff, some of which may be marked private.
Billing: invoices, payments and refunds, payer names and contact details, and payment references.
Referral: how the Patient heard of the Clinic and who referred them.

5.8 Prospective patients (leads)

A Clinic may record enquiries from prospective patients: name, phone, email, notes, source of the enquiry, status and the staff member following up.

5.9 Other people named in Customer Data

Customer Data may include information about people other than Patients, such as emergency contacts, payers, referring doctors, outside laboratories and suppliers named in clinic expenses. The Clinic is responsible for this information in the same way as for Patient Data.

6. Where personal data comes from

Directly from you, when you fill in a form, join the waitlist, apply for access, create or update your account, or contact us.
From your Clinic, when a Clinic's owner, doctor or admin invites you, assigns you a role or records information about you.
From Clinics about Patients: Patients do not use the Service themselves. All Patient Data is entered or uploaded by a Clinic's Authorized Users, or imported from files (such as DICOM images) that the Clinic uploads.
Automatically, from your browser or device when you use the Service (for example IP address, session and cookie data).
From service providers, such as analytics reports from Google Analytics (only with your consent).

7. Why we use personal data and our legal grounds

For Customer Data, including Patient Data, we act on the Clinic's instructions and the Clinic is responsible for having a lawful basis. For the data we control, we rely on the following purposes and grounds.

To provide the Service under our contract with the Clinic: creating and managing accounts, signing you in, enforcing roles and permissions, storing and displaying Customer Data, generating documents and providing support. Ground: performance of a contract, and our legitimate interest in providing the Service to the Clinic that employs or engages you.
To keep the Service secure and prevent abuse: authentication, two-factor authentication, rate limits on sign-in and forms, audit logs, investigating suspicious activity and protecting against fraud. Ground: legitimate interests (security of the Service and its users), and legal obligation where applicable.
To handle applications and onboard Clinics: reviewing access requests, contacting applicants and setting up approved Clinics. Ground: steps taken at the applicant's request before entering into a contract, and legitimate interests.
To bill Clinics and manage subscriptions: issuing invoices, recording payments, sending renewal and payment notices and keeping accounting records. Ground: performance of a contract and legal obligation (accounting and tax records).
To apply plan limits: counting seats, visits, storage, imaging uploads and AI usage for each Clinic. Ground: performance of a contract.
To send service emails and notifications: sign-in links, password resets, invitations, billing notices, clinic deletion notices and in-app notifications. Ground: performance of a contract and legitimate interests.
To manage the waitlist: contacting you about onboarding. Ground: consent, which you can withdraw at any time.
To answer messages: responding to contact form and support requests. Ground: legitimate interests, or steps at your request before a contract.
To measure website use: Google Analytics on nojdar.app. Ground: consent, given through the cookie banner.
To monitor and fix errors: error and performance monitoring. Ground: legitimate interests in a reliable Service.
To operate and improve the Service: creating statistics about how the Service is used (for example, how often a feature is used, error rates, storage volumes and performance) that do not identify any Patient, Authorized User or Clinic, and using them to plan capacity, fix problems and improve features. Where these statistics are derived from Customer Data, the Clinic authorizes this under section 9.4 of our Terms of Use. Ground: legitimate interests.
To keep a record of acceptance of our terms: recording which versions of our Terms of Use an applicant or Authorized User agreed to, and which version of this policy they acknowledged, and when. Ground: legitimate interests (being able to show what was agreed), and performance of a contract.
To comply with law and protect rights: responding to lawful requests from authorities, enforcing our Terms of Use and defending legal claims. Ground: legal obligation and legitimate interests.

Where we rely on legitimate interests, we have considered your interests and rights and believe they are not overridden. You can object (see Section 21).

8. Health data and other sensitive data

Patient Data includes health information, which is especially sensitive. We handle it only as the Clinic's processor:

We process Patient Data only to provide the Service to the Clinic that entered it, and not for our own purposes. We do not use Patient Data for marketing, advertising, profiling or sale, and we do not use it to train AI models.
Patient Data is separated by Clinic. Each Clinic's data is scoped to that Clinic in the database, in every server-side request and in the user interface, so one Clinic's users cannot see another Clinic's data.
Within a Clinic, access depends on each Authorized User's role, as configured in the Service.
Our personnel can access Customer Data only where necessary to provide support requested by the Clinic or its users, keep the Service secure and working, or comply with law (see Section 15.2).
Everyone at Nojdar who may access Customer Data is bound by a written duty of confidentiality, equivalent to the duty of medical secrecy that binds the Clinic's own staff, that continues after their work for us ends, and is instructed on handling health data.
Emails we send are designed not to contain Patient health information (see Section 12).

The Clinic decides what health information to record and is responsible for having a lawful basis (for example, the provision of medical care, or the Patient's explicit consent where required) and for meeting any medical confidentiality rules that apply to it.

9. The AI Clinic Assistant

9.1 What it is

The AI Clinic Assistant is an optional feature on some plans. It lets a doctor ask questions in plain language (for example, "who is in today's queue?" or "what is outstanding this month?") and, with the doctor's confirmation, carry out a limited set of routine actions such as booking, rescheduling or cancelling an appointment, marking a patient as arrived, creating a follow-up visit, creating a lead or adding a note to a patient's record.

It is off by default. A Clinic's doctor or admin must switch it on.
Only the doctor role can use it. It works only within the permissions of the doctor using it and only for that doctor's Clinic.
Every action requires the doctor's explicit confirmation before anything is changed, and confirmed actions are recorded in the Clinic's audit log as taken by the doctor with the assistant's help.
The assistant cannot delete records, change staff or roles, change billing, settings, fees or payments, or export data in bulk.

9.2 What information is sent to the AI provider

When a doctor uses the assistant, we send the following to our AI provider to generate a reply:

the conversation so far, up to the most recent 40 messages: the doctor's own messages (including anything the doctor types, which may include Patient Data), the assistant's earlier replies and the results of earlier lookups;
basic context: the Clinic's name, time zone, currency, the current local date and time, and the doctor's interface language;
the results of the information lookups the assistant performs. These results are deliberately limited, but they can include Patient Data, including health information. Typical lookups return:
- Patient lookups: the patient code, name, the last four digits of the phone number, gender, date of birth, governorate and blood type, and a short list of recent visits.
- Visit and appointment lookups: dates, times, visit type, the stated reason for the appointment, status, room, follow-up date, cancellation reason and fee.
- Queue, room, appointment, prescription and diagnostic lookups: these include patient names and codes.
- Prescription worklists: prescription numbers and status counts, not medicine names.
- Diagnostic worklists: the names of requested tests, their priority and whether a result is critical. Test names can reveal information about a Patient's health.
- Financial lookups: revenue, expense and outstanding-balance summaries, which may name Patients.
Lookup results do not include clinical notes, examination findings or diagnoses, and the number of records returned at once is capped; and
when the doctor asks the assistant to add a note to a patient's record, or to create or change an appointment, follow-up visit or lead, the content of that note or record.

When the assistant is switched off, nothing is sent to the AI provider.

9.3 Who the AI provider is

We access AI models through OpenRouter, Inc. (United States), which routes each request to a model provider. We currently use models developed by Anthropic (for example, Claude), served through a cloud platform that hosts Anthropic models, such as Google Vertex AI or Amazon Bedrock. These providers process the information only to generate the reply. OpenRouter keeps metadata about each request (such as the time, model and amount of usage) to bill us and prevent abuse.

Training and retention. We do not use Customer Data to train AI models. Every assistant request is sent with settings that instruct OpenRouter to route it only to endpoints that, under their published policies, do not retain prompts or replies after responding (zero data retention) and do not use submitted data to train models. If no endpoint that meets those conditions is available, the request fails instead of being sent to one that does not.

9.4 Conversations and usage records

Conversations are stored in our database so the doctor can return to them. When a doctor removes a conversation, it is hidden from the doctor but kept in our database until the doctor's account or the Clinic is permanently deleted, or until we introduce a retention period, which we will announce in this policy first.
We keep usage records (such as the number of tokens used, the model and the user) to apply plan limits and fair-use quotas.
Our server logs and error monitoring record only technical information about assistant requests, not the content of conversations.

9.5 The assistant is not a clinician

The assistant is a productivity tool for retrieving information and handling routine scheduling and administrative tasks. It does not diagnose, recommend treatment, prescribe or provide clinical decision support, and it may make mistakes. Authorized Users must check its output and remain fully responsible for all clinical and administrative decisions. See also Section 23.

10. Medical imaging and the imaging viewer

Uploaded studies. On plans that include imaging, a Clinic can upload medical images (DICOM studies) and 3D dental models. Imaging files are stored in private storage and delivered only through short-lived, signed links (valid for up to 60 minutes) after the Service checks the user's Clinic and permissions. The viewer at imaging.nojdar.app uses a short-lived access cookie (60 minutes) for each study.

Original files are stored unchanged. DICOM files often contain identifying information in their tags, such as the patient's name, ID, date of birth and sex, and the names of the referring doctor and facility. We do not remove or alter this information. The Service also copies some of these tags into the database to help the Clinic match a study to the right Patient. Clinics should make sure they upload only studies they are entitled to hold.
Access is restricted and logged. Clinic admins cannot open or download imaging studies. Each time a study is opened or downloaded, the Service records who did it and when, and this record is available to the Clinic.
Temporary files. To open a study, the Service creates a temporary file describing where its images are. These files are deleted automatically, normally within about 36 hours.
Deleting a study. Removing a study first hides it. A Clinic can then permanently delete it, which deletes the files and is recorded in the audit log.

Local viewing. The imaging viewer can also open files from your own device without uploading them. In local mode, the files stay on your device and are not sent to us.

We do not use imaging data for AI analysis or for any purpose other than storing and displaying it for the Clinic.

11. Public prescription verification

Each prescription PDF generated by the Service includes a QR code that links to a public verification page on clinic.nojdar.app. Anyone who scans the code (for example, a pharmacist) can check that a prescription with that number was issued through the Service. The page shows:

the Clinic's name and logo;
the prescription number and issue date;
the prescribing doctor's name;
a partly hidden patient code (for example, P-•••42); and
whether the prescription is valid.

The page does not show the patient's name, the medicines or any diagnosis. The page is excluded from search engines and is rate-limited to prevent automated scanning. Anyone holding the printed prescription or its QR code can see the information above, so Patients and Clinics should treat printed prescriptions as confidential documents.

12. Emails and notifications

We send emails through our email delivery provider, Plunk, from no-reply@nojdar.app under the name "Nojdar Clinic". Emails include:

account and security emails: sign-in links, password resets, email address verification, welcome emails and clinic invitations (which include the Clinic's name);
application emails: confirmation that we received an access request, and the outcome;
billing emails: invoices issued, payments received and subscription notices (expiring, expired or read-only), which include the Clinic's name, plan, amounts, invoice numbers and dates;
clinic deletion emails: notice to the Clinic's owner, doctor and admins that the Clinic has been scheduled for deletion or restored; and
notification emails: copies of in-app notifications, such as a critical laboratory value, a report being ready, plan usage or a product update. They are designed to contain only a short title and a link, and never results, diagnoses or other Patient health information. A report-ready email includes the report title chosen by the Clinic, so Clinics should not put Patient names in report titles.

You can turn off email copies of most in-app notifications, including invoice, payment, subscription-expiry and plan-usage emails, in your notification settings. Sign-in, password reset, email verification, invitation and clinic deletion emails, and the notice that a Clinic has become read-only, cannot be turned off while you have an account.

Our email provider processes recipient addresses, names and email content in order to deliver emails, and may keep delivery records and a contact record for each recipient. Our hosting logs also record the recipient address and subject of emails we send.

We do not contact Patients. The Service does not send emails, SMS or other messages to Patients.

13. Cookies and similar technologies

Cookies are small files stored by your browser. We also use your browser's local storage for a few preferences. We do not use advertising cookies on any part of the Service.

13.1 Marketing website (nojdar.app)

Strictly necessary and functional (set without consent because they are needed to run the site or remember a choice you made): consent records for 180 days whether you accepted or declined analytics (it is set whichever you choose); NEXT_LOCALE remembers your language; local storage remembers your light or dark theme.
Analytics (only if you accept): _ga and cookies beginning with _ga_ are set by Google Analytics to distinguish visitors and sessions. They last up to two years under Google's default settings. Google Analytics keeps event data for 2 months under our settings, and we have switched off Google's data sharing settings.

Google Analytics does not load until you click to accept analytics cookies. If you decline, it does not load, and if you later withdraw consent, we delete the Google Analytics cookies we can reach and reload the page. You can change your choice at any time through the "Cookie settings" link in the website footer.

13.2 Clinic application (clinic.nojdar.app)

The clinic application uses only cookies and storage that are necessary for it to work or that remember your choices:

sign-in session cookies that keep you signed in (up to 30 days, or until you sign out), a short-lived copy of session information (about 5 minutes) that speeds up pages, and a cookie that respects your choice not to be remembered on a device;
security cookies used during two-factor authentication (including a "trusted device" cookie if you choose to trust a device) and passkey sign-in;
NEXT_LOCALE for your language, and sidebar-collapsed for your sidebar layout; and
local storage for your light or dark theme.

The clinic application does not use analytics or advertising cookies. These cookies are strictly necessary to provide the clinic application you have signed in to, or store choices you made (language, sidebar layout, theme), so we do not ask for consent. If you block them, you will not be able to sign in.

13.3 Imaging viewer (imaging.nojdar.app)

The viewer sets short-lived access cookies (nv_gate_study, nv_gate_local and nv_gate_model) that let your browser load a study, a local session or a 3D model. They expire after 60 minutes and cannot be read by scripts. The viewer may also store display preferences in your browser's local storage.

13.4 Files served from cdn.nojdar.app

Our storage provider, Cloudflare, may set security cookies (such as __cf_bm) to distinguish people from automated traffic.

14. Analytics and error monitoring

Google Analytics (marketing website only, with consent). We use Google Analytics 4 to understand how visitors use nojdar.app. We have configured it with advertising features off: advertising storage, ad personalization and Google signals are disabled. Google processes this data as our service provider and under its own terms. The clinic application and the imaging viewer do not use Google Analytics.
Sentry (marketing website and clinic application). We use Sentry to detect and fix errors and performance problems. Error reports contain the error message and technical details, the page path (without query strings) and your browser type. Before error reports leave our systems or your browser, we remove cookies, authorization headers, referrer addresses, forwarded IP addresses, web address query strings, click and input details and database query arguments, and we do not use session replay. Error reports can occasionally contain fragments of the data being processed when the error happened, which may include Customer Data; we limit this with the filtering above, and access to error reports is restricted to our engineers. Sentry does not set cookies. On the marketing website, error monitoring runs without asking for consent because it does not store or read anything on your device and is needed to keep the website working; it relies on our legitimate interests. Error reports are stored in Sentry's European Union region (Frankfurt, Germany), and we have configured Sentry not to store the IP address of the device that reported an error.

15.1 Service providers (sub-processors)

We use the following service providers to run the Service. Providers marked "Customer Data: yes" may handle Patient Data on our behalf; our contracts with them require them to process it only to provide their service to us, keep it confidential and secure, and help us meet our obligations. Some providers also use limited information for their own purposes under their own terms, for example to bill us, prevent abuse or meet legal obligations; where this applies we say so below.

Vercel Inc.

Purpose: hosting and running the clinic application, the imaging viewer and the marketing website, and delivering pages through its network.
Data: all data passing through the Service in transit, and server logs (which can include IP addresses, pages requested, email recipients and error messages).
Customer Data: yes (in transit and in logs).
Location: application functions run in Frankfurt, Germany; content is delivered through a global network; Vercel is a United States company that runs on Amazon Web Services, and its runtime logs may be stored outside the European Union.

Neon (neon.com)

Purpose: our main database and its short rolling recovery history. Neon runs on Amazon Web Services.
Data: all Customer Data, Account Data, billing data and application data stored in our database.
Customer Data: yes.
Location: Frankfurt, Germany (AWS eu-central-1).

Cloudflare, Inc. (R2 storage)

Purpose: storing files, including attachments, generated PDFs, medical imaging, 3D models, profile photos and clinic logos. Public files (such as clinic logos) are served from cdn.nojdar.app.
Data: files uploaded or generated in the Service, which may include Patient Data.
Customer Data: yes.
Location: chosen automatically by Cloudflare, with no regional guarantee, so files may be stored outside the European Union; Cloudflare is a United States company.

Plunk (useplunk.com)

Purpose: sending service emails. Plunk delivers messages through Amazon Simple Email Service (Amazon SES), which handles them in transit.
Data: recipient names and email addresses, email content (sign-in links, invitations, billing, deletion and application emails, contact form messages). Plunk may keep delivery records and a contact record for each recipient.
Customer Data: no Patient health information; Account Data and email content.
Location: European Union (Germany), with Amazon SES delivering messages in transit.

Zoho Corporation (Zoho Mail)

Purpose: our support mailbox, which receives contact form messages and support emails.
Data: names, email addresses and the content of messages.
Customer Data: only what a Clinic chooses to include in a support email.
Location: Zoho Mail EU data center.

Functional Software, Inc. (Sentry)

Purpose: error and performance monitoring.
Data: filtered technical error reports (see Section 14).
Customer Data: yes (occasional fragments, see Section 14).
Location: Sentry's European Union region (Frankfurt, Germany). IP addresses are not stored. Sentry is a United States company.

OpenRouter, Inc. and the AI model provider it routes to (currently Anthropic models served through a cloud platform such as Google Vertex AI or Amazon Bedrock)

Purpose: generating AI Clinic Assistant replies, only for Clinics that have switched the assistant on.
Data: as described in Section 9.2. Requests are routed only to endpoints that do not retain prompts or replies after responding and do not train on them (see Section 9.3). OpenRouter keeps request metadata for billing and abuse prevention under its own terms.
Customer Data: yes.
Location: United States (OpenRouter is a United States company); the model provider processes requests in the regions of the cloud platform serving the model.

Google LLC (Google Analytics)

Purpose: website analytics on nojdar.app, only with consent.
Data: pseudonymous identifiers, page views and device information.
Customer Data: no.
Location: United States and other countries where Google operates.

Kit (ConvertKit LLC)

Purpose: managing the waitlist.
Data: email address, name, preferred language, governorate and type of practice.
Customer Data: no.
Location: United States.

This list was last updated on 7 October 2026. We will tell Clinics in advance before adding or replacing a provider that processes Customer Data, as set out in section 17.2.5 of our Terms of Use.

15.2 Nojdar personnel and support access

A small number of authorized Nojdar staff (platform administrators) use an administration console to manage Clinics, users, applications, plans, invoices and payments.

To provide support, a platform administrator may temporarily sign in as a specific Authorized User ("support access") and see what that user can see, including Patient Data. We use support access only:

(a) at the request of that user or the Clinic;
(b) where it is necessary to investigate or fix a security incident, a serious technical problem or suspected misuse of the Service affecting the Clinic, in which case we will tell the Clinic afterwards where the law and the investigation allow; or
(c) where the law requires it.

Our staff do not create, change or delete clinical records during support access unless the Clinic has asked them to in writing. Platform administrators must use two-factor authentication and are bound by written confidentiality obligations.

Support access is recorded in our own records with the administrator's name, the user and the time, and is marked as support access in the Clinic's audit log. The start of each support sign-in, and its end when the administrator ends it, are recorded in the audit log of every Clinic the user belongs to, under the administrator's name. Changes the audit log records during support access are recorded under the name of the user whose account is being used and are labeled as support access, with the administrator's name. On request, we will tell a Clinic when support access to its account took place, where our records allow.

15.3 Within a Clinic

Information an Authorized User records in the Service is visible to other Authorized Users of the same Clinic according to their roles. Each Clinic controls who it invites and which roles they hold. If you are an Authorized User, the Clinic can see your name, email address, role and the audit log entries for your actions. We may share information about your use of a Clinic's account with that Clinic where needed to investigate misuse or a security incident.

15.4 Legal requirements and protection of rights

We may disclose personal data if we believe in good faith that it is required by law, regulation, court order or a binding request from a competent authority, or necessary to protect the rights, property or safety of Nojdar, our users, Patients or the public. We review each request for legal validity, ask the requester to approach the Clinic directly where possible, and disclose only the minimum required. Where we receive a request for Customer Data, we will, where legally permitted, notify the Clinic so that it can respond or seek protection.

15.5 Business transfers

If Nojdar is involved in a merger, acquisition, financing or sale of all or part of its business, or the Nojdar Clinic business is transferred to a company formed to carry it on, personal data may be transferred as part of that transaction, subject to this policy and to the Clinic's agreement with us. We will notify affected Clinics before Customer Data becomes subject to a different privacy policy.

15.6 Professional advisers and insurers

We share information with our lawyers, accountants, auditors and insurers, under duties of confidentiality, where needed for advice, audits, insurance or legal claims. We share Patient Data with them only where needed to defend a legal claim or where the law requires it.

16. International data transfers

The Service is offered to Clinics in Iraq and the Kurdistan Region, but we do not store data in Iraq. Our main database is hosted in Frankfurt, Germany. Requests from your browser may first be handled by our hosting provider's servers in a location near you before being processed in Frankfurt. Some of our service providers are based in, or may process data in, the United States or other countries (see Section 15.1), including our file storage provider (whose storage location is selected automatically), our AI provider, our waitlist provider and website analytics.

When personal data is transferred to another country, we take steps to protect it, such as choosing reputable providers, signing data processing agreements with our providers, using standard contractual clauses or similar safeguards where the law that applies to a transfer requires them, choosing EU data locations where we can, and limiting the data we send (for example, the limited information sent to the AI provider described in Section 9.2).

By subscribing, a Clinic instructs us to host and process Customer Data, including Patient Data, outside Iraq as described in this policy. The Clinic is responsible for confirming that this is permitted for its records under the laws and professional rules that apply to it.

17. How long we keep personal data

We keep personal data only for as long as needed for the purposes described in this policy, unless a longer period is required by law or needed to resolve disputes or enforce our agreements.

Customer Data (including Patient Data): for as long as the Clinic's account exists. Removing a record in the Service (for example a patient, visit, prescription or invoice) hides it rather than erasing it, which protects medical records against accidental loss. The Clinic decides how long to keep its records, subject to the laws that apply to it.
Lapsed subscriptions: if a Clinic's trial or subscription ends without renewal, the Clinic's account becomes read-only. We do not delete a Clinic's data just because its subscription has lapsed, so that the Clinic can renew or export its records. If a Clinic remains read-only for more than 12 months, we may charge a storage fee or end the Clinic's account, but only after writing to the Clinic Owner and the Clinic's contact email at least 90 days, and again 30 days, before we act (see section 7.6.3 of our Terms of Use). If the account is ended, the Clinic first gets a read-only export window and then the 30-day deletion process described in Section 18.
Deleted Clinics: kept, closed, for 30 days after deletion is scheduled so that the Clinic can be restored. The Clinic's Customer Data is then permanently erased, normally within one day, except the Clinic's profile and our own billing records with the Clinic, which we keep as described below (see Section 18).
Audit logs and imaging access logs: for as long as the Clinic's account exists, because they form part of the Clinic's record of who did what. They are erased when the Clinic is permanently deleted, or erased or anonymized earlier only on the Clinic's instruction (see Section 18). The audit entries that record changes to the Clinic's profile (including who scheduled its deletion) and to our own billing records with the Clinic are kept with those records.
Account Data: for as long as your account exists. When an account is deleted, see Section 18.
AI Clinic Assistant conversations and usage records: see Section 9.4.
Clinic profile and platform billing records: the Clinic's profile (its name, contact details, address, logo and settings) and our own billing records with the Clinic (its subscription, the invoices we issued to it, the payments we received, any prices, plan limits or imaging allowances we agreed with it, and the audit entries for all of these) are Nojdar's financial records. We keep them while the Clinic's account exists and, after the Clinic is permanently deleted, for 7 years or any longer period required by accounting and tax law. They do not include Patient Data.
Records of acceptance: records of which versions of our Terms of Use were agreed to and which version of this policy was acknowledged, when and with which email address, for as long as the related application, account or Clinic relationship exists and afterwards for as long as needed to establish, exercise or defend legal claims.
Access applications: kept after a decision, including after the Clinic is deleted, so that we can recognize repeat applications. We review these records at least once a year and delete those older than 24 months after a decision, unless they relate to a current customer.
Waitlist data: until you unsubscribe, ask us to delete it or your Clinic is onboarded. We review the waitlist at least once a year and remove entries older than 12 months after the Service became available to the person.
Support and contact messages: we review our support mailbox at least once a year and delete messages older than 24 months after the conversation ended, unless we need them for a dispute.
Security records: session records, including IP address and browser information, are kept until the session expires or you sign out, and for a period after that while needed to protect the Service. Rate-limit records that include IP addresses are kept while needed to protect the Service. We review these records periodically and delete those no longer needed.
Server logs and error reports: for the retention periods set by our hosting and monitoring providers, currently no more than 90 days.
Backups and recovery history: our database provider keeps a short rolling recovery window of our database (at launch, a matter of hours), which we expect to extend as the Service grows. Deleted data can remain in this recovery history until it rolls off. We use it only to restore the Service after an incident.
Short-lived items: signed file links expire within 15 to 60 minutes, imaging viewer access cookies within 60 minutes, and temporary imaging files are deleted within about 36 hours.

18. Deleting a Clinic, an account or a patient record

Deleting a Clinic. The Clinic Owner, the doctor or an admin of a Clinic can schedule the Clinic for deletion in its settings, or the Clinic can ask us to. We may also schedule a Clinic for deletion after ending its account under our Terms of Use. The Clinic then closes for all its users and enters a 30-day deletion period, and we email the Clinic's owner, doctor and admins. During this period the Clinic cannot be used or exported, but the Clinic Owner, doctor or an admin can restore it in full from the Clinic's closed screen, or by contacting us. A Clinic that needs to export records during this period can restore the Clinic, export them and schedule the deletion again.

After 30 days, normally within one day, we permanently erase the Clinic's Patient Data and clinical records, its stored files (including attachments, the PDFs it generated and medical imaging), the invoices and payments between the Clinic and its Patients, its leads, expenses, reports and AI Clinic Assistant conversations, its staff memberships and pending invitations, and its audit log (except the entries we keep, described below). We also remove in-app notifications that link to the Clinic from its former staff members' accounts. We keep the Clinic's profile (its name, contact details, address, logo and settings) and our own billing records with the Clinic (its subscription, the invoices we issued to it, the payments we received, any prices, plan limits or imaging allowances we agreed with it, and the audit entries for these records and for changes to the profile, including who scheduled the deletion), because they are Nojdar's financial records, which we must keep for as long as the law requires (see Section 17). If the Clinic confirms in writing that its data must be erased sooner (for example, to comply with a legal erasure request), we may complete the deletion of a Clinic already scheduled for deletion before the 30 days end. Copies in our database recovery history are deleted as it rolls off (see Section 17). Before scheduling deletion, the Clinic should export the records it needs (see Section 21.4).

Deleting a Clinic removes its staff members' memberships of that Clinic but does not delete their personal accounts, which they may use with other Clinics. Each person can delete their own account.

Deleting your account. You can delete your Authorized User account from your account settings, or ask us to. Deleting your account removes your sign-in details, sessions, passkeys and two-factor settings, Clinic memberships, invitations you sent, notifications, and your AI Clinic Assistant conversations and usage records. Records you created in a Clinic (for example, visits or notes) belong to the Clinic and remain, and the Clinic's audit log keeps an internal identifier for you so that its record of past actions stays complete. In some cases, an account linked to clinical records (for example, dental chart entries) cannot be deleted until the Clinic or we reassign or resolve them. Your profile photo may remain in our file storage after your account is deleted; ask us and we will remove it.

Patient records. Patients' records are controlled by the Clinic. Removing a patient in the Service retires the record rather than erasing it.

Information about a Patient can also appear in other parts of the Clinic's account:

the audit log, which keeps snapshots of changed records such as names, phone numbers, dates of birth and clinical notes;
the imaging access log;
generated PDF documents and uploaded files;
medical images;
saved report results; and
AI Clinic Assistant conversations.

If a Clinic instructs us in writing to permanently erase a Patient's data, for example to honor a valid request under applicable law, we will do so within 30 days where permitted by law. We will erase or irreversibly anonymize that Patient's data in all of these places, including audit log snapshots, keeping only a minimal record that an erasure took place on the Clinic's instruction. Copies in backups are deleted when those backups expire. The Clinic is responsible for deciding whether erasure is lawful, taking into account any legal duty to keep medical records. Where the work goes beyond what the Service supports, we may charge a reasonable fee agreed with the Clinic in advance.

19. How we protect personal data

We use technical and organizational measures designed to protect personal data, including:

Separation between Clinics: every request is checked against the user's Clinic membership, role and subscription on the server, and database queries are limited to the user's Clinic.
Role-based permissions: each role can do only what it needs, enforced on the server, not just hidden in the interface.
Audit logging: changes to important records are recorded in an audit log in the same database transaction as the change, together with the user, role, time, IP address and browser information. Clinics cannot edit or delete audit entries. We erase or anonymize audit entries only on a Clinic's instruction to comply with law. Audit entries include snapshots of the changed information, which may include Patient Data, so access to the audit log is limited to authorized roles.
Account security: hashed passwords with a minimum length, rate limits on sign-in, password reset, magic link and two-factor attempts, optional two-factor authentication and passkeys for all Authorized Users, mandatory two-factor authentication for platform administrators, and the ability to see and revoke active sessions. Resetting a password signs out other sessions.
File protection: patient files are stored in private storage and are available only through short-lived signed links after a permission check. Uploads are limited to approved file types and sizes.
Encryption in transit: all connections to the Service use HTTPS (TLS), with strict transport security.
Encryption at rest: our database and file storage providers encrypt stored data on their systems.
Browser protections: security headers that prevent the Service being framed by other sites and restrict browser features.
Error monitoring with data filtering (see Section 14).
Personnel: access to production systems is limited to authorized personnel who need it, who are bound by confidentiality.

No system is completely secure. We cannot guarantee that personal data will never be accessed, disclosed or lost without authorization, but we work to prevent it and to respond quickly if it happens. Clinics and Authorized Users also play a part: see Section 25.

20. Security incidents and breach notification

If we become aware of a breach of security that leads to the accidental or unlawful destruction, loss, alteration, unauthorized disclosure of, or access to, Customer Data that we or our sub-processors process, we will:

notify the affected Clinic without undue delay and, where feasible, within 72 hours after becoming aware of it;
provide the information reasonably available to us about the nature of the incident, the categories of data and people affected, the likely consequences and the measures taken or proposed, in stages if it is not all available at once; and
take reasonable steps to contain the incident, reduce its effects and prevent it from happening again, and keep a record of it.

Because the Clinic controls Patient Data, the Clinic is responsible for deciding whether to notify Patients or authorities, and we will provide reasonable help. We will not notify Patients or authorities on the Clinic's behalf without the Clinic's agreement unless the law requires us to. Where an incident affects data we control (such as Account Data), we will notify affected people and authorities where the law requires it. If a breach affecting data we control is likely to result in a high risk to you, we will tell you without undue delay, explain what happened and what you can do to protect yourself.

21. Your rights and choices

21.1 Your rights

Depending on the law that applies to you, you may have the right to:

access the personal data held about you and receive a copy;
correct inaccurate or incomplete data;
delete your data, where there is no overriding reason to keep it (for example, a legal duty to keep medical records);
restrict or object to certain processing, including processing based on legitimate interests;
data portability: receive data you provided in a commonly used format;
withdraw consent at any time where we rely on consent (for example, for analytics cookies or the waitlist), without affecting earlier processing; and
complain to a supervisory authority (see Section 27).

We will consider any request about personal data we control in good faith, whether or not a specific law requires it, subject to legal and practical limits. For Patient Data, which the Clinic controls, see Section 21.2.

21.2 If you are a Patient

Your clinic controls your records in Nojdar. To access, correct, delete or obtain a copy of your information, please contact the clinic that treats you. If you contact us instead, we will, where we can identify the Clinic, forward your request to it within 5 business days and tell you that we have done so. We will help the Clinic respond, but we cannot act on your records without the Clinic's instructions unless the law requires us to.

If the clinic that treated you has closed, cannot be contacted or no longer uses Nojdar, contact us at support@nojdar.app. We will tell you what we can, for example whether the clinic's account still exists, and where the law allows we will try to put you in touch with the person responsible for the clinic's records. We will not disclose or change your records without the clinic's instructions unless the law requires or permits us to.

21.3 If you are an Authorized User, applicant, subscriber or Website Visitor

You can update your name, email address, photo, language, password, two-factor settings, passkeys and notification preferences in your account settings, and see and sign out of your active sessions.
You can delete your account in your account settings.
You can change your cookie choice on nojdar.app using "Cookie settings" in the footer.
You can leave the waitlist using the link in our emails or by contacting us.
For anything else, email support@nojdar.app.

Some information about you as an Authorized User (for example, entries in a Clinic's audit log, or clinical records you created) belongs to the Clinic's records. Requests about it may need to go through the Clinic.

21.4 For Clinics: exporting data

While its account is open, including when it is read-only after a subscription lapse (but not while it is scheduled for deletion), a Clinic can export its data through the Service: lists of patients, appointments and visits, invoices, payments, expenses, leads, prescriptions and diagnostics as CSV files (up to 50,000 rows per export), reports as CSV, the audit log as CSV on plans that include it, individual documents as PDFs, and imaging studies as files in their original DICOM format. The Service does not currently provide a single complete export of a Clinic's data or exports in health-data exchange formats (such as HL7 or FHIR). On request, we will provide any Clinic's audit log as a CSV file, whatever its plan, before the Clinic is deleted. On request, we will also provide reasonable assistance with Customer Data that cannot be exported through the Service, and we may charge a reasonable fee, agreed in advance, for extensive requests.

21.5 How we handle requests

We will respond within 30 days and tell you if we need more time. We may need to verify your identity before acting, and we may refuse requests that are manifestly unfounded, excessive or would affect the rights of others, explaining why where the law allows. We do not charge for reasonable requests about personal data we control.

22. Children and minors

The Service is a professional tool for clinic staff. It is not directed at children, and Authorized Users must be at least 18 years old. We do not knowingly collect personal data from children through the marketing website, the waitlist or applications.

Patients of a Clinic may include children and other people who cannot consent for themselves. The Clinic is responsible for obtaining any consent required from a parent, guardian or other legal representative, and for handling their records in line with the law.

If a Clinic switches on the AI Clinic Assistant, information about Patients who are children may be sent to the AI provider in the same way as for adult Patients (see Section 9.2). Clinics should take this into account when deciding whether to switch the assistant on and when informing parents and guardians.

23. Automated decisions and AI

We do not make decisions about individuals based solely on automated processing that produce legal effects or similarly significant effects on them.

The AI Clinic Assistant only answers questions and proposes routine actions. Nothing is changed without a doctor's explicit confirmation, and clinical decisions always remain with the Clinic's professionals. The assistant is not used to make any decision about a Patient.
Subscription status is calculated automatically from a Clinic's trial and subscription dates and the payments we have recorded. When a subscription lapses, the Clinic's account automatically becomes read-only. This affects the Clinic's access to the Service, not the rights of Patients. If a Clinic believes its status is wrong, it can contact us and a member of our team will review it.
Security controls such as rate limits may automatically delay or block repeated attempts. Contact us if you believe you have been blocked in error.

24. No sale of personal data, no advertising

We do not sell personal data, rent it or share it with third parties for their own marketing or advertising. We do not show advertising in the Service, we do not use Customer Data for advertising or to build marketing profiles, and we do not use Customer Data to train AI models.

25. What we expect from Clinics

Because the Clinic is the controller of Patient Data, each Clinic is responsible for:

telling its Patients how their information is used, including that it is stored in the Service and processed by our service providers outside Iraq (and, if the Clinic switches it on, sent to AI providers in the United States), and obtaining any consent required by law (including from parents or guardians);
recording only the information it needs and is entitled to hold, and keeping it accurate;
deciding whether to switch on optional features such as the AI Clinic Assistant and imaging uploads, and training its staff to use them appropriately;
inviting only appropriate staff, assigning the right roles, removing access promptly when staff leave and encouraging staff to use two-factor authentication;
telling its staff that their activity in the Service, including IP address and device information, is recorded in the audit log and may be reviewed by the Clinic;
contacting prospective patients (leads) only in line with the law on direct marketing and with their agreement where required;
keeping printed and exported records (PDFs, CSV files and DICOM downloads) secure once they leave the Service;
answering requests from its Patients; and
keeping its records for as long as the law requires, including exporting them before deleting its account, and telling us who is responsible for its records if it closes.

26. Changes to this policy

We may update this policy to reflect changes in the Service, our service providers or the law. We will post the updated policy on this page with a new "Last updated" date. If a change materially affects how we process Customer Data or personal data we control, we will give Clinics at least 30 days' notice by email or in the Service before it takes effect, unless a shorter period is required by law or for security reasons. When a new version takes effect, the clinic app asks each Authorized User to acknowledge it, and we record that acknowledgement as described in Section 5.5. We keep previous versions of this policy and will provide them on request.

27. Contact us and complaints

If you have a question or concern about this policy or our handling of personal data, please contact us first:

Email: support@nojdar.app

We will try to resolve your concern. If you are a Patient, please also contact your clinic. If you are not satisfied, you may have the right to complain to a data protection or other competent authority where you live or work. If you are in the European Union or European Economic Area, you can complain to your local data protection authority.

Contents