Scope of this policy
This policy applies to information handled through the website for Dr. Muhammad Ashfaq Ahmed Nadeem, including online consultation requests, appointment coordination, patient review submissions and messages sent through the published contact links. It explains the current website process in plain language for patients in Pakistan.
Physical clinic records or communications handled entirely outside this website may also be subject to the relevant clinic or hospital's own procedures.
Information we collect
The secure online consultation form may collect:
- full name, age, gender, city, mobile number, WhatsApp number and email address;
- consultation reason, symptom or concern description, when the issue began, how it is progressing and an existing diagnosis when provided;
- previous consultation or surgery information, current medicines and other follow-up details when relevant;
- the requested consultation method and consent confirmations;
- medical reports, scans, prescriptions or other files the patient chooses to upload;
- JazzCash sender name and number, transaction ID, payment amount and payment screenshot; and
- submission date, consultation reference, payment status, provisional scheduling information and appointment status.
Please submit only information that is relevant to the consultation request. Do not send banking passwords or unrelated personal files.
The patient review form collects a display name, rating, review message, optional service type, publication consent and submission date. It does not request an email address or medical records.
Patient review moderation and publication
Submitted reviews remain non-public while an authorized administrator assesses them. Approval makes the supplied display name, rating, review message and optional service type visible on the public website. Rejected and pending reviews are not published.
Review authors should not include diagnoses, contact details or other private medical information. The practice may reject a review that contains sensitive information, inappropriate content or content that cannot be published responsibly. Publication consent may be withdrawn by contacting the practice, subject to reasonable verification and any record-retention obligations.
Why information is used
Information is used to receive and review consultation requests, understand the concern described, assess whether an online consultation is appropriate, review submitted reports, manually verify payment, coordinate a provisional time, communicate with the patient, document consent and administer the consultation.
Records may also be used for practice security, troubleshooting, preventing misuse, resolving payment or scheduling disputes and meeting applicable professional or legal responsibilities. Patient information is not sold to advertisers.
Private storage and authorized access
Consultation and review-moderation data is stored in Supabase. Medical reports and payment proofs are placed in private Supabase Storage buckets rather than public website folders. Access to the doctor portal is restricted to authenticated administrative accounts whose email addresses are separately allowlisted by the practice.
Private files are opened through temporary signed access links generated only after the server checks the administrative session. These links expire and are regenerated when required. No internet system can be guaranteed to be completely risk-free, but the website is designed to avoid public file access and unnecessary exposure of sensitive details.
Payment and appointment status
Uploading a JazzCash payment screenshot does not automatically verify payment or confirm an appointment. The practice reviews payment manually. A Calendly selection is provisional until payment and the appointment are confirmed by the practice.
Payment information is used only to match and review the submitted transfer. The website does not ask for a JazzCash password or one-time code.
Services used by the website
- Vercel hosts the website and its server routes.
- Supabase provides the consultation and review databases, administrator authentication and private file Storage.
- Calendly provides provisional online appointment scheduling after a request is saved. The website may prefill the patient's name and email. Symptoms, diagnosis, payment details and uploaded files are not intentionally placed in the Calendly URL.
- JazzCash is used by the patient outside the website for manual payment.
- Google Maps links provide clinic directions.
- WhatsApp, email and telephone links open the relevant external communication service selected by the user.
When a patient chooses to use an external service, that provider's own privacy practices and terms may also apply.
How long records may be kept
Consultation, payment-administration and review-moderation records may be retained for as long as reasonably required to manage the request, support continuity of care, maintain practice security, handle publication decisions or disputes and meet applicable professional or legal requirements. Different information may need different retention periods.
Correction and deletion requests
A patient may ask the practice to correct inaccurate information or request deletion by using the confirmed contact details below. The practice will consider the request where legally and operationally possible. Some information may need to be retained for clinical, payment, security, dispute-resolution or legal reasons, so deletion cannot be guaranteed in every case.
Policy updates and contact
This policy may be updated when the website process, service providers or applicable requirements change. The effective and last-updated dates at the top of this page identify the current version.
For privacy questions or a correction or deletion request, contact the practice at dr.ashfaq2871@gmail.com or +92 300 9729456. Do not include unnecessary medical details in an initial email.