Data Deletion Policy

MUSTABAL SPECIALITY EYE CLINIC respects your right to control your personal data. This Data Deletion Policy explains how patients, website visitors, and any individual whose data we hold can request the permanent deletion of their personal information from our systems. This page also serves as the official data deletion request endpoint required by Meta (Facebook & WhatsApp) platform policies for applications that integrate with Meta's APIs. We are committed to processing all verified deletion requests promptly and transparently.

Upon a verified request, we will delete the following categories of personal data: Patient Identity & Contact Data: • Full name, date of birth, gender, nationality • Phone number, home address, email address • Government-issued ID references WhatsApp & Communication Data: • Your phone number from our WhatsApp notification system • Message logs and communication history stored in our system • Opt-in/opt-out consent records linked to your phone number Account & Portal Data: • Staff or admin portal account credentials (for registered users) • Session logs and access history associated with your account Important Limitations: Due to legal healthcare regulations in Ethiopia and international best practices for ophthalmic care, certain medical and financial records may be subject to mandatory retention periods before permanent deletion is possible. We will inform you of any such limitations when processing your request.

You can request the deletion of your data through any of the following channels: Option 1 — Email Request: Send a written request to: privacy@mustabaleye.com Subject line: "Data Deletion Request" Include: Your full name, phone number on file, and a brief description of the data you wish deleted. Option 2 — In-Person Request: Visit the Mustabal Speciality Eye Clinic administrative office during working hours (Sat–Thu, 8:00 AM – 8:00 PM) and speak to a member of the administrative team. You will be asked to provide identity verification. Option 3 — Phone Request: Call our main hotline at 0975766661 or 0907679268 and ask to speak with the Data Protection Officer. Verbal requests will be followed up with written confirmation for your records. After submitting your request, you will receive a confirmation acknowledgment within 3 working days.

To protect your data and prevent unauthorised deletion requests, we require identity verification before processing any deletion request. For Patients: • Provide the full name and phone number used at registration • Answer one security verification question (e.g., date of last visit, assigned branch) For Staff / Portal Users: • Provide your registered email address and employee ID For Meta / WhatsApp Data Deletion Requests: • Requests originating from Meta's platform will be processed automatically via our secure callback system. No manual verification is required for platform-initiated requests. We will never delete records based on unverified or anonymous requests to protect the integrity of clinical records.

Once your identity has been verified, we will process your deletion request within the following timeframes: • Acknowledgment of request: Within 3 working days • Deletion of WhatsApp / communication data: Within 7 working days • Deletion of personal contact and identity data: Within 14 working days • Deletion of portal account and access logs: Within 14 working days • Medical records (where legally permitted): Within 30 working days You will receive a written confirmation once your data has been successfully deleted. If any portion of your data cannot be immediately deleted due to legal retention requirements, we will inform you of the specific reason and the expected retention end date.

In certain circumstances, we are legally or operationally required to retain data despite a deletion request: Medical Records Retention: Ethiopian healthcare regulations and international ophthalmic standards require us to retain clinical medical records for a minimum of ten (10) years from the date of last clinical contact. This includes diagnoses, prescriptions, surgical notes, and examination results. Financial Records: Financial transaction records, including invoices and payment history, must be retained for a minimum of five (5) years for regulatory audit compliance. Legal Proceedings: If your data is relevant to an ongoing legal dispute, regulatory investigation, or compliance audit, we may be required to retain it until the matter is resolved. In all such cases, we will clearly communicate the retention period to you and will delete the data as soon as the retention obligation expires. Data subject to retention will not be used for any other purpose.

Mustabal Speciality Eye Clinic integrates with the Meta WhatsApp Business API to send patients transactional clinical notifications. In compliance with Meta's Platform Terms and Data Policy, we provide the following data deletion callback endpoint for platform-initiated deletion requests: Callback URL: https://www.mustabalspeciality.com/api/meta/data-deletion This endpoint is designed to receive and process signed data deletion requests from Meta. Upon receiving a valid signed request, our system will: 1. Verify the signed request using our app's secret key 2. Queue the deletion of all data associated with the user's Facebook / Instagram UID 3. Return a confirmation URL where users can check the status of their deletion request 4. Complete the deletion within 30 days as required by Meta's Platform Policy Status Check URL: https://www.mustabalspeciality.com/data-deletion?status=true If you used Facebook or Instagram to interact with our services or pages, you may also submit a deletion request directly through your Facebook account settings under "Apps and Websites".