Privacy Policy

MUSTABAL SPECIALITY EYE CLINIC ("we", "our", or "the clinic"), is committed to protecting the privacy and confidentiality of every patient and website visitor. This Privacy Policy explains what personal data we collect, how we use it, who we share it with, and what rights you have over your information. This policy applies to all personal data collected through our clinic registration system, website, WhatsApp communication channels, and any other digital or physical touchpoint operated by MUSTABAL SPECIALITY EYE CLINIC in Jigjiga, Ethiopia. If you have any questions about this policy, please contact us using the details at the end of this document.

When you register as a patient or interact with our services, we may collect the following categories of personal information: Personal & Identity Data: • Full name, date of birth, gender, and nationality • Government-issued ID number (where required for surgical procedures) Contact Data: • Mobile phone number (required for registration and WhatsApp notifications) • Home address and district/city of residence • Email address (optional) Medical & Clinical Data: • Eye health history, existing conditions, and current medications • Diagnoses, clinical examination results, and treatment plans • Prescription records, surgical notes, and optical measurements • Photographs of the eye or fundus taken during diagnostic procedures Administrative & Financial Data: • Service invoices, payment history, and outstanding balance records • Appointment history, visit dates, and assigned clinical staff

Your personal data is used strictly for the following purposes: Clinical Care: To provide you with accurate diagnosis, appropriate treatment, and ongoing follow-up care. Clinical staff access only the information relevant to your specific care pathway. Patient Records Management: To maintain an accurate, up-to-date digital medical record that supports continuity of care across all branches. Billing & Financial Management: To generate invoices, process payments, manage outstanding balances, and produce accurate financial reports for clinic management. Queue & Appointment Management: To coordinate your visit, assign you to the appropriate clinical department, and manage the patient flow across our branches. Communication via WhatsApp: To send you automated, transactional messages including: • Welcome messages upon first registration • Appointment confirmation and reminders • Post-visit follow-up instructions • Notifications regarding your treatment progress We do not use your data for unsolicited marketing or promotional communications.

Mustabal Speciality Eye Clinic uses the official Meta WhatsApp Business API to send patients automated transactional notifications. By providing your phone number during registration, you consent to receiving these clinical messages. The types of WhatsApp messages we send include: • Welcome message confirming your registration as a patient • Visit confirmation messages when you check in at a branch • Prescription and treatment summary notifications • Post-operative care reminders and follow-up scheduling alerts Important: We do not share your phone number with third-party marketing platforms. Your number is used solely to communicate with you about your own clinical care. If you wish to opt out of WhatsApp notifications, please inform the reception desk at your branch. You can still receive care; opting out only stops automated digital messages. Your data processed through Meta's WhatsApp API is subject to Meta's own privacy terms and data processing agreements.

Mustabal Speciality Eye Clinic does not sell, rent, or trade your personal data to any third party for commercial purposes. We share your data only in the following limited circumstances: Within the Clinic Network: Clinical and administrative staff across our branches may access your records for the purpose of providing you with coordinated care. Access is restricted through role-based permissions in our digital system. Meta (WhatsApp Business API): Your phone number and appointment-related message content are processed through Meta's official API to deliver transactional notifications. Legal Obligation: We may disclose your information if required to do so by a court order, regulatory authority, or applicable law. We will notify you of such disclosure where legally permitted. Emergency Referrals: Where your condition requires referral to an external hospital, we will share relevant clinical information with the receiving facility only with your explicit consent or in a life-threatening emergency.

We implement technical and organisational measures to protect your personal and medical data against unauthorised access, disclosure, alteration, or loss. These measures include: • Role-based access control (RBAC): Clinical staff can only access patient records relevant to their specific department and assigned role • Encrypted data transmission: All data transferred between clinic branches and our central system uses secure, encrypted connections • Audit logging: All access to patient records is logged and can be reviewed by system administrators • Staff training: All clinical and administrative staff are trained on confidentiality obligations and data handling best practices Despite these measures, no system is entirely immune to security risks. If you become aware of any suspected data breach, please notify us immediately using the contact details below.

As a patient of Mustabal Speciality Eye Clinic, you have the following rights regarding your personal data: Right of Access: You may request a copy of the personal and medical information we hold about you at any time. Requests will be processed within 14 working days. Right to Correction: If any of your records are inaccurate or incomplete, you have the right to request corrections. Please speak to the reception team at your branch. Right to Withdraw Consent: You may withdraw your consent to WhatsApp notifications at any time by informing the reception desk. This will not affect the lawfulness of any messages sent prior to withdrawal. Right to Data Portability: You may request your medical records in a standard format if you wish to transfer your care to another healthcare provider. Right to Erasure: In certain circumstances, you may request that your personal data be deleted, subject to our legal obligations to retain medical records for minimum periods required by Somali healthcare regulations. To exercise any of these rights, please contact the clinic administrative office in writing.

We retain patient medical records for a minimum of ten (10) years from the date of last clinical contact, in accordance with applicable Somali healthcare regulations and international best practices for ophthalmic records. Financial records are retained for a minimum of five (5) years for audit and regulatory compliance purposes. WhatsApp notification logs are retained for twelve (12) months. After the applicable retention period, data is securely deleted or anonymised.