Privacy Policy

01Introduction

Protecting your privacy matters to the official website of Dr. Mojtaba Hedayat Yaghoubi, Associate Professor at Alborz University of Medical Sciences and specialist in infectious and tropical diseases.

This policy explains what information is collected when you use the website — especially online booking — why it is used, who can access it as part of their duties, and how it is protected.

This website and everything in it belongs to Dr. Mojtaba Hedayat Yaghoubi; the information it receives is kept and used under the doctor's and the practice's responsibility.

This website is not an electronic medical record or a system for storing medical history; online booking is designed only to collect and manage what is needed to book and follow up appointments.

02Scope

This policy covers information received or processed through the website and its online booking.

Pages about the doctor, the areas of care and educational content can be viewed without an account. Private areas, such as the patient account, are subject to sign-in and access control.

03Information we collect

Depending on which part of the website you use, only the following is collected:

Identity

• Full name
• National ID

Contact

• Mobile number

Appointment

• The area of care you choose (reason for visit)
• Appointment date and time
• Appointment status and reference code

Contact form

• Full name, mobile number and your message

Reviews of the doctor

• First name, last name and national ID (to verify the author)
• Rating (1 to 5 stars) and the review text
• The review’s moderation status

Technical information needed for security

• A session cookie that keeps you signed in (see “Cookies”)
• Your IP address in hashed, irreversible form — used only to limit repeated sign-in requests and prevent abuse

Your mobile number is verified with a one-time SMS code (OTP). It is not a permanent password, it expires shortly after it is sent, and it is not stored in readable form.

04When information is collected

This information is collected when you enter it to book an appointment. During mobile verification, a one-time code is sent by SMS to that number.

If you use the contact form, your name, mobile number and message are stored, and authorised practice staff read them in the management area in order to reply. Please do not include medical information in the form.

To write a review, you sign in with your mobile number and enter your first name, last name and national ID. The national ID is used only to verify you against your account. Every review is checked by the practice before it is published; once approved, only your first name and last initial (e.g. “Sara M.”), rating, review text and publication date are shown publicly — your full last name, mobile number, national ID and other details are never shown.

05How we use your information

Information is used only to:

• Book appointments and show them in your patient account
• Verify your mobile number and sign you in
• Identify you at the practice and track appointment status
• Send essential appointment-related messages, when enabled
• Reply to contact-form messages
• Moderate reviews and publish approved ones
• Keep the system secure and prevent unauthorised access
• Carry out the technical and operational work needed to provide the service

Information is used only as far as these purposes require, and never for advertising or marketing.

06Medical information

Online booking only asks for the area of care (for example, “Wound and skin infections”). You do not need to describe your condition or symptoms; the conditions listed under each area are there for guidance only.

The system does not collect medical records, prescriptions, test results, diagnoses, clinical notes or medical history, and the patient account is not an electronic medical record.

If a future feature requires a new type of personal or medical information, this policy will be updated before it is introduced.

07Who can access your information

Private information is never public. Access depends on the type of account and its permissions:

Patient account

Each patient sees and manages only their own appointments and account.

Authorised staff

The doctor, receptionist and others authorised by the practice can access the management area only as their duties require. National IDs are never shown in full in the staff area, and staff actions are logged.

Patients and other users cannot access the staff area or any management function.

08External links

External links, such as directions on Google Maps or the official Instagram page, take you to those services, whose own privacy policies apply.

09Disclosure

Private information is not published, sold or rented. The only exception is approved reviews, which are published with the author’s first name and last initial, rating and text.

It is shared only as needed to provide the service, for authorised staff duties, or where the law requires it.

10Security

The system uses security measures appropriate to the service, including:

• Patient sign-in with one-time codes and a limited number of attempts
• Secure session cookies that page scripts cannot read
• Rate limiting of repeated sign-in requests
• Fully separate patient and staff accounts and sessions
• Logging of staff actions in the management area

No internet-connected system can be guaranteed completely secure; we take appropriate steps to protect information and respond promptly to any incident.

11Cookies

The website uses only the cookies needed for signing in:

• Patient session cookie — after signing in with a verification code; up to 30 days, or until you sign out
• Staff session cookie — for authorised staff only; up to 12 hours

No analytics, advertising or marketing tools (such as Google Analytics or Meta Pixel) are used. If such tools are ever added, this policy will say so first.

12Data retention

Information is kept as long as needed for the purposes above, for providing and securing the service, or to meet legal requirements. Expired verification codes, expired sessions and rate-limiting records are set up for periodic removal.

If formal retention periods are set, they will be stated in a future version of this policy.

13Your rights

Within the applicable law, you can:

• View your appointments and account details in your patient account
• Correct your name in your patient account; national ID corrections are made through the practice
• Ask for your information to be deleted, where legally and operationally possible
• Ask for your published review to be removed
• Ask questions about, or object to, how your information is used

Requests are handled through the practice’s official contact channels, and we may need to verify your identity first.

14Accuracy of information

You are responsible for the accuracy of the information you enter. Incorrect information may prevent an appointment from being booked, identified or managed correctly.

15Changes to this policy

This policy may be updated when the website’s features, processes or legal requirements change. The new version is published on this page; the date of the last update is shown in the website footer.

16Contact

For questions about this policy or requests about your personal information, please use the official channels listed on the Contact page.