MediHelp
MediHelp respects your privacy. This policy explains what data we collect, how we use it, and your rights.
Last updated:
We collect account information (email, name) when you register, device details for security, and usage analytics to improve the product. Professional verification documents, prescription photos, usage analytics and search terms are described below.
Your data is used to authenticate your account, deliver the MediHelp service, provide support, and send important updates. We never sell your data.
If you join through a colleague's invite link or code, we record which account invited yours, the code, the date and whether the invitation qualified for points, together with keyed hashes of network and device signals that we use only to prevent abuse. Your colleague sees only that someone joined and the first letter of your user name, never your name or email. Legal basis: Art. 6(1)(f) GDPR (running the invitation program and preventing fraud). The record is deleted with your account. On the website the code from an invite link is kept in the mh_invite cookie for 30 days.
MediHelp provides drug reference information. If you choose to use features that store health-related information (such as patient profiles, lab results, prescriptions or questions you send to AI tools), that information is saved to your account, encrypted in the on-device cache and protected on our servers. We process it only to provide the features you use and never sell it. See "Patient data you enter" below.
If you ask to be verified as a healthcare professional, you upload a photo or PDF of your licence or professional ID in the app. The file is kept in private storage and is never shown in the app, on the website or through our API; only the MediHelp staff who review your request open it. It is deleted automatically 90 days after upload, whatever the outcome, and at once if you withdraw the request or delete your account. We keep the result of the review with your account until you delete it. Legal basis: Art. 6(1)(b) and (f) GDPR.
When you use the Prescription Reader, the photo is sent to our server and to our AI provider (OpenAI or Anthropic) only to read the medicines on it. We do not keep the photo after the reading. Our server keeps a one-way fingerprint of the photo with the reading for 72 hours, so that sending the same photo again is not charged twice, and a reading made in the background stays in your results for up to 30 days. Avoid photographing patient names or other identifiers. Legal basis: Art. 6(1)(b) GDPR; for health data, Art. 9(2)(h) or your explicit consent (see the GDPR section).
To improve MediHelp we record how the app and the signed-in website are used, for example pages and features opened and searches, linked to your account. A search term is stored only in a short, safe form: a term that is long or looks like an e-mail address, phone number, link or ID number is kept only as a one-way hash. With each event our server records the IP address and the browser or device user agent, works out your country from the IP address, and deletes the IP address and user agent after 90 days. On the public website pages you see without signing in, we record only anonymous page views and taps on buttons such as the app store and sign-up links; the visitor ID is a random value kept in your browser for that visit only (sessionStorage, not a cookie) and is deleted when you close the tab. Legal basis: Art. 6(1)(f) GDPR (improving and securing the service).
Your data is stored securely with industry-standard encryption. We use Firebase Authentication for secure sign-in and follow best practices for data protection.
MediHelp uses Firebase (authentication, push notifications and app integrity checks; crash reports via Crashlytics), Google Play Services, and Apple App Store infrastructure. Usage analytics go to our own servers, not to Firebase. The free mobile app shows ads through Google AdMob; ads are personalised only after you agree in the consent form (where it is required) and, on iPhone and iPad, allow tracking. Each of these services has its own privacy policy.
The website uses cookies and browser storage that are strictly necessary (to keep you signed in, protect forms and remember your language and theme) and privacy-friendly first-party audience measurement that is not a cookie and is described in the cookie notice. We use no advertising cookies and do not track you across websites. You can switch the measurement off on the cookie notice page. Read the cookie notice
You may request access to, correction of, or deletion of your personal data at any time through the support page. How to delete your account
Privacy questions can be sent through the support page.
The controller is Omar Mahmoud, trading as MediHelp. General contact: info@medihelpapp.com. Support and privacy requests: support@medihelpapp.com. The postal address and our EU and UK representatives are listed below and in our legal notice (Impressum). Legal notice (Impressum)
Providing your account and the service: Art. 6(1)(b). Security, fraud prevention and product analytics: Art. 6(1)(f), legitimate interests. Optional analytics/advertising identifiers and marketing e-mails: only with your consent, Art. 6(1)(a). Tax and accounting records: Art. 6(1)(c). Health-related content is processed under Art. 9(2)(h) where a healthcare professional processes patient data under professional secrecy; otherwise it is processed only with your explicit consent, Art. 9(2)(a).
When you store patient profiles, lab results or prescriptions in MediHelp, you (or the organisation you work for) are the controller of that patient data and need a lawful basis and, where required, your patients' consent. MediHelp processes it only on your behalf. This section is the data-processing agreement under Art. 28 GDPR and is part of our Terms of Use. MediHelp: processes the data only on your documented instructions, which you give by using the features; ensures that everyone authorised to access it is bound by confidentiality; protects it with appropriate technical and organisational measures (encryption in transit and in the on-device cache, access control, protected servers); uses only the sub-processors listed below, under written contracts with the same obligations, and announces changes to this list in this policy so that you can object; helps you answer data-subject requests and meet your security, breach-notification and impact-assessment obligations, and tells you about a personal data breach without undue delay; deletes the data when you delete it or your account, and lets you export it with "Download my data"; and makes available the information needed to show compliance and allows reasonable audits. The data is sent to an AI provider only when you use an AI feature. Do not enter direct identifiers such as names, ID numbers or dates of birth. Sub-processors for patient data:
We use the following service providers, bound by data-processing agreements:
Some providers process data outside the EU/EEA, in particular in the United States. Transfers rely on the EU–US Data Privacy Framework where the recipient is certified, otherwise on the European Commission's Standard Contractual Clauses.
Account data is kept while your account is active. After you request deletion, your account is deactivated immediately and erased or anonymised after 30 days. Encrypted backups roll off within about 6 weeks. Payment and tax records are kept as long as the law requires.
You have the right of access (Art. 15), rectification (Art. 16), erasure (Art. 17), restriction (Art. 18), data portability (Art. 20) and to object to processing based on legitimate interests (Art. 21). Where processing is based on consent you may withdraw it at any time with effect for the future (Art. 7(3)). You can delete your account in the app and download your data in the app or on the web ("Download my data"). You can also contact us at support@medihelpapp.com.
You may complain to a data-protection supervisory authority, in particular in the EU member state of your residence or place of work (Art. 77 GDPR).
MediHelp is not directed to children under 16, and we do not knowingly collect their data.
We do not make decisions producing legal or similarly significant effects based solely on automated processing (Art. 22). AI output is informational and must be verified by a professional.
If you are in the United Kingdom, the UK GDPR and the Data Protection Act 2018 apply. You have the same rights described in the GDPR section above. Transfers out of the UK rely on the UK Extension to the EU–US Data Privacy Framework or on the UK International Data Transfer Addendum to the Standard Contractual Clauses. You can complain to the Information Commissioner's Office (ico.org.uk).
Depending on your state (for example California, Virginia, Colorado, Connecticut, Texas or Oregon), you may have the right to know what personal information we collect and why, to access, correct or delete it, to receive a portable copy, and to opt out of its sale, of targeted advertising and of profiling. We do not sell personal information, and the website uses no advertising cookies. The free mobile app shows ads through Google AdMob; you can limit ad personalisation in the app's privacy settings and in your device settings. Health-related information you enter is used only to provide the features you use and is never sold or used for advertising. To make a request, e-mail us; we will verify it and answer within the time the law requires. You may use an authorised agent and may appeal a refusal by replying to our answer. We will not treat you differently for using these rights.
MediHelp is not a HIPAA covered entity (a health plan, a health care clearinghouse or a health care provider that transmits health information electronically in standard transactions) and is not designed to handle protected health information (PHI). We do not sign business associate agreements. Do not enter PHI, such as patient names, dates of birth, medical record numbers or other identifiers. See the medical disclaimer for details.
If you are in Egypt, Law No. 151 of 2020 and its Executive Regulations apply; the regulator is the Personal Data Protection Center (PDPC). Health information is sensitive personal data: we process it, and transfer your data outside Egypt (our servers are in Germany and some providers are in the United States), only with your explicit consent and with the safeguards described in this policy. This policy is available in Arabic. You can withdraw your consent at any time, and you have the right to know what data we hold, to get a copy, and to have it corrected, updated or erased: write to support@medihelpapp.com. You can also complain to the PDPC.
Wherever you live, you can ask us for access to, correction of or deletion of your personal data, and you can withdraw any consent you gave. Where your local law gives you further rights, for example Brazil's LGPD, Canada's PIPEDA, India's DPDP Act, Egypt's Personal Data Protection Law, Saudi Arabia's PDPL, Turkey's KVKK or the UAE's PDPL, we honour them. Write to us, and if you are not satisfied you can contact your local data protection authority.
Country detection for local prices uses IP geolocation data by DB-IP, licensed under CC BY 4.0.
