Privacy Policy
Last updated 14 July 2026.
1. Who this policy covers
This policy describes how Aafiyat, a wellness programme operated by Dr. Tasneem's Institute of Health (DTIOH), collects and handles information about patients enrolled in the programme.
Aafiyat is not a consumer app patients download. Patients interact with it only in person, through a Beauty & Wellness Volunteer (BVW) or physician at a partner clinic or parlour, and via WhatsApp messages sent to them. The information described below is recorded about patients by clinical staff — it is not typed in or self-reported by patients through an app.
2. Information we collect
Identity & contact
- Full name
- WhatsApp number, used for identity verification and programme communication
- Age, sex
Screening baseline
- Height, weight, waist circumference
- Diabetes, hypertension and PCOS history (self-reported to clinical staff)
- Computed BMI and waist-to-height ratio
Fortnightly check-ins
- Blood pressure and orthostatic drop
- Activity, daily-living activities, sleep, and questionnaire responses
- A mental-health screening item (PHQ-9). This is treated as sensitive health data with restricted, role-limited access — it includes a suicidal-ideation question that, if answered positively, triggers an internal clinical safety flag for review
- Safety flags for adverse events
Lab-based monitoring
- Metabolic markers such as HOMA-IR, body fat percentage
- Vitamin D, serum potassium, and other biomarkers as clinically indicated
- Whether a related condition is medically treated (used to adjust scoring, not stored differently)
3. What we do not collect through WhatsApp
WhatsApp is used only to deliver a one-time verification code during screening and a link to a progress scorecard after each check-in. No health information is typed into, or read from, WhatsApp chat content by Aafiyat. It is a notification channel, not a clinical one, and is not a chatbot.
4. How we use this information
To coordinate care between the BVW, physician, and Wellness Leader involved in a patient’s programme.
To build and adjust an individual treatment plan across screening, check-ins, and lab-based monitoring.
To generate the plain-language progress scorecard shared with the patient after each check-in.
To flag potential safety concerns — including the PHQ-9 suicidal-ideation item — for internal clinical review.
5. Who can access your information
Access is role-based and enforced at the database level (Row-Level Security), not only in application code. A Beauty & Wellness Volunteer, physician, Wellness Leader, and Admin each have a different, limited scope of what they can see and edit. The PHQ-9 mental-health item carries additional access restrictions given its sensitivity.
6. Your progress scorecard link
After each check-in, you receive a link to a scorecard page showing your own progress summary, in English and Urdu. This page is reachable by anyone who has the link — it is not protected by a login or password. It is gated only by the link itself being an unguessable, unique address, the same trust model as a shared file link. Treat your scorecard link as you would any private link, and avoid forwarding it to others.
7. Where your data is stored
Patient data is stored on secure, access-controlled servers using Supabase (PostgreSQL), protected by industry-standard technical and organizational safeguards. Access is restricted to authorized clinical staff on a need-to-know basis, enforced through role-based database permissions rather than application logic alone.
Aafiyat does not use third-party analytics or advertising tracking technologies. If this changes, this policy will be updated accordingly.
8. Data retention and deletion
We retain your data for as long as necessary to provide the Aafiyat programme, maintain accurate clinical records, and meet our legal and regulatory obligations. You may request access to, correction of, or deletion of your data at any time by contacting us using the details below. We will act on verified requests promptly, subject to any records we are required by law or clinical practice to retain.
9. Your rights
You may ask to access, correct, or request deletion of the information we hold about you, subject to any clinical record-keeping obligations that apply to a medical programme. Contact us using the details below to make a request.
10. Changes to this policy
We may update this policy from time to time to reflect changes to the Aafiyat programme or applicable law. Material changes will be reflected by updating the date below.
11. Contact us
Dr. Tasneem's Institute of Health (DTIOH) — Aafiyat Programme
Malir Cantt, Karachi, Sindh, Pakistan
Email: hello@dtioh.com
Phone: +92 302 2301918