Privacy Policy

1. Scope and who uses the app

HealthWallet is a mobile app for patients and members, and for participating doctors, coaches, and administrators. It helps users keep health information, connect with providers, find nearby care, request appointments, and use fitness tools. This policy covers the app and this informational website. The operator is Rawaz Yassin, at Sulaymaniyah, Kurdistan Region, Iraq.

HealthWallet is an information organizer and directory. It does not diagnose conditions, replace professional advice, or provide emergency care.

2. Information handled by the mobile app

• Account and contact details: phone number for one-time code sign-in; name, username, address, and staff login credentials where applicable. Verification codes are delivered through WhatsApp or SMS. Authentication and session identifiers are also processed.
• Profile and health details: date of birth, gender, blood type, emergency contact, conditions, symptoms, allergies, medications, surgeries, medical history, lifestyle answers, body measurements, and information you add to your profile.
• Files and content: profile photos, medical document and receipt images, text recognized from documents, progress photos, private chat messages and images, and appointment notes.
• Care and activity: appointments, linked doctors or coaches, workout and nutrition plans, fitness or water entries, in-app notifications, reports, blocks, and related moderation records.
• Location: device location when you use nearby map or navigation features and grant permission. When you request a route, route coordinates are sent to the public OSRM routing service. Map tile requests also disclose the map area and ordinary network information to the tile service.
• Payments: on Android, consultations and coaching can be paid for through First Iraqi Bank (FIB) in Iraqi dinars. The app handles the plan, amount and currency, payment identifier, status, and access dates. You enter your banking details with FIB; the app never receives them. The iOS app does not offer purchases.
• Technical data: network request data and service security information. Google ML Kit may process device, app, feature-use, performance, and diagnostic information according to its SDK disclosures. Google Fonts may receive a request when a font is not bundled or cached.

The app contains no advertising, analytics, or crash-reporting software, and it does not use push notifications. The notification bell shows messages stored with your account.

3. Why information is used

Information is used to create and secure accounts, verify phone numbers, provide profiles and records, generate the QR codes and PDFs you choose to share, store documents, connect patients with care providers, handle appointments and chat, show maps and routes, support coaching, process and verify payments, prevent abuse, and respond to support or safety reports. We do not sell personal or health information, and we do not use it for advertising.

4. Camera, photos, files, and text recognition

The app requests camera access for QR scanning and for taking profile or document photos. It can also let users choose images from their photo library for profile, document, progress, or chat content. Document text recognition uses Google ML Kit on the device; documents chosen for upload and recognized text can then be stored with the account. You can deny or revoke permissions in device settings, although related features may not work.

5. Sharing and recipients

Information is shared through features you use: showing a QR code, exporting a PDF, requesting an appointment, linking a doctor or coach, or participating in private chat. Linked providers may see information their app role and connection permit. Chat participants see messages in their conversation. Authorized administrators may perform directory, support, or safety functions. Service providers receive the information needed to deliver their services. Information may also be disclosed where required by applicable law.

HealthWallet uses these outside services:

• Supabase: authentication, database, server functions, and private file storage, hosted in Tokyo, Japan.
• OTPIQ: phone code delivery by WhatsApp or SMS.
• First Iraqi Bank (FIB): payment creation and payment status verification on Android.
• OpenStreetMap tiles and public OSRM: maps and requested routes.
• Google ML Kit and Google Fonts: on-device text recognition support and font delivery, including SDK or network data described above.
• Netlify: hosting for this website.

6. Storage, security, and international processing

Application records and uploaded files are stored with Supabase in Tokyo, Japan, so your information is processed outside Iraq. Access is limited by database row-level security, authenticated server functions, short-lived file links, and encrypted connections, and sign-in material on your phone is kept in the operating system's secure storage. These safeguards reduce risk, but no online service can guarantee absolute security.

7. Retention and deletion

We keep your account information and content while your account is active, because the app needs it to work.

When you delete your account in Settings → Account → Delete account, HealthWallet first removes the files you uploaded — profile photo, medical documents and progress photos — and then deletes the account. With it go your profile and health information, appointments, chats and the messages you sent, notifications, plans assigned to you, reports and blocks that involve you, and the app's record of your payments. See the account deletion instructions, including how to ask for deletion if you cannot sign in.

• Directory listings. A doctor's public map listing can remain as directory information after the doctor deletes their account, but it is no longer connected to that account. Plans a coach wrote stay with the members they were written for.
• Sign-in records. One-time codes expire shortly after they are sent and are erased within a day. Sign-in rate-limit records are erased after one day.
• Backups. Our database provider keeps backups for up to 7 days; after that, deleted data no longer exists in them.
• Payment and message providers. FIB keeps its own records of payments, and OTPIQ its own records of messages it delivered, under their own policies and legal obligations.

8. Your choices and rights

You can view and edit many profile and health fields in the app, decide whether to add optional information, choose whether to share through QR, PDF, links, and chat, and turn off camera, photo, or location access in device settings. You can delete your account in the app. For access, correction, deletion, or other rights available under applicable law, contact rawazyas@gmail.com.

9. Children

HealthWallet is intended for people aged 18 and over, and we do not knowingly create accounts for anyone younger. If you are a parent or guardian and believe a child has created an account, contact rawazyas@gmail.com and we will delete it.

10. This website

This website is informational. It has no account system, contact form, cookies, advertising, or analytics. It is hosted by Netlify, which, like any web host, records ordinary request data such as IP address, browser type, and the page requested, for security and operations, under its own privacy policy. Following a store link takes you to that store, which has its own privacy practices.

11. Changes and contact

When this policy changes, we update the effective date above and tell users about significant changes in the app or by the support channels listed on the support page. Privacy questions may be sent to rawazyas@gmail.com. Postal address: Sulaymaniyah, Kurdistan Region, Iraq.