Privacy Policy

1. Scope

This policy describes how Mukti collects, uses, and protects personal data when you use mukti.health, our apps, and related services: the Mukti Health app for patients and families, the Mukti Rider app for ambulance drivers and delivery riders, and the Doctor, Hospital and Pharmacy portals. Section 10 sets out what each app collects. Health-related data is sensitive; we design access controls and partner verification with that in mind.

2. Data we may collect

• Identity & contact: name, email, phone, NID/passport where required for verification
• Account & profile: role, preferences, emergency contacts, dependent (child) profiles
• Health-related data you or your clinicians add: appointments, prescriptions, reports, notes
• Location data when you enable it for ambulance, delivery, or nearest ER features, and a rider's location while they are online for a shift
• Technical data: device, logs, cookies (see Cookie Policy)
• Partner documents: licences, trade documents uploaded for verification
• Security and consent records: sign-in factors for portal accounts, consent and record-sharing decisions, and logs of who accessed a record

3. Why we use data

• Provide and improve booking, records, logistics, and support features
• Verify professionals and organisations before they serve patients
• Communicate service updates, security alerts, and (with consent) product news
• Comply with Bangladesh law and respond to lawful requests
• Protect users, partners, and the platform against fraud and abuse

4. Sharing

We share data only as needed: with the care partners you interact with (e.g. a doctor you book), the processors named below under contract, and authorities when required by Bangladesh law. We do not sell personal health records.

Mukti uses these kinds of service providers (processors). Each receives only what its task needs:

• Cloud database and file storage: stores account, health and order records.
• Website and app hosting: runs the websites and apps and sees request metadata, including your IP address.
• SMS delivery (a Bangladeshi SMS service): receives your phone number and the message text.
• Email delivery: receives your email address and the message text.
• Push notifications: receives a device push token, a device identifier and the notification text; it does not receive health records.
• Maps and address search: receives your location when you open a map, track an ambulance or use address auto-complete.
• Open map address lookup: receives your coordinates, only to turn them into a street address when the main map service is unavailable.
• IP-based location lookup: receives your IP address, only when location permission has not been granted, to estimate your city.
• AI model provider (Mukti AI, section 9): receives your Mukti AI messages, the recent messages sent with them and the images you choose, including prescription photographs, to reply and to read prescriptions.
• Speech-to-text provider (Doctor dictation): when a doctor uses dictation, after telling the patient, the recording is sent to an AI transcription service in the United States to produce a transcript. The provider does not use it to train its models and, by default, does not keep it once the transcript is returned; Mukti does not store the audio.
• Consultation calls: carries the live audio and, when a camera is on, the video of a consultation call between a patient and their doctor, only while the call lasts. Calls are not recorded.

Each processor is bound by its service terms and data-processing terms to confidentiality, security measures and processing limited to Mukti’s instructions. Mukti does not use a processor that does not provide protections equivalent to those described in this notice. Several are based, or process data, outside Bangladesh, including in the United States; cross-border processing is assessed and protected as required by Bangladesh law.

You can ask support@mukti.health for the current list of service providers, and for a copy of the safeguards that protect international transfers.

5. Security & retention

We use technical and organisational measures appropriate to the risk, including role-based and least-privilege access for staff, row-level database controls, encrypted transport and audit logs of access to records. Emergency access to a record without the patient's code is logged and reviewed. No system is perfectly secure. We keep data only for the service, safety, dispute and legal periods that apply; records the law requires us or a provider to keep are restricted and kept with an audit trail.

6. Your choices

In the Patient app, Profile → Settings → Your data lets you download a copy of your data, make a formal request to access, correct, port or erase it, and withdraw a clinical consent; the app shows the date by which Mukti will respond. You can delete your account on the same page, subject to legal retention needs (for example completed transaction records). A doctor or hospital can open your records only after you allow their request in the app (Profile → Settings → Who can see my records), and you can revoke that at any time. Mukti AI is optional: you can withdraw its permission in AI privacy & data. Mukti Rider accounts can be deleted in the Rider app's account settings. You can also write to support@mukti.health.

7. Children

Child health records may be managed under a guardian profile until handoff at majority, as designed in the patient product. Do not create independent accounts for minors outside that model.

8. Law

Processing is carried out in connection with services offered in Bangladesh and is subject to applicable Bangladesh law, including the Personal Data Protection Act, 2026, the ICT framework and cyber security legislation as they apply to digital services and personal data. Mukti's main database and servers are currently hosted outside Bangladesh, and some of the processors listed above also process data outside Bangladesh; cross-border processing is assessed and protected as required by Bangladesh law.

10. In the Mukti Health and Mukti Rider apps

One policy covers both apps. What each one collects, and why:

Mukti Health (patients and families)

• Your phone number (you sign in with a code sent by SMS), name, NID, date of birth, gender, your Mukti Health ID, emergency contacts, and your family and children's profiles
• Your health record: prescriptions, lab results and reports, including those a partner hospital, clinic or home lab test sends to your account, and the readings you log in Health trackers
• Appointments, medicine orders, home lab tests and ambulance trips, with their receipts
• Your location, only when you allow it: to find the nearest ER, send an ambulance or a delivery to you, and share a live trip only when you choose to
• Messages with the rider, driver, pharmacy or hospital on an order, deleted 15 days after the order ends (kept longer only while a complaint, support case or SOS about it is open)
• Consultation calls with your doctor, carried live and not recorded. The app asks for the camera and microphone only for a call you answer, and you can take the call with audio only. Mukti keeps a record of the call (when it rang, was answered and ended), never its audio or video
• Mukti AI messages and images, only with your permission (section 9)

Mukti Rider (ambulance drivers and delivery riders)

• Your name, phone number, photo, NID, driving licence and vehicle documents, which Mukti reviews before you can take jobs
• Your live location, only while you are online for a shift or on a job; the patient on that job sees it until the job ends
• Your jobs, earnings and settlements
• SOS alerts and incident reports, kept for seven years as the law on safety records requires
• Messages with patients, pharmacies and hospitals on a job, deleted 15 days after the job ends

Both apps use a device token to send you notifications, and keep sign-in and security logs. Records the law requires, such as clinical and financial records, complaints (six years) and SOS or incident reports (seven years), are kept under restricted access even after you delete your account.

11. Contact