Privacy Policy
Last updated: 9 September 2026
DoctorDesk is practice-management software for doctors, clinics and medical societies in Bangladesh, provided by AvienTech ("we", "us"). It is used by registered healthcare providers to write prescriptions, keep patient records, and manage appointments. This policy explains what information the service handles, why, and what rights you have.
Who controls your health record. If you are a patient, your record belongs to the clinic or doctor who treated you. They decide what is recorded and how long it is kept; we store and protect it on their behalf and act on their instructions. Requests about your own record should go to your clinic first — see "Your rights" below.
1. Information we handle
Healthcare providers (our customers)
- Name, email address, phone number and password
- Professional details, including BMDC registration number, specialisation, qualifications and any certificate uploaded for verification
- Signature image, clinic name, address and logo, where provided
- Organisation and billing details for the subscription
Patients
Entered by the healthcare provider as part of your care:
- Name, gender, date of birth, phone number, email and address
- National ID number, where the clinic records one
- Health information — blood group, allergies, medical history, diagnoses, prescribed medicines, vital signs, lab and diagnostic reports, and appointment history
- Documents uploaded to the record, such as scanned reports
- Consent records — whether consent was given, when, and to which version of the consent text
Technical information
- Access logs recording who viewed or changed a record, when, and from which IP address and device. These are kept deliberately: they are a safeguard for patients, not analytics.
- On public clinic pages only, a clinic may enable Google Analytics. The private app and medical records are never sent to it.
2. Why we handle it
| Purpose | Information used |
|---|---|
| Providing the service — prescriptions, records, appointments | Provider and patient information |
| Sending a prescription or appointment reminder by SMS | Phone number and a secure link |
| Verifying a doctor is registered with BMDC | Registration number and certificate |
| Security, fraud prevention and audit | Access logs |
| Billing the clinic for its subscription | Organisation and payment details |
We do not sell personal information, and we do not use health information for advertising or to train machine-learning models.
3. Where your data is stored
Personal and health information is stored on servers located in Bangladesh, and is not transferred out of the country. Traffic is encrypted in transit using TLS. Data belonging to each clinic is isolated: the system scopes every query to the clinic that owns the record, so one clinic cannot read the patients of another.
4. Who we share it with
- The healthcare provider and the staff they have authorised
- An SMS provider, to deliver a message to the phone number given — it receives the number and the message, not the medical record
- A payment provider, for clinic subscription payments only — patients never pay us
- Anyone the patient or clinic chooses to send a prescription link to
- Authorities, where we are legally required to disclose
5. Prescription sharing links
A clinic can generate a link that shows a single prescription without needing a login, and send it to the patient. The link contains a long random token, expires after a set period, and every time it is opened the access is logged. Treat it like a medical document: anyone who has the link can view that prescription until it expires.
6. How long we keep it
Medical records are kept for as long as the clinic operates its account, in line with its own record-keeping obligations. When a patient record is erased at request, personal details — name, contact information, date of birth, address, allergies and medical history — are permanently removed, uploaded documents and generated PDFs are deleted, sharing links are revoked, and any patient portal login is closed. The clinical entries themselves remain in anonymised form, because a prescription that has been dispensed is a medical and legal record that cannot be rewritten after the fact. Access logs are also retained, since their purpose is to show who touched a record.
7. Your rights
- See your record. Patients with a portal login can view and download their own record from the app. Otherwise, ask the clinic.
- Get a copy. A record can be exported in a machine-readable format.
- Correct it. Ask the clinic to fix anything inaccurate. A finalised prescription is corrected by issuing a superseding one, so the original history stays intact.
- Erase it. You can ask the clinic to erase your personal details, subject to the limits in section 6.
- Withdraw consent. Tell the clinic; this may mean they can no longer treat you through this service.
Because the clinic controls the record, please contact them first. If they do not respond, or if the request is about how we operate the platform, contact us using the details below and we will help.
8. Security
- Encrypted connections (TLS) for all traffic
- Passwords stored using one-way hashing, never in readable form
- Role-based access, so staff only reach what their role allows
- Optional two-factor authentication for provider accounts
- Append-only access logging on medical records
- Uploaded files kept in private storage, not on the public web
No system is completely secure. If we become aware of a breach affecting your information, we will notify the affected clinics without undue delay.
9. Children
The app is for healthcare professionals and is not directed at children. Children are of course treated as patients; their records are entered and managed by the clinic under the consent of a parent or guardian.
10. Changes
If we change this policy we will update the date at the top of this page, and tell clinics about significant changes.
11. Contact us
AvienTech — DoctorDesk, Bangladesh
- Email: info@doctordesk.bd
- Phone: +880-1322-303131