Privacy Policy

1. Data We Collect

1.1 Personal Data

• First and last name
• Date of birth
• Email address
• Phone number
• Residential address (optional)

1.2 Appointment Data

• Appointment booking history (date, time and selected professional)
• User contact data necessary for appointment confirmation (first name, last name, phone number or email)

AloDoktor.al does not actively request or process health data. Any such information is shared directly by the user with the healthcare professional and is processed by the latter as an independent data controller.

1.3 Technical Data

• IP address
• Cookies and similar technologies
• Device, operating system and browser
• Platform usage history

2. Purpose of Data Processing

Your data is processed only for legitimate purposes, including:

• Creating and managing user accounts
• Managing bookings and (when applicable) organizing audio/video communication between user and healthcare professional, without content retention
• Sending notifications via email or SMS
• Providing technical support and customer service
• Improving platform functionality and security
• Fulfilling legal obligations

3. Legal Basis for Processing

• User consent
• Performance of a contract (service provision)
• Legal obligations
• Legitimate interest of the platform for security and correct operation

4. Data Security

We implement advanced technical and organizational measures for data protection, achieving a high level of security and protection:

In the event of a security incident that may affect personal data, users will be notified in accordance with applicable legal requirements.

4.1 Encryption and Secure Communication

• SSL/TLS encryption for all communications (HTTPS 256-bit)
• HSTS (HTTP Strict Transport Security) to enforce secure connections
• Protection against Man-in-the-Middle attacks through complete encryption

4.2 Protection Against Cyber Attacks

• CSRF Protection (Cross-Site Request Forgery) - Protection against attacks attempting unauthorized actions on your behalf
• XSS Protection (Cross-Site Scripting) - Automatic sanitization of all input data to prevent malicious code injection
• SQL Injection Prevention - Complete data validation and sanitization for database protection
• Clickjacking Protection - Security headers preventing page loading in third-party frames
• MIME Sniffing Prevention - Protection against file type misinterpretation

4.3 Authentication and Access Control

• JWT (JSON Web Tokens) for secure authentication
• Token Blacklist System - Tokens invalidated immediately after logout for maximum security
• Rate Limiting - Maximum 5 login attempts within 15 minutes for protection against brute force attacks
• Session Management - Secure management of user sessions
• Restricted access only to authorized personnel with minimal privileges

4.4 Backup and Recovery

• Periodic backup and recovery procedures to ensure service continuity
• Retention of backup copies according to internal security policies and operational needs
• Periodic testing of recovery procedures
• Redundancy - Multiple copies in different locations

4.5 Monitoring and Auditing

• Security Logging - Recording of all suspicious activities
• 24/7 monitoring for unusual activities
• Advanced firewall for traffic filtering
• Automatic notification in case of attack attempts
• Audit trails for tracking access to sensitive data

4.6 Data Validation and Sanitization

• Input Validation - Strict validation of all input data
• Email Validation - Verification of email format and validity
• Phone Sanitization - Standardization and validation of phone numbers
• Output Encoding - Secure data encoding before display

5. Audio/Video Communication (if activated)

AloDoktor.al may offer an audio/video communication feature solely to facilitate the connection between user and healthcare professional. The platform does not store audio/video content and does not create transcripts or recordings. Although advanced security technologies are used, no internet transmission can be 100% guaranteed secure.

5.1 Communication Security and Encryption

• Use of secure HTTPS / TLS connections for all communications
• Audio and video transmission via WebRTC technology with SRTP for data stream protection
• DTLS for secure key exchange and connection verification
• Protection against unauthorized access during data transmission

5.2 Audio/Video Communication Privacy

• Each communication session takes place in a unique private virtual room
• Access link is personal and sent only to the user and respective healthcare professional
• Restricted access only to authorized parties in the session
• Platform does not record or monitor audio/video communication content

5.3 No-Storage Policy

• Audio and video content of the session is not stored
• No automatic recordings or screenshots are created by the platform
• No transcripts or conversation copies are retained
• Temporary technical data is automatically deleted after session completion

6. Data Sharing

We do not sell or transfer your data to third parties, except:

• To the selected healthcare professional, only for appointment management purposes (date/time and necessary contacts)
• Healthcare professionals act as independent data controllers for information they receive from patients.
• To technical service providers (email, SMS), only for notifications
• To state authorities, when required by law
• To technical infrastructure providers (hosting/IT), only for service operation and security

7. User Rights

• Right to access data
• Right to rectification
• Right to erasure ("right to be forgotten")
• Right to data portability
• Right to withdraw consent
• Right to lodge a complaint with the competent authority for personal data protection

8. Platform Role

• AloDoktor.al is a technology platform that facilitates the connection between users and healthcare professionals. The platform does not directly provide medical services and does not replace professional consultation with a doctor.

9. Cookies

The platform uses cookies for functionality and improving user experience. Disabling cookies may limit some functionalities.

Users can manage cookie preferences through their browser settings.

We only use essential cookies for platform operation and, when applicable, request your consent for non-essential cookies in accordance with applicable legislation.

10. Data Retention

• For as long as the account is active
• According to legal requirements for accounting/administrative data and security purposes (when applicable)
• After account deletion, data is anonymized or deleted within 30 days

We only retain booking and contact data for as long as necessary for service operation, dispute resolution and fulfillment of legal obligations. AloDoktor.al does not actively request or process health data. Any such information is provided at the user's initiative and shared directly with the healthcare professional.

11. Policy Changes

This policy may be updated. Significant changes will be notified via email or platform.

12. Data Controller

The data controller for data processing (Data Controller) is AloDoktor.al, platform operator. For any privacy-related requests and your rights, contact us at the addresses below.

13. Contact

• Email: [email protected]
• Phone: +355 68 835 5895
• Address: Tirana, Albania