Privacy Policy

Who is responsible

The clinic you select in SmartCordinator is the controller of its patient and care data. B-IT operates the SmartCordinator platform as the clinic’s processor and platform operator. This policy applies to SmartCordinator (Android package co.bit.smartcoordinator) and its patient services in Saudi Arabia; the app is not limited to Derma Clinic.

Privacy and support requests may be sent to info@b-it.co. Include the name of your clinic so your request can be directed to the correct controller. The clinic remains responsible for decisions about your care and patient record.

Data we collect

• Identity and contact details, including name, mobile number and email.
• Date of birth, gender and consent records.
• Health and care information you or the clinic provides, including intake answers, clinical notes, treatment and aftercare information.
• Appointments, booking choices, cancellations and attendance information.
• Chat messages, assistant conversations and satisfaction responses.
• Installation and device identifiers, app and operating-system versions, push tokens, IP address and security logs.

Why we use it

• Create and secure your account using SMS one-time codes.
• Coordinate appointments, clinic communication, intake, aftercare and support.
• Deliver non-sensitive push notifications and service messages.
• Prevent abuse, protect accounts, diagnose failures and maintain an audit trail.
• Operate the clinic-configured assistant. It coordinates care but does not diagnose or replace professional medical advice.

Service providers and international processing

B-IT may use contracted hosting, SMS, Firebase push-notification and clinic-approved AI providers only to operate the service. The assistant may transmit the current conversation, intake context and relevant service information to the configured AI provider. We do not sell data or use it for advertising.

Where a provider processes data outside Saudi Arabia, the clinic and B-IT require an appropriate lawful basis, processor terms, access controls and transfer safeguards under applicable Saudi law. The production provider and processing region are reviewed before use.

Security and notifications

Access uses one-time codes and encrypted transport. Mobile session tokens are stored using the device keychain or keystore. Clinic tenants are separated, access is restricted, and important operations are logged. No system can guarantee absolute security.

The production notification design requires generic lock-screen wording without diagnoses, treatment details, intake answers or chat text. Native push delivery is still being validated before the public app release.

Deletion and your rights

You may request access, correction or account deletion by emailing info@b-it.co through the public account-deletion page. Include your clinic name and registered mobile number, but do not send passwords, one-time codes or medical documents. Support and the clinic must verify your identity before acting.

The release plan targets deletion of the account and linked profile, appointment, conversation, intake, aftercare, satisfaction, clinical, notification and device data within seven days after verification and clinic approval, with only a non-identifying deletion audit retained. The clinic must confirm whether any legally required record retention applies and explain any exception before processing. Automated in-app and OTP-verified web deletion are not yet available on the live backend; contact support to request deletion or ask about cancellation and progress.

Children, emergencies and changes

SmartCordinator is intended for adults aged 18 and over in Saudi Arabia. It is not an emergency service. For an emergency, call the Saudi ambulance service on 997.

We may update this policy when the service or legal requirements change. The current non-editable version and update date will remain available at this address.