Apnar Doctor by Zeppelin Limited

Privacy Policy

How Zeppelin Limited, operator of the Apnar Doctor mobile application and related services, collects, uses, discloses, stores and protects personal data — including health data — of users and their dependents, in connection with our partner healthcare facility, Medical College for Women and Hospital (MCWH).

This Policy is prepared with reference to the Personal Data Protection Act, 2026 of Bangladesh and its implementing rules, the Cyber Security Act, 2023, and applicable guidelines of the Directorate General of Health Services (DGHS) on telemedicine and digital health records.

By using the Service, you consent to the collection and processing of your personal data as described in this Policy. Where required by law, we will obtain your explicit, opt-in consent before collecting or processing sensitive personal data, including health data.

1. Information We Collect

1.1 Information you provide to us

• Identity and contact data: name, age, gender, mobile number, email address, and — for dependents — relationship to the primary user.
• Account credentials: login details and OTP verification records.
• Health and medical data (sensitive personal data): appointment details, doctor consultations, digital prescriptions, diagnostic test selections and results, and any health information you or your doctor add to your records.
• Payment-related data: subscription tier selected, transaction references, billing details, and payment method type (e.g. bKash, Nagad, card, bank). Full card numbers and mobile financial services PINs are collected and processed directly by our Payment Partners, not stored by us.
• Support communications: messages you send through "Contact Us", FAQ interactions, or customer support channels.

1.2 Information collected automatically

• Device and usage data: device type, operating system, app version, log-in timestamps, and general usage/diagnostic information needed to operate and secure the app.
• Booking metadata: QR code booking references generated at the time of appointment or test booking.

2. How We Use Your Information

We use personal data, including sensitive health data, for the following purposes:

• to create and manage your account and any linked dependent profiles;
• to enable booking, confirmation and management of doctor appointments and diagnostic tests;
• to generate your Digital Health Card and QR codes for identification and facility access;
• to process payments and subscriptions through our Payment Partners;
• to make digital prescriptions, test results, appointment history and receipts available to you and downloadable as PDFs;
• to send appointment reminders, service updates, and prescription/result notifications;
• to provide customer support and respond to your queries;
• to maintain the security, integrity and proper functioning of the Platform, including fraud and abuse prevention;
• to comply with applicable legal, regulatory and medical record-keeping obligations.

3. Legal Basis and Consent

We process your personal data primarily on the basis of your explicit, opt-in consent, given at registration and at the point specific sensitive data is collected (for example, before booking a consultation or test). You may withdraw consent at any time by contacting us, though this may limit or prevent your ability to use certain services — we cannot book a test without the test-related information. We may also process limited data where necessary to perform our contract with you, to comply with a legal obligation (such as medical record retention requirements), or for our legitimate interests in operating and securing the Platform, balanced against your rights.

4. How We Share Information

We share personal data only as necessary and with appropriate safeguards:

• with the Partner Hospital (MCWH) and its doctors, nurses and laboratory staff, to enable the consultations, tests and treatment you book;
• with DgePay, our payment gateway partner — which in turn connects to bKash, Nagad, card networks and participating banks — solely to process your payments;
• with service providers who support our technology infrastructure (cloud hosting, SMS/OTP delivery, notification services), under confidentiality and data-processing obligations consistent with this Policy;
• with regulators, law enforcement or courts, where required by applicable Bangladeshi law, including the Personal Data Protection Act, 2026 and the Cyber Security Act, 2023;
• with your explicit consent, for any other purpose we disclose to you at the time.

We do not share your health data with employers, insurers or marketing partners without your specific, separate consent.

5. Data Storage, Security and Retention

5.1 We implement administrative, technical and physical safeguards designed to protect personal and health data against unauthorised access, alteration, disclosure or destruction, including access controls, encryption in transit, and OTP-based authentication.

5.2 In accordance with applicable data localisation requirements under Bangladeshi law, at least one synchronised copy of data classified as sensitive or critical will be maintained on infrastructure located within Bangladesh.

5.3 We retain personal and health data for as long as your account remains active, and thereafter for the period required to comply with applicable medical record-keeping, tax and legal obligations, after which it is securely deleted or anonymised — except where longer retention is required by law or is necessary to resolve disputes.

6. Cross-Border Data Transfers

Where any personal data is transferred to or accessed from outside Bangladesh — for example, for cloud infrastructure support — we will ensure such transfers comply with the cross-border data transfer requirements of the Personal Data Protection Act, 2026, including using service providers that offer an adequate level of protection or are bound by appropriate contractual safeguards.

7. Your Rights

Subject to applicable law, you have the right to:

• access the personal data we hold about you and your dependents;
• request correction of inaccurate or incomplete data;
• request erasure of your data, subject to our legal and medical record-keeping obligations;
• withdraw consent to processing at any time;
• object to or request restriction of certain processing, including automated decision-making;
• request a copy of your data in a portable format, where technically feasible;
• lodge a complaint with the competent data protection authority in Bangladesh.

To exercise these rights, contact our Grievance Officer using the details in Section 12. We will respond within the timeframe required by applicable law.

To close your account and request erasure, see Delete your account.

8. Children's and Dependents' Data

The Service allows primary users — parents and legal guardians — to create and manage dependent profiles for children and other family members. By adding a dependent, you confirm you are legally authorised to consent to the processing of that dependent's personal and health data on their behalf. We do not knowingly permit minors to create their own primary account, and we do not use dependent data for profiling, behavioural tracking or targeted advertising.

9. Cookies and Similar Technologies

The app may use similar technologies — such as device identifiers and local storage — to keep you logged in, remember preferences, and understand app performance. Where analytics tools are used, data is aggregated or pseudonymised where feasible. You can manage app permissions, such as notifications, through your device settings.

10. Data Breach Notification

In the event of a data breach that poses a risk to your rights or health data, we will notify the competent authority and affected users without undue delay, in accordance with the breach notification requirements of the Personal Data Protection Act, 2026.

11. Changes to this Policy

We may update this Privacy Policy from time to time to reflect changes in our practices or legal requirements. Material changes will be notified through the app or your registered contact details before they take effect. Your continued use of the Service after such changes constitutes acknowledgement of the updated Policy.

12. Contact Us / Grievance Officer

For any questions, requests or complaints regarding this Privacy Policy or your personal data, please contact:

© 2026 Zeppelin Limited. Operated from Dhaka, Bangladesh.