Privacy Policy

MBN Health ("we", "us") provides a multi-tenant clinic management platform and a connected patient portal. This policy explains what data we collect, how it is used, and how it is kept separate between clinics.

What we collect

Depending on how you use MBN Health, we process:

• Account information: name, email, phone, and password (stored as a salted hash, never in plain text).
• Clinical and administrative data entered by a clinic: appointments, medical records, prescriptions, invoices, and related notes.
• Patient-portal data: the clinics you search for, the appointments you book, and messages exchanged with a clinic through MBN Health.
• Technical data: IP address, browser/device information, and audit logs of sign-ins and key actions, used for security and troubleshooting.

Data isolation between clinics

MBN Health is a multi-tenant platform. Every clinic's data — patients, appointments, records, staff — is strictly scoped to that clinic and is never visible to, or shared with, any other clinic on the platform. The patient portal is the one deliberate exception: it lets a single patient account book with multiple clinics, but each clinic still only ever sees its own patients and appointments.

How we use data

We use collected data to:

• Provide and operate the platform (scheduling, records, billing, communication).
• Authenticate accounts and protect against unauthorized access.
• Send transactional communications such as appointment confirmations, reminders, and password resets.
• Maintain audit trails required for clinical and administrative accountability.

Data sharing

We do not sell personal data. Data is shared only with the clinic you interact with, and with service providers strictly necessary to operate the platform (for example, hosting, database, and email delivery), each bound to protect the data they process on our behalf.

Data retention and security

Passwords are hashed with Argon2 and never stored in plain text. Access to clinical data is governed by role-based permissions within each clinic. Data is retained for as long as the account or clinic remains active, or as required by applicable healthcare record-keeping obligations.

Your rights

You may request access to, correction of, or deletion of your personal data by contacting the clinic you registered with (for clinic staff and patients of a specific clinic), or contact@mbndev.ma for platform-level accounts.

Contact

Questions about this policy can be sent to contact@mbndev.ma.