Legal
Privacy Policy
Last updated 31 August 2026
The short version
- Your medical records are yours. We store them so you can use them.
- We never sell your data, and we never use it for advertising.
- Nobody sees a profile unless you invite them, or you share a link yourself.
- Deleting your account really deletes it — records and files included.
- The AI assistant only reads your records after you turn it on.
Who we are
3afya is a family health records app operated by Brilliminds. You can reach us any time at info@3afya.health.
This policy explains what we collect, why, and what you can do about it. It covers the 3afya mobile app and this website.
What we collect
Only what the app needs to work. There is no hidden collection.
- Your account: name, mobile number, and optionally an email address. Your password is stored hashed — we cannot read it. If you sign in with Google, Facebook or Apple, we store the identifier they give us instead.
- Family profiles you create: name, date of birth, gender, blood type, height and weight, and — only if you enter them — national ID, insurance details, organ donor status and medical flags.
- Health information you add: allergies, chronic conditions, medications and reminders, vaccinations, measurements, visits, prescriptions and lab results, plus any photos or PDFs you upload.
- Emergency contacts you choose to add.
- Your location — only on the emergency screen. When you open Emergency and allow it, the app reads your location once and sends it to Google Maps to list the nearest hospitals and pharmacies. We never receive it, and it is not stored: it lives in the screen while it is open and is gone when you leave. Decline the permission and the rest of the emergency card works as normal.
- Technical data: app version and device type, a notification token so reminders can reach your phone, your language choice, and crash reports when something breaks.
Apart from that one screen, we do not track your location. We never read your contacts list or anything from other apps on your phone.
Why we hold it
To give you and the family members you invite access to these records, to send the medication and vaccination reminders you set up, to answer your questions when you use the assistant, and to keep the service secure and working. That is all.
We rely on your consent, which you can withdraw at any time by deleting your account.
Who else processes it
We use a small number of companies to run the service. They act on our instructions and may not use your data for their own purposes.
| Who | What they handle |
|---|---|
| Google (Firebase) | Sign-in and push notifications |
| Google Maps | Finding hospitals and pharmacies near you, on the emergency screen |
| Microsoft Azure | Reading the text out of documents you upload |
| Google and OpenAI, via Vercel | Answering your questions in the assistant |
| Cloudflare | Hosting this website and storing your uploaded files |
| Sentry and Pydantic Logfire | Crash reports and performance monitoring |
Some of these process data outside Egypt. We only use providers that commit to protecting it.
The AI assistant
The assistant can read your records so it can answer questions about them. It is off until you turn it on, and we record when you did.
When you ask something, the relevant parts of your records are sent to the AI providers listed above to produce an answer. Your conversations are not used to train their models.
The assistant gives general guidance. It is not a doctor and does not diagnose or prescribe. In an emergency, seek medical help immediately.
Sharing with a doctor
You can create a link that shows a doctor a summary of a profile. You choose what it contains, it is protected by a passcode, and you can see when it was opened. You can revoke it whenever you want.
What we never do
- We do not sell your data, to anyone, ever.
- We do not use it for advertising or send it to advertisers.
- We do not share it with employers, insurers or marketers.
- We do not read your records except when you ask the assistant to.
Deleting your data
You can delete your account from inside the app. This is permanent: your profiles, health records, uploaded documents and the underlying files are removed. We keep no shadow copy.
Backups roll off within 30 days. If you would rather we did it for you, email info@3afya.health from your registered address.
Keeping it safe
- Everything travels over encrypted connections (HTTPS).
- Passwords are hashed, never stored in readable form.
- Access is per profile: a family member only sees what you granted them, and nothing else.
- Crash reports are configured to strip request contents, so your medical details do not ride along in an error report.
No system is perfect. If something goes wrong that affects your data, we will tell you.
Your rights
Under Egypt's Personal Data Protection Law (Law No. 151 of 2020) and similar laws elsewhere, you can ask us to show you the data we hold, correct it, delete it, or stop using it. Most of this you can do yourself in the app; for the rest, email us and we will respond within 30 days.
Children
You must be 18 or older to hold a 3afya account. Parents and guardians can keep records for their children inside their own account — those records belong to the adult who created them.
Changes
If we change this policy in a way that matters, we will tell you in the app before it takes effect. The date at the top always shows the current version.
Contact
Questions, requests or complaints: info@3afya.health.