Privacy Policy

01 Who we are

Partaw (operating the Mohr-e Asil / مهر اصیل service, “Partaw”, “we”, “us”) provides a contracted teleradiology overread service to clinics and hospitals. Films a clinic already owns are sent to us; a licensed radiologist reviews and signs a report; the signed report is returned to the clinic. AI assists with quality checks and pre-drafting, but it never substitutes for the radiologist’s signature.

02 Our role and whose data this is

Partaw is a business-to-business service. Our direct customers are clinics and healthcare providers, and the people who message our WhatsApp number are normally clinic staff, not patients directly.

Radiographs and the patient details attached to them are supplied to us by clinics. With respect to that patient information, the clinic is the controller responsible for obtaining the patient’s consent and a lawful basis to share it; Partaw processes that information on the clinic’s behalf to produce the report. If you are a patient, please direct privacy requests to the clinic that ordered your study (see Your rights).

03 Information we collect

We collect only what is needed to take in a study, produce a signed report, and deliver it back. This includes:

From the WhatsApp / web sender (usually clinic staff)

• The sender’s WhatsApp phone number (so we can map the study to the right clinic and deliver the report back to the same conversation), and the WhatsApp message identifiers.
• Any text or caption sent with the image.

Patient and study information supplied by the clinic

• A patient reference and/or patient identifier provided by the clinic (for example an MRN or case number).
• Patient age and sex, where provided.
• The clinical question or presenting problem (free text).
• The radiograph image(s) sent for review, and the medical imaging derived from them (a normalized DICOM copy).

Information we generate

• AI processing outputs — image quality and view checks, classification scores, structured findings, and visual heatmaps used to assist the radiologist.
• The radiologist’s report — findings, impression, criticality flag, a digital signature and signature hash, a verification code, and the branded PDF.
• An append-only audit log recording each step in a study’s lifecycle (receipt, processing, the reading and signing event, and delivery), including timestamps and the actor involved. This record is a core part of clinical accountability and is kept intact.

Account information (radiologists and staff)

• For radiologists, administrators, and platform staff who use our portal: name/email and the identity provided by our single sign-on, plus the role assigned to the account.

04 How we use information

• To receive a study and route it to a qualified radiologist.
• To run automated image-quality and triage checks that assist (never replace) the radiologist.
• To produce, digitally sign, and deliver the report back over WhatsApp.
• To let anyone confirm a report is authentic via the verification code at the verify page.
• For quality assurance, safety monitoring, and clinical accountability (including defending the accuracy of a signed report).
• To improve our models. Information used to train or evaluate models is de-identified before it is added to any training store.
• To meet legal, regulatory, and medical-records obligations.

05 WhatsApp and Meta

We deliver this service through the WhatsApp Business Platform, operated by Meta. When you message our business number or we send a report back, Meta processes that message to deliver it, under Meta’s and WhatsApp’s own terms and privacy policies. Your use of WhatsApp is also governed by the WhatsApp Privacy Policy. Partaw is not responsible for Meta’s independent handling of your data on the WhatsApp network.

06 Where your data is stored

Our edge and control plane runs on Cloudflare (database, object storage for images and PDFs, and a search index used for comparison features). Because medical imaging archives are stateful, the imaging core — including the DICOM archive — runs on a dedicated server hosted in a Gulf / Singapore region, chosen for protected-health-information residency. We keep imaging data in-region and de-identify it before it is used for any model training.

07 Sharing and disclosure

We do not sell your data. We share it only:

• With the contracted radiologist assigned to read the study, so they can produce and sign the report.
• With infrastructure providers who process data on our behalf under contract — principally Cloudflare (edge platform) and Meta (WhatsApp delivery).
• With the originating clinic, which receives the signed report.
• Where required by law, regulation, or valid legal process, or to protect the rights, safety, and integrity of patients, our service, or others.

08 Retention and deletion

Because this is a medical service, studies, signed reports, and the audit log are retained for the period required by applicable medical-records and healthcare regulations and by our agreement with the originating clinic. Records kept for clinical accountability — in particular the signed report and the append-only audit log — are preserved for that retention period and are not casually altered or removed.

You can ask us to delete your data. Data that is not subject to a mandatory retention requirement is deleted on request; records under a legal retention obligation are deleted once that obligation expires. See the dedicated Data Deletion page for exactly how to make a request and what we can and cannot remove.

09 Security

Data is encrypted in transit and at rest. Access to the portal is protected by single sign-on behind Cloudflare Access; service-to-service calls to the imaging core are authenticated with bearer tokens; the WhatsApp webhook is signature-verified; and every signed report carries a cryptographic signature hash. No method of transmission or storage is perfectly secure, but we take reasonable measures appropriate to the sensitivity of medical data.

10 Your rights and choices

Subject to applicable law and to the medical-records retention limits above, you may request to access, correct, or delete your personal data.

• Clinics / senders: email privacy@partaw.com or follow the Data Deletion process.
• Patients: because your clinic supplied your study, please contact the clinic that ordered it; they can submit a request to us on your behalf.

11 Minors

Partaw is a service used by clinics, not a consumer product, and is not directed to children. Radiographs may relate to patients of any age, including minors; the clinic ordering the study is responsible for the lawful basis and any consent required for a minor’s information.

12 Changes to this policy

We may update this policy from time to time. We will revise the “Last updated” date above and, for material changes, take reasonable steps to notify our clinic customers. This policy is governed by the laws of Afghanistan.

13 Contact us

For any privacy question or request, contact us at privacy@partaw.com.