Comprehensive Privacy Policy

Welcome to GREHALA. We have architected our platform with an absolute, uncompromising commitment to your digital privacy. This comprehensive document details how we collect, route, process, and protect your data across our Web, Android, and iOS applications. We strictly adhere to the UAE Federal Decree-Law No. 45 of 2021 on Personal Data Protection, the Google Play Developer Program Policies (Data Safety), and the Apple App Store Review Guidelines. By registering an account or utilizing our services, you establish a legally binding agreement to the practices detailed herein.

1. The "Zero Medical Data" Doctrine

GREHALA is a professional networking directory, career milestone tracker, and employment hub for healthcare providers. We are not a health information custodian or a telemedicine provider.

No Patient Records: We explicitly do not collect, process, or archive Electronic Health Records (EHR), laboratory results, prescriptions, patient communications, or clinical diagnostic data.
Prohibited Content: Users are strictly prohibited from uploading patient data, X-rays, or sensitive medical files to the platform's feeds, goals, or comments. Any such data will be immediately purged, and the account may be suspended.

2. Information We Collect & Why

To provide a functional, secure, and interactive professional network, we collect specific data points voluntarily provided by you:

Account Registration Data: Full Name, Email Address, Phone Number (optional), encrypted Password, and Professional Title (e.g., Doctor, Pharmacist, Nurse). This is required for authentication and platform security.
Media & Avatars: You may upload a profile picture. Images are securely hosted on our encrypted servers and used strictly for visual representation. We do not apply facial recognition algorithms.
Curriculum Vitae (CV) & Files: When you upload a PDF CV, it is securely transmitted via API and stored in a highly restricted Google Drive Cloud Infrastructure. This file is linked to your profile to facilitate job applications and is never sold to data brokers.
Professional Metrics: We store your stated Location (Emirate/City), Skills, Medical Licenses, Languages, and Work Experience (Milestones) to build your public-facing professional portfolio.

3. User-Generated Content (UGC) & Social Networking

GREHALA includes social features such as the "Trust Circle", Activity Feeds, Goals, and Comments. By participating in these features, you acknowledge:

Public by Default (with controls): Information you post on your Professional Feed, including Milestones and Goals, is visible to other registered users. You can restrict visibility by toggling "Lock Milestones" in your settings.
Trust Circle (Connections): Connection requests ("Trust Circle") are mutual. You have absolute authority to accept, decline, or silently disconnect from any user at any time.
Comments & Interactions: We store your likes (Congrats/Insightful), bookmarks, and comments on jobs and feeds. Comments are public to anyone who can view the original post.
UGC Moderation: In compliance with App Store guidelines, we reserve the right to remove any User-Generated Content that is deemed offensive, discriminatory, spam, or violates intellectual property, without prior notice.

4. Job Board & Employer Privacy

Our employment hub is designed to protect both applicants and employers:

Applicant Privacy: Applying for jobs may redirect you to external hospital portals or WhatsApp. We do not intercept or monitor data transmitted outside the GREHALA ecosystem.
Employer Anonymity: If you post a job vacancy, you may utilize the "Show My Profile" toggle. Disabling this hides your personal identity, displaying the author simply as "GREHALA User", ensuring your inbox is protected from unsolicited contact.

5. Artificial Intelligence (AI) Processing

GREHALA integrates AI purely to enhance user experience. Your personal data is not the product.

AI Match Score: We use internal logic to compare your profile (Specialty, City) against job requirements to calculate an "AI Match %". This is processed locally and securely.
Smart Job Extraction: When posting a job, our system temporarily analyzes the pasted text to auto-extract emails, phone numbers, and categories. The raw text is processed instantaneously in system memory (RAM) and is not used to train external public language models (LLMs).

6. Cookies & Device Data

We require certain technical data to ensure the platform functions seamlessly:

Session & Security Cookies: We use strictly necessary cookies (including a 30-day encrypted "Remember Me" token) to maintain your authenticated session and protect against Cross-Site Request Forgery (CSRF) attacks.
Telemetry & IP Logging: We temporarily log IP addresses and User-Agent strings solely to detect fraudulent activity, prevent DDoS attacks, and enforce daily posting limits.

7. Third-Party Integrations & External Links

We do not sell, rent, or lease your personal information. However, data interacts with third parties in the following ways:

Google Cloud & Drive: Infrastructure hosting and CV file storage are managed via secure Google APIs.
WhatsApp Routing: Clicking a "WhatsApp" button on a profile or job transfers your intent to the Meta (WhatsApp) application. Your subsequent conversation is governed by Meta’s privacy policies.
Legal Compliance: We will unequivocally disclose data to UAE governmental authorities, police departments, or judicial bodies if presented with a legally binding subpoena or court order concerning cybercrime or fraud.

8. The "Right to be Forgotten" (Data Deletion)

In strict accordance with Google Play Data Safety requirements and global privacy standards, you possess absolute control over your digital footprint on GREHALA. You do not need to contact support to delete your data.

Asset Deletion: You can independently delete any Job Post, Milestone, Goal, or Comment you have created. Once clicked, it is instantly and permanently wiped from our active databases.
CV Deletion: Clicking "Delete CV" in your profile immediately triggers an API call that permanently shreds the PDF file from our secure Google Drive infrastructure.
Total Account Termination: You may initiate total account deletion from your settings. This triggers a cascading protocol that irreversibly destroys your authentication credentials, profile data, avatars, Trust Circle connections, and all associated User-Generated Content.

Document Revision: 2.1.0 | Last Updated: September 2026
If you have privacy concerns or require data export assistance, please utilize the "Help" button within the platform.