Privacy Policy

Mersal OncoGuide (the “App” or “we”) is a digital health platform supporting cancer patients, their caregivers, and the medical community in Egypt. This Privacy Policy explains what personal data we collect, how we use and protect it, who we share it with, and the rights you have regarding your data.

The App is operated by Mersal Foundation for Charitable Works, located at 263 Street, New Maadi, Cairo, Egypt, tax ID 567-474-259.

Because the App is designed for people affected by cancer, a significant portion of the data we handle is considered sensitive health data, and we treat it with special care as described below.

By creating an account or using the App, you confirm that you have read and understood this Privacy Policy. Where required by law, we will ask for your explicit consent before collecting or using sensitive data.

This policy applies to the Mersal OncoGuide mobile application, the web platform, and the related backend services we operate. It applies to patients, caregivers, doctors, and administrators who use the App.

A. Data you provide to us

Identity and contact data: first name, last name, phone number, date of birth, gender, and governorate. We may also collect an email address if you sign in via email.

Account and verification data: one-time verification codes (OTP) sent via SMS, account verification status, your role (patient, caregiver, doctor, or administrator), and session data.

Health and medical data (sensitive data): cancer diagnosis/diagnoses, treatments and treatment plans, medications and schedules, medication intake records (whether doses were taken), and your responses to Patient Reported Outcome (PRO) questionnaires related to symptoms and health status.

Caregiver and relationship data: links between patients and caregivers, invitations exchanged between them. A caregiver may create a profile on behalf of a patient who does not have their own phone number.

Emergency (SOS) data: when you trigger an SOS alert, we collect the alert time, any optional message you add, and your location (GPS coordinates and/or address) so your caregivers — and, when appropriate, emergency services — can help you. See Section 6.

AI assistant conversations: messages you send to the in-app AI assistant. See Section 8 for how these are handled.

Communications with us: when you contact support (for example via WhatsApp), we receive the information you choose to share.

B. Data we collect automatically

Device and technical data: device type, operating system, app version, language, and IP address.

Notification tokens: an identifier that allows us to send notifications to your device.

Usage data: educational content you view, features you use, and analytics about AI assistant sessions, such as timing, message count, token usage, and whether the SOS feature was triggered. Depending on the configured service, Mersal may also store individual conversation turns on its servers to maintain conversation context.

Diagnostics and crash data: technical logs that help us detect and fix errors.

We use your data to:

Create and manage your account and verify your identity via SMS;

Provide the App’s core features — medication reminders and tracking, treatment management, educational content, service provider directory, and Patient Reported Outcome (PRO) questionnaires;

Enable relationships between patients and caregivers and allow authorized caregivers to support you;

Operate the SOS emergency feature and notify your caregivers;

Provide responses through the in-app AI assistant;

Send service-related notifications and important messages;

Improve and secure the App and resolve issues;

Comply with our legal obligations.

We process your personal data based on the following grounds, in accordance with the Egyptian Personal Data Protection Law (Law No. 151 of 2020):

Your consent — especially your explicit consent for processing sensitive health data;

Performance of a service you request through the App;

Our legitimate interests in operating, securing, and improving the App;

Compliance with legal obligations.

You may withdraw your consent at any time (see Section 13). Withdrawing consent does not affect processing that occurred before withdrawal, and some features may stop working without the data they rely on.

The SOS feature is designed to alert your registered caregivers in a genuine emergency. When activated, your location and an optional message may be shared with caregivers via notifications, SMS, and WhatsApp, and this information may also be made available to administrators to help coordinate the response.

Please use this feature only for real emergencies. The App is a supportive tool and not a substitute for official emergency services.

The App allows patients to link with caregivers. Once a relationship is created and authorized, the caregiver may be able to view some of the patient’s data and help manage it (such as medications, reminders, and SOS alerts). A caregiver may also create a profile on behalf of a patient who does not have their own phone. You can review and manage your relationships inside the App.

The App includes an AI assistant. Before using it, you are shown a separate disclosure and asked for your explicit permission to share data with external AI service providers. If you decline, the AI assistant will not be available, but you may continue using the App’s other features. Permission is valid only for the current login session, can be withdrawn from Profile > Privacy > AI Data Sharing, and is requested again after you log out and sign in again.

When you give permission and use the assistant, Mersal sends the messages you type and the conversation history through Mersal’s backend to an external AI service provider contracted by Mersal. The underlying technology may change without changing the categories of data or purpose described here.

For patient accounts, the assistant also receives the following profile information when available so it can personalize its response: full name, age derived from date of birth, gender, governorate, cancer diagnosis and stage, metastatic locations, and current treatments or medications.

This data is used to generate personalized educational and supportive responses. It is not shared for advertising or cross-app tracking. The providers may process this information on servers outside Egypt under their applicable privacy and security terms.

Mersal stores session analytics and may store conversation turns on its servers to provide conversation continuity. The configured external provider may also handle conversation content and state under its applicable data-retention policy. Withdrawing permission stops future sharing but does not undo processing that already occurred; you may request deletion as described in Sections 11 and 13.

Please do not share information with the assistant that you do not want processed in this way. The assistant provides general information only and does not provide medical diagnosis or treatment.

We do not sell your personal data. We share data only to the extent necessary to operate the App, with service providers (“processors”) working under our instructions and committed to protecting your data.

For the AI assistant, the processor is an external AI service provider contracted by Mersal. We require service providers that receive personal data to apply the same or an equivalent level of protection to that described in this Privacy Policy and required by applicable law.

The external AI service provider and some of our other service providers may store or process data on servers located outside Egypt, including in the United States. When this occurs, we use contractual, organizational, and technical safeguards intended to ensure your data receives an appropriate level of protection under applicable law.

We keep your personal data for as long as your account is active and for the period necessary to provide the App, comply with legal obligations, resolve disputes, and enforce our agreements. When data is no longer needed, we delete or anonymize it. You can request deletion of your account and related data as described in Section 13.

AI session analytics and any conversation history stored by Mersal are retained only for as long as needed to provide and secure the assistant, meet legal obligations, or resolve disputes. AI providers retain data according to their applicable service and retention policies. A deletion request may be submitted through the in-app account deletion feature or by contacting us; we will delete or coordinate deletion with processors where required, subject to legal retention obligations.

We use technical and organizational measures to protect your data, including encryption in transit, access controls, and OTP authentication. No system can be guaranteed completely secure, but we work to protect your data and handle any incidents responsibly.

Under applicable law, you have the right to:

Access the personal data we hold about you;

Correct inaccurate or incomplete data (you can edit much of your profile inside the App);

Delete your data and account;

Withdraw your consent for processing, including sensitive data;

Object to or restrict certain processing;

File a complaint with the competent data protection authority in Egypt.

To exercise any of these rights, contact us using the details in Section 16. We may need to verify your identity before fulfilling your request.

The App is intended for use by adults. If the App is used for a minor (for example, a child patient supported by a caregiver), it must be used by a parent, legal guardian, or authorized caregiver who provides the necessary consent on the child’s behalf.

We may update this Privacy Policy from time to time. We will update the “Last updated” date above, and for material changes we will notify you inside the App. Your continued use of the App after an update constitutes your acceptance of the revised policy.

For questions about this policy or to exercise your rights, contact us by email at Info@mersal-ngo.com.

Information provided through the App is for educational and supportive purposes only and is not a substitute for professional medical advice, diagnosis, or treatment. Always consult a qualified doctor before making any medical decision.