Privacy Policy

Effective date: 26 August 2026  |  Last updated: 26 August 2026  |  Version 1.0

This Privacy Policy explains how Curanexa collects, uses, shares, and protects personal information when you use PhysioConnect, a digital healthcare marketplace platform owned and operated by the Company in Pakistan.

1. Scope

This policy applies to patients, physiotherapists, students, teachers, clinical interns, administrators, and visitors who use PhysioConnect.

2. Information we collect

2.1 Identity and account

• Full name, mobile number, password (hashed), optional email, date of birth, gender, city
• Patient home address and coordinates; optional medical history summary; optional CNIC (encrypted/protected)
• Physiotherapist license/PHCPT details, clinic information, specializations, profile photo, verification documents
• Student/teacher university and verification details as required

2.2 Beneficiaries and emergency contacts

Names, relations, phones, and related details you add (up to five emergency contacts for SOS).

2.3 Health and session data

Booking problem descriptions, clinical/session notes (including doctor-only private notes), supervised intern notes, exercise logs, reviews, and dispute descriptions.

2.4 Location

Addresses and GPS for booking, nearby search, session start/end, live “on my way” tracking (with permission), and SOS events.

2.5 Payments

Wallet balances, commissions, debt, JazzCash payment proofs/screenshots, and related ledger entries. We do not store full bank IBAN as a core field today.

2.6 Communications and device

In-app messages, inbox notifications, FCM push tokens, OTPs (push and/or WhatsApp), device identifiers for limited guest features, and technical security logs.

3. How we use information

• Account creation, OTP authentication, and credential verification
• Matching, booking, tracking, session notes, education, and supervised intern workflows
• Wallet, commission, and payment verification
• Transactional notifications and SOS safety alerts
• Fraud prevention, disputes, strikes/suspensions, support, and legal compliance

4. Sharing

We share data only as needed: matched physiotherapists, patients (patient-visible notes only), supervisors, administrators, emergency contacts you add (SOS package — not clinical notes), processors, and authorities when required by law. We do not sell personal information.

5. Processors

• Google Firebase Cloud Messaging (push / OTP)
• Meta WhatsApp Cloud API (authentication OTP, when configured)
• Google Maps Platform (maps / distance / ETA)
• Cloudflare (domain DNS, object storage R2; optional Stream)
• JazzCash (payment instructions / proof verification)
• Hosting for API, database, and cache infrastructure

6. Device permissions

Internet; notifications; location (and background location for physiotherapist “on my way”); camera/photos/files for uploads.

7. Retention and security

Data is retained while accounts are active and as needed for finance, disputes, verification, SOS audit, and law. We use soft-delete for audit integrity. Security measures include HTTPS, password hashing, role-based access, protected CNIC storage, and malware scanning of uploads where enabled.

To request account closure or a privacy request, email support@physioconnectpk.com.

8. Children

Patient registration requires minimum age 16. Contact support if you believe we hold data of a child under 16 without authority.

9. Contact

CURANEXA TECHNOLOGIES (SMC-PRIVATE) LIMITED
Platform: PhysioConnect
Privacy: support@physioconnectpk.com · Info: info@physioconnectpk.com · Admin: admin@physioconnectpk.com
SECP verify: https://leap.secp.gov.pk/#/verify-company-info/0352292