Privacy Policy

Last updated: 1 August 2026

1. General

This policy describes what information is collected when using Mediqaro, available at mediqaro.web.app (the "Service"), how it is stored, to whom it is disclosed and what your rights are. It follows the principles of the Israeli Protection of Privacy Law, 5741-1981, including Amendment No. 13 which came into force in August 2025, and the Protection of Privacy (Data Security) Regulations, 5777-2017.

Operator and privacy contact: Shakargy, email aviad94@gmail.com.

2. What information is collected and stored

On registration, sign-in and during use, the following is stored and associated with your account:

• Identity and sign-in details: if you sign in with Google - your name and email address as held in your Google account, plus a unique user identifier. If you use email and password - your email address; the password is managed and secured by Google's Firebase Authentication and is not accessible to the operator.
• Business details: name and title, specialty, licence number, VAT/company number, phone, clinic address and invoice settings.
• Activity data: invoices you issued, client/patient details entered on them, appointments in the diary, and your digital signature if you saved one.
• Subscription details: if you subscribed to a paid plan - the plan type (monthly or annual), subscription status, the PayPal subscription identifier, the next renewal date and update timestamps. Card details are not collected, do not pass through the Service and are not stored in it (see section 5).

3. Where the information is stored

Your activity and business data is stored in the cloud in Google Cloud Firestore, on servers located in the Israel region (me-west1). Identity and password management use Firebase Authentication, and the Site is hosted on Firebase Hosting - all Google cloud services acting as a processor on behalf of the operator. Access to your data is restricted by security rules that permit reading and writing a record only to the signed-in user it belongs to.

As with any internet service, Google's servers may automatically log technical traffic data (such as IP address, browser type and access times) for security and operational purposes. The Site embeds no third-party advertising, analytics or tracking tools.

4. Purpose of use

The stored information is used for one purpose only: operating the system for you - identifying you at sign-in, displaying your data, issuing invoices and managing the diary. We do not use the information for advertising or any other purpose. Declining to provide details at registration means an account cannot be opened; there is no other consequence.

5. Payments and card details

Subscription payments are processed by PayPal (PayPal Pte. Ltd. / PayPal (Europe) S.à r.l. et Cie, S.C.A.), acting as an authorised payment processor.

• Your payment details never pass through Mediqaro. Entering card or PayPal account details happens on PayPal's own site. The operator does not see them, does not receive them and does not store them at any stage or in any place.
• What we store is the subscription identifier issued by PayPal, the plan type, the subscription status and renewal dates - and nothing more. These are needed to know which features are open on your account.
• To open the subscription, the email address and name on your account, along with your internal account identifier, are sent to PayPal so the payment can be matched to the right account.
• PayPal acts as an independent controller of the payment data rather than a processor on our behalf, and its use of that data is governed by PayPal's privacy policy.
• Transfer outside Israel: payment processing takes place on PayPal servers outside Israel. The transfer is necessary to perform the transaction you entered into, in accordance with the Protection of Privacy (Transfer of Data to Databases Abroad) Regulations, 5761-2001.

6. Sharing with third parties

The operator does not sell, rent or transfer your information to third parties for marketing purposes. Information is stored and processed using Google's cloud services (Firebase / Google Cloud) acting solely as a processor and subject to Google's privacy policy and data processing terms, and using PayPal solely for payment processing as described in section 5. Patient information is never sent to PayPal and plays no part in the payment process. Beyond this, information will be disclosed only if required by law or by order of a competent authority. Export actions (PDF, ZIP or backup download) happen on your own device, and the files are saved wherever you choose.

7. Patient information - your role as database owner

Where you enter patient details into the Service (name, phone, billing details), you - and not the operator - are the "database owner" of that data under the Protection of Privacy Law. You are responsible for the duties applying to you, including medical confidentiality, securing the device you work on, and obtaining patient consent where required. We recommend not entering sensitive clinical information - the system is intended for administrative management only.

8. Data security

• Traffic with the Site and the cloud is encrypted over HTTPS.
• Identity and password management use Google's Firebase Authentication; passwords are not stored by the operator and are not accessible to it.
• Access to cloud data is restricted by security rules ensuring each user reaches only their own records.
• Data is stored on Google Cloud infrastructure, which meets strict security standards.
• Securing your account is in your hands: keep your credentials confidential, use a strong password, and sign out on shared computers.

9. Cookies and local storage

The Site uses no third-party advertising or tracking cookies. Google's Firebase uses the browser's local storage (LocalStorage / IndexedDB) to keep you signed in and to hold a local cache that allows uninterrupted work - a technical use essential to the system's operation only. Your interface language preference is also stored locally on your device.

10. Retention periods

• Account and activity data (settings, invoices, appointments) is kept as long as the account exists. Moving to the Free plan, cancelling a subscription or the trial ending delete nothing - your data remains available to view and export.
• Billing records (subscription invoices issued to you) are retained for the period required by tax law and bookkeeping regulations, including after the account is closed. These are documents the operator is obliged to keep and cannot delete on request.
• After an account deletion request, data is deleted from the cloud within 30 days, except for the billing records above. Deleting an account does not delete data from backup files you downloaded to your own device.

11. Your rights

Under the Protection of Privacy Law you have rights of access, correction and deletion of information about you:

• Access and export: all of your information is available to you in the system and via "Download full backup" in Settings.
• Correction: any data can be edited directly in the system.
• Deletion: individual invoices and appointments can be deleted in the system. To delete the entire account and all associated data from the cloud, contact the address in section 1; your request will be handled within 30 days, subject to the retention of billing records described in section 10. If you have an active subscription, cancelling it before requesting deletion is recommended.

For any privacy question or request, contact the address in section 1.

12. Minors

The Service is intended for adult medical professionals and is not intended for use by anyone under 18.

13. Changes to this policy

This policy may be updated from time to time, including following changes to the Service or the law. The current version is published on this page with its update date at the top. A material change to how data is stored or used will be accompanied by a notice in the system.