IBP Clinics uses patient information to provide and administer Institution-Based Private Practice appointment services at Ayub Teaching Hospital Abbottabad. This page gives a practical explanation of the information flow across the website, patient account, SMS and official WhatsApp channel.
Information provided by patients
This may include a name, mobile number, email address, gender, consultant or department choice, appointment date and slot, booking notes, account verification details, and information entered for an authorized family member or dependent. Patients should provide only information needed for appointment administration.
Information generated by the service
The system generates appointment identifiers, booking status, source channel, timestamps, confirmation messages and limited security or audit records. It may record message-delivery status so staff can investigate failed confirmations.
Website, SMS and WhatsApp
Website and WhatsApp bookings use the same central consultant schedule and appointment records. SMS may be used for identity verification or operational notifications. WhatsApp messages pass through Meta's WhatsApp Cloud API. When AI assistance is enabled, it is restricted to helping interpret appointment-related requests and does not replace a clinician.
Who can access information
Access is limited according to operational responsibility. A consultant can view appointments assigned to that consultant. Authorized reception, booking and administrative staff may view information needed to schedule, confirm, reschedule, cancel or support appointments. Technical access is limited to authorized maintenance and security purposes.
Sharing and service providers
Information may be processed by contracted hosting, communications, security, SMS and WhatsApp providers where necessary to operate the service. IBP Clinics does not sell patient personal information or permit its use for unrelated advertising.
Security and retention
Reasonable technical and organizational controls include encrypted HTTPS transport, authenticated staff access, role-based permissions, request validation, audit records and server-side protection of integration credentials. Records are retained only as required for appointment operations, safety, auditing, dispute resolution and applicable administrative or legal obligations.
Accuracy, correction and deletion
Patients may ask for correction of inaccurate contact or account information and may request deletion of eligible data. Some records may need to be retained, restricted or de-identified for legitimate hospital, security, accounting, patient-safety or legal reasons. Use the Account and Data Deletion Request page for instructions.
Questions or concerns
Contact IBP Clinics support at info@ath.gov.pk or 0992 9311155. Also read the Privacy Policy for the complete policy statement.
Administrative note: This explanation should be periodically reviewed by authorized hospital privacy, legal and administrative representatives.