This policy explains how Institution-Based Private Practice (IBPP), Ayub Teaching Hospital Abbottabad, handles information used by the IBP Clinics website, appointment services, SMS, and the official WhatsApp appointment channel.

Information we handle

Depending on the service used, we may handle a patient or authorized representative's name, mobile number, account and contact details, consultant and department selection, requested appointment date and time, booking status, optional booking notes, dependent or family-profile information, and messages sent to our support or WhatsApp channel. We may also retain limited technical, delivery, security, and audit logs.

How information is used

Information is used to search the verified consultant schedule, reserve and manage appointments, prevent duplicate bookings, send confirmations and operational reminders, answer appointment questions, support patients and consultants, protect the service, investigate delivery or security problems, and meet applicable administrative or legal obligations.

Service providers and integrations

We may use contracted hosting, security, SMS, and communications providers to operate the service. WhatsApp messages are transmitted using Meta's WhatsApp Cloud API. When an AI assistance feature is specifically enabled, the minimum necessary message text may be processed by the configured AI service to prepare an appointment-related response. We do not sell personal information.

Health and emergency information

The portal is an appointment service, not an emergency or clinical-diagnosis system. Do not use it for urgent medical needs. Please contact Ayub Teaching Hospital emergency services or the appropriate emergency number.

Retention and protection

We retain records only for as long as reasonably required to operate appointments, maintain audit and security records, resolve disputes, and comply with applicable requirements. We use access controls, server-side secrets, encrypted HTTPS transport, request validation, and operational logging to reduce unauthorized access. No internet service can guarantee absolute security.

Your choices and requests

You may request access, correction, or deletion of eligible information. Some appointment, audit, or legal records may need to be retained or de-identified instead of immediately deleted. See our Data Deletion Instructions.

Children and dependents

A parent, guardian, or authorized account holder should provide and manage information for a child or dependent and should submit only information needed for appointment administration.

Contact

For privacy questions, contact IBPP Appointment Support at info@ath.gov.pk or call 0992 9311155.

Administrative note: This operational policy should be reviewed periodically by the hospital's authorized legal and privacy representatives.