Document Version: 1.0
Last Updated: January 4, 2026
Effective Date: January 4, 2026
This document outlines Hakim's compliance with the General Data Protection Regulation (GDPR) (EU) 2016/679 for users located in the European Union and European Economic Area.
Data Controller: Hakim Telehealth Platform
Contact: [email protected]
Email: [email protected]
Responsibilities: Ensuring GDPR compliance, handling data subject requests, liaising with supervisory authorities
Hakim processes personal data under the following legal bases as defined in Article 6 and Article 9 of GDPR:
When Applied: Optional marketing communications, use of non-essential cookies, AI-powered feature enhancements, research participation
Implementation: Explicit, informed, and freely given consent with clear consent mechanisms in app, easy withdrawal options, granular consent for different purposes, and consent records maintained with timestamps
When Applied: Creating and managing user accounts, facilitating telemedicine consultations, processing appointments and scheduling, enabling patient-provider communication, managing medical records, processing payments
When Applied: Retaining medical records (healthcare regulations), reporting to health authorities, tax and accounting requirements, responding to legal requests, preventing fraud and money laundering
When Applied: Fraud prevention and security, platform improvement and analytics (using de-identified data), internal administrative purposes, network and information security
When Applied: Provision of healthcare services, medical diagnoses and treatment, preventive medicine, public health monitoring
Additional Safeguards: Enhanced encryption, strict access controls, healthcare professional oversight, additional security measures
Hakim facilitates the exercise of all GDPR data subject rights:
Implementation: User dashboard with full data access, downloadable data export feature, response within 30 days (extendable to 60 days if complex)
Information Provided: Categories of data processed, purposes of processing, recipients of data, retention periods, rights available
Implementation: In-app profile editing, medical record amendment requests (with provider approval), correction within 30 days
Implementation: Account deletion feature, clear process for erasure requests, exceptions communicated clearly (legal retention requirements)
Exceptions: Medical records: 7-year retention required by law; Financial records: Tax law requirements; Legal claims: Until resolved
Implementation: Structured data export (JSON/CSV format), machine-readable format, direct transfer to other providers (where technically feasible), medical records in HL7 FHIR standard
Implementation: Opt-out of marketing communications, object to automated decision-making, object to profiling, object to legitimate interest processing
Implementation: Human review option for AI symptom checker, transparency about AI use, explanation of automated decisions, right to contest automated decisions
Automated Systems: AI symptom checker (advisory only, not diagnostic), provider matching algorithm, appointment scheduling optimization
Encryption: TLS 1.3 for data in transit, AES-256 encryption for data at rest, end-to-end encryption for messages, encrypted backups
Access Control: Role-based access control (RBAC), multi-factor authentication, principle of least privilege, regular access reviews
Pseudonymization: User IDs instead of names in analytics, de-identification for research data, separation of identifying data from medical data
Data Minimization: Collect only necessary data, regular data review and purging, purpose limitation enforced
Privacy by Default: Strictest privacy settings by default, opt-in for non-essential features, granular privacy controls
Staff Training: Regular GDPR training for all staff, specialized training for data handlers, confidentiality agreements
Monitoring: 24/7 automated security monitoring, intrusion detection systems, regular security audits, user-reported breach channel
To Supervisory Authority (Article 33): Within 72 hours of becoming aware, including nature of breach, approximate number of affected individuals, contact point for information, likely consequences, and measures taken or proposed
To Data Subjects (Article 34): Without undue delay if high risk to rights and freedoms, in clear and plain language, including likely consequences, measures taken, and recommendations for protection
All third-party processors have signed Data Processing Agreements (DPAs) including:
Supabase (Database Hosting): DPA in place, GDPR compliant, EU data residency option, sub-processor list provided
Chapa (Payment Processing): DPA in place, PCI DSS compliant, data localization in Ethiopia, GDPR commitments
Telebirr (Payment Processing): DPA in place, local Ethiopian processor, GDPR commitments
All DPAs include: Processing only on documented instructions, confidentiality obligations, security measures (Article 32), sub-processor requirements, data subject rights assistance, deletion or return of data after contract, audit rights, breach notification obligations
Standard Contractual Clauses (SCCs): European Commission approved SCCs, regular review and updates, transfer impact assessments
For each international transfer: Assessment of local laws, evaluation of safeguards, supplementary measures if needed, documentation maintained
To exercise your GDPR rights, contact us:
Email: [email protected]
In-app support
Written mail
Acknowledge: Within 3 business days
Respond: Within 30 days (extendable to 60 days if complex)
Data Protection Officer:
Email: [email protected]
Response time: Within 5 business days
Privacy Team:
Email: [email protected]
Response time: Within 3 business days
Emergency Contact:
For data breaches: [email protected]
24/7 availability
Document Control:
Created: January 4, 2026
Version: 1.0
Next Review: July 4, 2026
Owner: Data Protection Officer