1. Who we are
Elshrouk Center for Physiotherapy & Weight Loss is a physiotherapy clinic located at 24 Tereet El Sawahel St, El Warraq, Giza, Egypt. We are registered and licensed to practice physiotherapy under the Egyptian Ministry of Health. This policy describes how we collect, use, store, and protect your personal and medical data.
2. What we collect
- Contact info: name, phone number, WhatsApp number, email (if provided)
- Medical info: chief complaint, diagnosis, session notes, weight logs, body composition, prescribed programs
- Appointment data: scheduled visits, attendance, session history
- Payment records: invoices, payment methods used (we do not store card numbers — payments are processed by licensed providers)
- Communication: messages you send us via WhatsApp, Facebook Messenger, or Instagram to our clinic accounts
- Application data (for job applicants): CV, phone, schedule preferences, any info you share during the hiring process
3. How we use your data
- Deliver treatment, track progress, and provide continuity of care
- Schedule, remind, and communicate about your appointments
- Send treatment programs, diet plans, and follow-up messages via WhatsApp
- Process payments and issue invoices
- Evaluate job applications
- Improve our clinical protocols (aggregated and anonymized data only)
4. Messaging platforms (WhatsApp, Messenger, Instagram)
When you message our clinic on WhatsApp Business (01025232869), Facebook Messenger (@shroukcenterpt), or Instagram (@shroukcenter), the message content, your profile name, and your platform-specific ID (phone number, PSID, IGSID) are received and stored in our clinic management system to enable our team to reply. We use Meta's WhatsApp Business Platform, Messenger Platform, and Instagram Graph API under their respective terms. We do not share message content with third parties except as required by law.
5. Data storage and security
Patient data is stored on a local clinic server (PostgreSQL on a Mac Mini at our Al-Warraq facility) and a synchronized cloud mirror (Supabase, EU region — aws-1-eu-west-1). Access is restricted to authorized staff with individual login credentials. All network transport uses HTTPS/TLS. Backups are encrypted.
6. Who has access
- Dr. Ahmed Atteito (clinic owner, MSc Physiotherapy, Cairo University) — full access
- Clinic doctors and receptionists — role-scoped access to patients they serve
- Authorized technical contractors — only when debugging specific issues, under signed NDA
- Meta platforms — only metadata required to deliver messages (they do not see clinical notes)
7. Your rights
You have the right to: request a copy of your data, correct inaccuracies, request deletion (subject to medical record retention laws), withdraw consent to marketing messages at any time. To exercise these rights, WhatsApp us at 01025232869 or email [email protected].
8. Retention
Medical records are retained for the period required by Egyptian healthcare regulations (currently 10 years after last visit). Message history is retained for 2 years for care continuity. Job application data is retained for 1 year unless you request earlier deletion.
9. Changes to this policy
We may update this policy. Material changes will be communicated via WhatsApp or at your next visit. The current version is always available at shroukcenter.com/privacy.