Privacy Policy

1. Scope and who we are

Darman is a product of FindUs (Private) Limited. This Privacy Policy applies to the Darman mobile application, this website, and related patient, doctor, consultation, communication, and support services. FindUs (Private) Limited operates these services and is who we're referring to throughout this policy.

You can learn more about FindUs (Private) Limited at findus.com.pk.

Darman connects patients with healthcare professionals. While we verify doctor credentials before they appear on Darman, the professional advice, diagnosis, and treatment a doctor provides are their own responsibility, and doctors remain subject to any additional legal duties that apply to medical records and patient confidentiality in their profession.

2. Data safety overview

Health-related information is sensitive. Here is a short summary before the full details below:

3. Information we collect

Information you provide

• Account and identity data: phone number, one-time-password verification, name, email where provided, account role, gender, date of birth, and profile image.
• Doctor profile and verification data: professional title, specialization, qualifications, licence or registration number, experience, consultation fee, biography, introduction media, identity or credential documents, verification status, availability, ratings, and reviews.
• Consultation and booking data (sensitive health information): doctor and patient details, appointment date and time, booking status, consultation notes or information you choose to share, and service history. Treat this as health information under applicable law; we apply additional care to how it is stored, accessed, and shared.
• Communications and media: chat messages, images, videos, voice messages, files, call metadata, reports, reviews, and support correspondence. Audio or video calls are transmitted to enable the consultation; Darman does not intentionally record call content unless users are clearly notified and any required consent is obtained.
• Payment and wallet data: consultation charges, wallet balances, reserved amounts, refunds, and transaction records. Payment providers may collect payment credentials directly under their own policies; Darman does not store full card numbers.

Information collected automatically

• Device and app data: device identifiers, push-notification tokens, operating system, app version, language, IP address, timestamps, diagnostic logs, crash information, and security events.
• Usage data: screens or features used, account activity, booking and call events, and interactions needed to operate, secure, and improve the Services.

We collect camera, microphone, photo, video, or file data only when you use a feature that needs it or grant the relevant permission. Darman does not access contacts, precise location, SMS, or call-log data, and does not use an advertising identifier.

4. How we use information

We process information as necessary to provide the Services, with your consent where required, for legitimate safety and operational purposes, and to meet legal obligations. Uses include:

• creating, authenticating, and managing patient and doctor accounts;
• reviewing doctor credentials and showing verified professional profiles;
• matching users, scheduling consultations, enabling calls and chat, and delivering notifications;
• processing charges, wallet activity, refunds, and financial reconciliation;
• providing customer support and handling account-deletion, privacy, safety, and dispute requests;
• preventing fraud, impersonation, harassment, abuse, security incidents, and violations of our Terms;
• maintaining, diagnosing, measuring, and improving the reliability and accessibility of Darman; and
• complying with professional, tax, accounting, court, regulatory, and other lawful requirements.

We do not use consultation notes, medical, or health information for advertising, and we do not build advertising or marketing profiles from it. We will ask for permission before using sensitive information for a materially different purpose where the law requires it.

5. How we share information

We share only what is reasonably necessary, and we never sell personal or health information. Categories of recipients:

• Between patients and doctors: profile, booking, consultation, availability, rating, and communication information needed to arrange and deliver care.
• Service providers (processors): infrastructure, authentication, storage, notifications, calls, messaging, verification, diagnostics, support, and payment services. Current technology providers may include Supabase, Google Firebase, Agora, and Twilio. They may only use information to provide these services to us and process it under contractual confidentiality and security obligations.
• Safety and legal compliance: authorities, courts, regulators, professional bodies, or affected parties when reasonably necessary to comply with law, protect life or safety, investigate misconduct, enforce our Terms, or defend legal rights.
• Business changes: a successor or adviser in connection with a merger, financing, reorganisation, or sale, subject to appropriate confidentiality and continued protection.
• With your direction: another person or service when you ask us to share information or clearly consent.

Public doctor profiles and user-submitted ratings or reviews may be visible to other Darman users. Do not include unnecessary health or identifying information in public content.

6. Device permissions

Darman requests device permissions only when a specific feature needs them, and each permission can be turned off at any time in your device settings.

Some features will not work without the permission they require. We do not request contacts, precise location, SMS, or call-log access.

7. Retention and deletion

We keep information only for as long as needed to provide the Services, maintain account and transaction integrity, resolve disputes, protect users, enforce agreements, and meet medical, professional, tax, accounting, or other legal obligations. Retention periods vary by record type and applicable law.

When information is no longer required, we delete it, anonymise it, or securely isolate it until deletion is possible. Encrypted backups may retain residual copies for a limited period before routine overwrite. Anonymised information that can no longer identify you may be retained for service analysis.

You can request account deletion at any time through our account-deletion page. This removes your account and associated personal data, subject to the legal retention exceptions above. Deleting the app from a device does not delete the account.

8. Security and international transfers

We use reasonable administrative, technical, and organisational safeguards designed to protect information, including access controls, authenticated services, encryption in transit, restricted storage, and monitoring. No internet or storage system is completely secure, so we cannot guarantee absolute security.

Our providers may process information in countries other than your own. Where required, we use appropriate contractual or legal safeguards for cross-border processing. Never share a one-time password, password, or account-access code with another person — Darman staff will never ask you for it.

9. Your rights and choices

Depending on applicable law, you may ask to access, correct, update, export, restrict, object to processing of, or delete your personal information, and you may withdraw consent where processing relies on consent. You can update some profile details in the app and control device permissions through system settings.

To protect users, we may verify your identity and account ownership before completing a request. Some rights are subject to lawful exceptions, including records that must be retained for care, fraud prevention, financial reporting, disputes, or legal compliance.

Send a privacy request to contact@findus.com.pk. We will respond within the period required by applicable law.

10. Children and dependent patients

Darman accounts are intended for people legally able to agree to these terms and are not directed at children. A parent or legal guardian must manage an account or provide consent when required for a minor or dependent patient. Do not create an independent child account or submit a child's information without appropriate authority. If we learn that a child's account or information was created without appropriate consent, we will take steps to remove it. Contact us if you believe a child's information was provided improperly.

11. Changes and contact

We may update this policy when our Services, providers, or legal obligations change. The effective date at the top shows the latest revision. If a change materially affects your rights, we will provide appropriate notice through the app, website, or registered contact details before it takes effect.

Questions, complaints, and privacy requests can be sent to contact@findus.com.pk. Include the phone number registered to your account, but never include a password or one-time verification code.