Loading page...
The Premier Cloud Clinical & Polyclinic Operating System in Iraq & the Region
DR.IQ Cloud OS v4.2 • EMR & Polyclinic Suite
Loading page...
The Premier Cloud Clinical & Polyclinic Operating System in Iraq & the Region
DR.IQ Cloud OS v4.2 • EMR & Polyclinic Suite
Loading page...
DR.IQ is committed to enforcing world-class security and privacy standards for Electronic Health Records (EHR), clinical workflows, and financial data across medical clinics and healthcare centers in Iraq, guaranteeing 100% clinic data ownership and strict multi-tenant database isolation.
Effective & Last Updated: October 1, 2026All patient records, treatment plans, diagnostic imaging, and financial ledgers remain the exclusive property of the subscribing clinic.
Every medical center operates within a logically and cryptographically isolated database environment preventing cross-tenant data access.
All clinical and operational data is encrypted in transit via TLS 1.3 and at rest via AES-256 with automated encrypted daily backups.
We never sell, rent, broker, or share physician or patient data with advertisers, data brokers, or unauthorized third parties.
This Privacy Policy establishes the legal, architectural, and operational framework governing how DR.IQ ('Platform', 'we', 'us') collects, processes, stores, and safeguards personal and clinical data across dr.iq and all associated cloud dashboards and APIs.
The DR.IQ platform is purpose-built to meet the rigorous confidentiality and integrity standards required by specialty clinics, dental centers, polyclinics, aesthetic centers, and diagnostic laboratories in the Republic of Iraq, aligned with international security benchmarks including ISO/IEC 27001, HIPAA Security & Privacy principles, and GDPR data protection standards.
This Charter applies to all subscribing healthcare organizations (physicians, clinic directors, nursing and accounting personnel, reception staff), website visitors, and authorized implementation partners.
To enable medical centers to manage clinical care and financial operations seamlessly, we process distinct, strictly segregated categories of information:
We adhere strictly to the principle of Data Minimization—collecting and processing only the information necessary to provision, secure, and operate your clinical cloud environment:
Clinic or medical center name, medical specialties, principal physician or authorized director name, official phone numbers, professional email addresses, physical address across Iraqi governorates, and assigned clinic subdomain.
Full names, clinical/administrative roles, Role-Based Access Control (RBAC) permissions, cryptographically hashed credentials, and timestamped session audit logs.
Data entered directly by physicians and authorized clinic staff, including patient demographics, medical history, diagnoses, dental/clinical charts, prescriptions, lab/imaging attachments, and appointment schedules.
Patient invoices, cash and electronic payment records, installment plans, supplier/laboratory ledgers, and clinic SaaS subscription billing records.
IP addresses, browser and OS metadata, session timestamps, and firewall telemetry required to prevent unauthorized access and DDoS attacks.
Clear demarcation of legal authority over patient records and clinical documentation stored within the Platform:
With respect to all patient records, clinical notes, diagnostic files, and financial ledgers entered into the system by a subscribing clinic, the Clinic (or licensed physician) acts as the sole 'Data Controller' and legal owner of such data. DR.IQ acts strictly as a 'Data Processor' operating on behalf of and under the documented configuration of the subscribing Clinic.
DR.IQ personnel do not access, view, modify, or delete patient medical records, except when explicitly authorized via a verified support ticket initiated by the Clinic Director to resolve a specific technical issue. Every support intervention is logged in an immutable audit trail.
Clinical Sovereignty Guarantee: Subscribing clinics are responsible for maintaining standard patient consent practices in accordance with Iraqi medical ethics and applicable healthcare regulations, while DR.IQ is responsible for securing the underlying cloud infrastructure and database isolation.
Information processed by DR.IQ is used strictly for the following operational, clinical, and security purposes:
We never use clinic or patient records for external marketing, profiling, or unauthorized AI training. Processing is strictly limited to:
Deploying isolated clinic databases, enabling selected clinical modules, and synchronizing schedules and medical records in real time.
Delivering automated appointment confirmations, subscription status alerts, and critical security notifications to clinic administrators.
Diagnosing technical anomalies, optimizing database query performance, and maintaining 99.9% platform availability.
Detecting anomalous login attempts, mitigating cyber threats, enforcing multi-layer access controls, and maintaining regulatory audit logs.
Issuing subscription invoices, processing plan renewals or upgrades, and maintaining accurate account billing history.
DR.IQ employs a multi-layered Defense-in-Depth security architecture engineered to protect sensitive healthcare and financial records:
Our production infrastructure undergoes continuous 24/7 security monitoring and enforces the following technical safeguards:
All traffic between clinical devices and DR.IQ servers is encrypted using TLS 1.3, while databases, file attachments, and backups are encrypted at rest using AES-256.
Each subscribing clinic's records are logically and cryptographically isolated, ensuring zero possibility of cross-clinic data leakage.
Clinic Directors define fine-grained permissions per staff member (Physician, Reception, Accountant, Lab) so staff only view authorized modules.
Daily automated, geo-redundant encrypted backups ensure rapid point-in-time recovery in the event of any hardware or network incident.
Every creation, modification, or deletion of a clinical or financial record is logged with user identity, timestamp, and action metadata.
DR.IQ enforces a strict non-disclosure policy prohibiting the sale, sharing, or disclosure of clinic or patient data to third parties, except for essential infrastructure sub-processors:
We never monetize medical databases or contact lists. Technical sub-processing is restricted to vetted infrastructure providers bound by strict Data Processing Agreements (DPAs):
ISO-certified data centers and edge security networks (such as Cloudflare) used to host encrypted workloads and mitigate DDoS attacks.
Encrypted payment processors and SMS/WhatsApp gateways used solely to fulfill clinic transactions or patient appointment reminders.
Data is never disclosed to authorities unless mandated by a final, binding judicial order issued by a competent court in the Republic of Iraq, with prior notice to the affected clinic whenever legally permissible.
Subscribing clinics retain complete authority over the lifecycle, export, and deletion of their clinical archive:
Clinic data remains active and instantaneously accessible throughout the subscription term. Should a clinic choose not to renew or transition to another system, DR.IQ guarantees full Data Portability—allowing the Clinic Director to export all patient records, clinical history, and financial ledgers in standard, non-proprietary formats (Excel / CSV / PDF / JSON) during a 60-day post-expiration grace period.
Upon expiration of the grace period, or immediately upon verified written request from the clinic owner, all clinic data and backups are permanently and irreversibly purged using cryptographic erasure.
DR.IQ empowers subscribing healthcare providers with comprehensive administrative and legal rights over their data:
Clinic Directors and authorized physicians can exercise these rights directly within the Management Dashboard or by contacting our Data Protection Office:
Immediate access to all stored clinical records, financial reports, and staff activity logs.
Modify, update, or correct clinic metadata, staff permissions, and patient records at any time.
Export complete or partial archives of patient files and financial statements without artificial barriers or export fees.
Request restriction of specific data workflows or permanent deletion of the clinic environment upon contract conclusion.
We use essential cryptographic session tokens and local preferences strictly to secure clinical workflows and preserve user settings:
DR.IQ dashboards rely on encrypted authentication tokens (Secure JWT / HTTP-Only Session Tokens) to verify physician and staff identity across clinical modules and to store interface language preferences (Arabic, Kurdish, English) and display themes.
We do not deploy third-party behavioral advertising cookies or cross-site ad trackers inside clinical management dashboards.
We may periodically refine this Charter to reflect technological advancements, enhanced security protocols, and evolving legislative standards:
If material updates are made to how clinical or personal data is processed or secured, we provide advance notice to subscribing Clinic Directors via official email and in-dashboard notifications prior to the effective date.
Continued use of the DR.IQ platform following the effective date constitutes acceptance of the updated Charter, while preserving the clinic's unconditional right to export its data at any time.
For legal inquiries, security compliance documentation, data processing agreements (DPA), or data export/deletion requests, please contact our Data Protection Office: