{"id":129,"date":"2026-07-20T10:49:40","date_gmt":"2026-07-20T10:49:40","guid":{"rendered":"https:\/\/link.theprivateclinic.me\/?page_id=129"},"modified":"2026-09-19T07:41:12","modified_gmt":"2026-09-19T07:41:12","slug":"aura-privacy-policy","status":"publish","type":"page","link":"https:\/\/link.theprivateclinic.me\/ar\/aura-privacy-policy\/","title":{"rendered":"Aura \u2014 Privacy Policy"},"content":{"rendered":"<h1 class=\"wp-block-heading\"><\/h1>\n\n\n\n<p class=\"wp-block-paragraph\"><strong>Version 1.0 \u00b7 Effective date: 20 July 2026<\/strong> <strong>Operator:<\/strong> The Private Clinic \u2014 \u0627\u0644\u0639\u064a\u0627\u062f\u0629 \u0627\u0644\u0634\u062e\u0635\u064a\u0629 \u0627\u0644\u0637\u0628\u064a\u0629, a company registered in the Hashemite Kingdom of Jordan, Company No. 75818, National Establishment ID 200204705 (&#8220;<strong>\u0623\u0648\u0631\u0627<\/strong>&#8220;, &#8220;<strong>we<\/strong>&#8220;, &#8220;<strong>us<\/strong>&#8220;). <strong>Contact \/ Privacy Officer:<\/strong> care@theprivateclinic.me<\/p>\n\n\n\n<hr class=\"wp-block-separator has-alpha-channel-opacity\"\/>\n\n\n\n<h2 class=\"wp-block-heading\">1 \u00b7 Who this policy covers, and the three roles<\/h2>\n\n\n\n<p class=\"wp-block-paragraph\">Aura is a booking, practice-management and electronic-records platform operated on <strong>link.theprivateclinic.me<\/strong> and connected to <strong>care.theprivateclinic.me<\/strong> (together, the &#8220;<strong>\u0627\u0644\u0645\u0646\u0635\u0629<\/strong>&#8220;). Three parties interact on it, and this policy is explicit about who is responsible for what \u2014 this allocation of roles is the foundation of the entire document:<\/p>\n\n\n\n<ul class=\"wp-block-list\">\n<li><strong>\u0645\u0642\u062f\u0645\u0648 \u0627\u0644\u062e\u062f\u0645\u0627\u062a<\/strong> \u2014 healthcare and wellness professionals who create an account, publish a public booking page, and manage clients. For their own account data, Aura is the <strong>data controller<\/strong>. For the client and patient records a Provider creates or collects through the Platform, <strong>the Provider is the data controller and Aura acts strictly as a data processor<\/strong> on the Provider&#8217;s documented instructions.<\/li>\n\n\n\n<li><strong>Clients \/ patients<\/strong> \u2014 people who book sessions with a Provider. Their platform account data (login, bookings) is controlled by Aura; their <strong>health information (session notes, medications, chart entries) is controlled by the treating Provider<\/strong>.<\/li>\n\n\n\n<li><strong>Visitors<\/strong> \u2014 anyone who views a public Provider page without booking.<\/li>\n<\/ul>\n\n\n\n<p class=\"wp-block-paragraph\">By creating a Provider account or booking a session, you accept this policy. If you do not accept it, do not use the Platform.<\/p>\n\n\n\n<hr class=\"wp-block-separator has-alpha-channel-opacity\"\/>\n\n\n\n<h2 class=\"wp-block-heading\">2 \u00b7 Data we collect<\/h2>\n\n\n\n<h3 class=\"wp-block-heading\">2.1 From Providers<\/h3>\n\n\n\n<ul class=\"wp-block-list\">\n<li><strong>Identity &amp; profile:<\/strong> name, email, phone, professional credentials, specialty, biography, profile photo, page handle, tagline, gallery media, and any content you choose to publish.<\/li>\n\n\n\n<li><strong>Practice configuration:<\/strong> services, prices and currencies, working hours, special days, blocked times, timezone, language preference, page appearance settings.<\/li>\n\n\n\n<li><strong>Business &amp; billing:<\/strong> subscription plan, plan dates and trial status, Site 2 (WooCommerce) order history for plan purchases, commission percentage applicable to your plan, coupon configurations.<\/li>\n\n\n\n<li><strong>Payout details:<\/strong> bank name, branch, beneficiary name, account number, IBAN, SWIFT, bank address and country \u2014 collected <strong>solely<\/strong> to execute payouts you request.<\/li>\n\n\n\n<li><strong>Integration credentials:<\/strong> OAuth tokens for Google Calendar and Microsoft Calendar (we store tokens, never your passwords), your Zoom meeting link, webhook URLs you configure, and advertising pixel IDs you enter.<\/li>\n\n\n\n<li><strong>Team data:<\/strong> roles and memberships (owner, provider, assistant) and invitation email addresses.<\/li>\n<\/ul>\n\n\n\n<h3 class=\"wp-block-heading\">2.2 From Clients \/ patients<\/h3>\n\n\n\n<ul class=\"wp-block-list\">\n<li><strong>Account data:<\/strong> name, email address and login credentials (passwords are hashed by WordPress; we never store them in readable form).<\/li>\n\n\n\n<li><strong>Booking data:<\/strong> the service booked, date and time, timezone, booking status, payment amount and currency, package credits, and idempotency identifiers used to prevent duplicate bookings.<\/li>\n\n\n\n<li><strong>Health records (special-category data):<\/strong> session notes, chart entries, medication records and any clinical information the treating Provider enters. <strong>These are entered by and belong to the Provider&#8217;s clinical relationship with the patient.<\/strong> They are never displayed to the client through the Platform, never used by Aura for any purpose other than storage and display to the authorized Provider, and never used for advertising, profiling or model training.<\/li>\n\n\n\n<li><strong>Communications:<\/strong> booking-related emails we send on the Provider&#8217;s behalf, invitations and nudges the Provider triggers.<\/li>\n<\/ul>\n\n\n\n<h3 class=\"wp-block-heading\">2.3 From Visitors and all users (technical data)<\/h3>\n\n\n\n<ul class=\"wp-block-list\">\n<li><strong>Cookies we set:<\/strong> <code>aura_pref_lang<\/code>, <code>aura_lang_applied<\/code>, <code>aura_lang_auto<\/code> (language preference), <code>aura_client_tz<\/code> (your timezone, so session times display correctly), and standard WordPress session cookies for logged-in users.<\/li>\n\n\n\n<li><strong>Local storage:<\/strong> interface state only \u2014 guided-tour progress, dismissed banners. No tracking identifiers.<\/li>\n\n\n\n<li><strong>Usage analytics:<\/strong> page views and link clicks on public Provider pages, aggregated for the Provider&#8217;s own analytics dashboard. We do not build cross-site profiles.<\/li>\n\n\n\n<li><strong>Logs:<\/strong> server logs and an internal diagnostic log (IP address, timestamps, request context) retained for security and troubleshooting.<\/li>\n<\/ul>\n\n\n\n<p class=\"wp-block-paragraph\">We do <strong>not<\/strong> collect: government ID numbers, biometric data, or precise geolocation. Payment card numbers never touch Aura&#8217;s systems (\u00a75).<\/p>\n\n\n\n<hr class=\"wp-block-separator has-alpha-channel-opacity\"\/>\n\n\n\n<h2 class=\"wp-block-heading\">3 \u00b7 Why we process data, and on what legal basis<\/h2>\n\n\n\n<figure class=\"wp-block-table\"><table class=\"has-fixed-layout\"><thead><tr><th>Purpose<\/th><th>Data used<\/th><th>Legal basis<\/th><\/tr><\/thead><tbody><tr><td>Operating your account and the booking engine<\/td><td>Profile, practice, booking data<\/td><td>Performance of contract<\/td><\/tr><tr><td>Storing and displaying patient records to the authorized Provider<\/td><td>Health records<\/td><td><strong>Processor acting on Provider&#8217;s instructions<\/strong>; the Provider must hold a lawful basis (typically the treatment relationship and applicable medical-records law)<\/td><\/tr><tr><td>Publishing the public page you configure<\/td><td>Data you choose to publish<\/td><td>Performance of contract; your explicit direction (\u00a74)<\/td><\/tr><tr><td>Payouts and plan billing<\/td><td>Payout details, order history<\/td><td>Performance of contract; legal obligations (accounting)<\/td><\/tr><tr><td>Transactional email (confirmations, reminders, receipts, security notices)<\/td><td>Contact + booking data<\/td><td>Performance of contract \/ legitimate interest<\/td><\/tr><tr><td>Product announcements to Providers<\/td><td>Provider email<\/td><td>Legitimate interest, <strong>with opt-out<\/strong> (\u00a79)<\/td><\/tr><tr><td>Security, fraud prevention, abuse response, account-lock protection<\/td><td>Technical data, logs<\/td><td>Legitimate interest \/ legal obligation<\/td><\/tr><tr><td>Legal compliance and defense of claims<\/td><td>Minimum necessary<\/td><td>Legal obligation \/ legitimate interest<\/td><\/tr><\/tbody><\/table><\/figure>\n\n\n\n<p class=\"wp-block-paragraph\">We do <strong>not<\/strong> sell personal data, rent it, or share it with data brokers \u2014 in any jurisdiction, under any revenue model.<\/p>\n\n\n\n<hr class=\"wp-block-separator has-alpha-channel-opacity\"\/>\n\n\n\n<h2 class=\"wp-block-heading\">4 \u00b7 Public information \u2014 what you publish is public<\/h2>\n\n\n\n<p class=\"wp-block-paragraph\">When a Provider publishes a page at <code>\/@handle<\/code>, everything on it \u2014 name, photo, credentials, bio, services, prices, availability, posts and links \u2014 is <strong>publicly accessible on the internet<\/strong>, indexable by search engines, and shareable by anyone. In addition:<\/p>\n\n\n\n<ul class=\"wp-block-list\">\n<li>Link previews shared in messaging apps display a <strong>QR code image encoding your page address<\/strong> (generated by a third-party QR service that receives only the page URL \u2014 never client or health data).<\/li>\n\n\n\n<li>If you create a short link, the destination page URL is shared with the shortening service you selected through the Platform.<\/li>\n\n\n\n<li>Your page handle appears in URLs; choose it accordingly.<\/li>\n<\/ul>\n\n\n\n<p class=\"wp-block-paragraph\"><strong>You control this exposure.<\/strong> Unpublishing content, deactivating a service, or deleting your account removes the material from the Platform, but Aura cannot recall copies already cached by search engines, messaging apps or third parties. <strong>Never place client or patient information on your public page.<\/strong> Doing so violates this policy and your professional obligations, and responsibility for such publication rests solely with you.<\/p>\n\n\n\n<hr class=\"wp-block-separator has-alpha-channel-opacity\"\/>\n\n\n\n<h2 class=\"wp-block-heading\">5 \u00b7 Payments<\/h2>\n\n\n\n<p class=\"wp-block-paragraph\">Client payments and plan purchases are processed by the payment processors connected to care.theprivateclinic.me \u2014 HyperPay, PayTabs, Paymob and Zbooni. Card and wallet credentials are collected <strong>directly by those processors<\/strong> under their own privacy policies; Aura receives only the order outcome, amount, currency and status. Payout bank details are stored for the sole purpose of transferring your earnings and are visible only to you and authorized Aura payout administrators.<\/p>\n\n\n\n<hr class=\"wp-block-separator has-alpha-channel-opacity\"\/>\n\n\n\n<h2 class=\"wp-block-heading\">6 \u00b7 Patient records: confidentiality architecture<\/h2>\n\n\n\n<p class=\"wp-block-paragraph\">This section governs the electronic records feature and is deliberately strict.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\"><strong>6.1 Ownership and control.<\/strong> The treating Provider is the controller of every chart entry, session note and medication record they create. Aura stores this data, displays it to the authorized Provider, and does nothing else with it.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\"><strong>6.2 Access control, as enforced in software.<\/strong><\/p>\n\n\n\n<ul class=\"wp-block-list\">\n<li>Clinical charts are visible <strong>only to the Provider who owns the client relationship<\/strong> (and, where a practice owner legitimately administers a team member&#8217;s practice, to that owner).<\/li>\n\n\n\n<li><strong>Assistants (front desk) can never access clinical charts, notes, medications, revenue or content<\/strong> \u2014 this is enforced both in navigation and at the API permission layer.<\/li>\n\n\n\n<li>\u0627\u0644\u0639\u0645\u0644\u0627\u0621 <strong>cannot<\/strong> see Provider notes through any Platform interface.<\/li>\n<\/ul>\n\n\n\n<p class=\"wp-block-paragraph\"><strong>6.3 No secondary use.<\/strong> Aura does not read, analyze, mine, sell, or train any system on patient records. Aggregated, non-identifying operational statistics (e.g., total bookings across the platform) never include clinical content.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\"><strong>6.4 Data Processing Addendum.<\/strong> Providers processing patient data through Aura are bound by the Data Processing Addendum published alongside this policy, which forms part of the Terms of Service and specifies processing instructions, sub-processors, security measures, breach assistance and deletion terms. <strong>If you do not accept the DPA, do not enter patient data into the Platform.<\/strong><\/p>\n\n\n\n<p class=\"wp-block-paragraph\"><strong>6.5 Provider warranties.<\/strong> By entering any client or patient data, the Provider warrants that they: (a) hold a lawful basis and, where required, valid consent for that processing; (b) comply with the medical-records, professional-secrecy and licensing laws of every jurisdiction in which they practice; (c) will provide their own patient-facing privacy notice where required by law; and (d) will not enter data of any person with whom they have no genuine professional relationship. <strong>The Provider indemnifies Aura against claims arising from the Provider&#8217;s breach of these warranties<\/strong>, per the Terms of Service.<\/p>\n\n\n\n<hr class=\"wp-block-separator has-alpha-channel-opacity\"\/>\n\n\n\n<h2 class=\"wp-block-heading\">7 \u00b7 Integrations \u2014 data leaves the Platform only at your direction<\/h2>\n\n\n\n<p class=\"wp-block-paragraph\">Every integration below is <strong>off by default<\/strong> and activates only when a Provider connects or configures it. When you connect an integration, you instruct Aura to transmit the described data to that third party, whose own privacy policy then governs it:<\/p>\n\n\n\n<figure class=\"wp-block-table\"><table class=\"has-fixed-layout\"><thead><tr><th>Integration<\/th><th>What is shared when YOU enable it<\/th><\/tr><\/thead><tbody><tr><td><strong>\u062a\u0642\u0648\u064a\u0645 \u062c\u0648\u062c\u0644<\/strong><\/td><td>Booking events (time, service name, and the client identifier <strong>you configure \u2014 either the client&#8217;s full name or an anonymous label<\/strong>) are written to your Google calendar; busy times may be read to block double-booking. Governed by Google&#8217;s policy; revocable in Settings \u2192 Integrations or your Google account.<\/td><\/tr><tr><td><strong>Microsoft \/ Outlook Calendar<\/strong><\/td><td>Same scope as Google, to your Microsoft account.<\/td><\/tr><tr><td><strong>The Private Clinic listing sync<\/strong><\/td><td>Your <strong>public<\/strong> profile and service data sync to your listing on care.theprivateclinic.me. No clinical data is ever synced.<\/td><\/tr><tr><td><strong>Booking Webhook (Make.com, Zapier, n8n\u2026)<\/strong><\/td><td>Booking event payloads (client name, email, service, time, status) are sent to the URL <strong>you<\/strong> provide. <strong>You are the controller of this transfer<\/strong>: you must ensure the receiving system is secure and lawful. Aura is not responsible for data once delivered to your endpoint.<\/td><\/tr><tr><td><strong>Zoom<\/strong><\/td><td>Your meeting link is embedded in booking confirmations and Join buttons. Session content is governed by Zoom&#8217;s policy.<\/td><\/tr><tr><td><strong>Marketing pixels (Google, Meta, TikTok\u2026)<\/strong><\/td><td>If you enter pixel IDs, those vendors&#8217; scripts run <strong>on your public page only \u2014 never on the dashboard and never on any page containing clinical data<\/strong> \u2014 and collect visitor data under <strong>your<\/strong> responsibility as the party deploying them. You must ensure your use of pixels (including any consent banner obligations) is lawful in your market.<\/td><\/tr><tr><td><strong>URL shortener \/ QR services<\/strong><\/td><td>Receive only the public page URL.<\/td><\/tr><tr><td><strong>Push notifications (mobile app)<\/strong><\/td><td>A device token is stored to deliver booking notifications to your device.<\/td><\/tr><\/tbody><\/table><\/figure>\n\n\n\n<p class=\"wp-block-paragraph\"><strong>Sub-processors used by Aura itself<\/strong> (hosting, email delivery, infrastructure): <strong>Hostinger<\/strong> (hosting and email delivery). We will update this policy before adding any sub-processor that touches personal data.<\/p>\n\n\n\n<hr class=\"wp-block-separator has-alpha-channel-opacity\"\/>\n\n\n\n<h2 class=\"wp-block-heading\">8. AI Provider and AI-Assisted Features<\/h2>\n\n\n\n<p class=\"wp-block-paragraph\">Aura includes an optional Provider Copilot feature that assists providers with practice-management and clinical documentation tasks.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">When a provider uses Aura AI, Aura may send the information necessary to answer that provider&#8217;s request to the AI service configured by Aura&#8217;s administrator. The current Aura AI implementation is designed to use OpenAI&#8217;s API as its external AI service.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">Depending on the provider&#8217;s request, information sent to the AI service may include provider practice information, booking and scheduling information, and client information that the provider is authorized to access, including clinical documentation such as SOAP notes and assignments.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">Aura AI is a provider-assistance feature. It does not independently diagnose, prescribe, make autonomous clinical decisions, or write information into a client&#8217;s clinical record without an authorized user action.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">Aura does not use client clinical records obtained through Aura AI to advertise, sell to data brokers, or train generalized AI models. AI-generated responses are presented as drafts for provider review.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">Google Calendar information is not used as input to Aura AI. Google Calendar event contents, calendar availability information, and other Google Calendar data obtained through the Google Calendar integration are handled separately for calendar synchronization and scheduling functionality and are not intentionally transmitted to Aura AI or the AI provider.<\/p>\n\n\n\n<hr class=\"wp-block-separator has-alpha-channel-opacity\"\/>\n\n\n\n<h2 class=\"wp-block-heading\">9. Google Calendar Data<\/h2>\n\n\n\n<p class=\"wp-block-paragraph\">When a provider connects Google Calendar, Aura requests access to the Google Calendar permission required for its calendar synchronization features.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">Aura uses Google Calendar data only to provide the calendar functionality requested by the provider, including:<\/p>\n\n\n\n<ul class=\"wp-block-list\">\n<li>creating booking events in the provider&#8217;s selected Google Calendar;<\/li>\n\n\n\n<li>updating existing Aura booking events when a booking is rescheduled or its relevant calendar information changes;<\/li>\n\n\n\n<li>removing Aura booking events when applicable;<\/li>\n\n\n\n<li>reading calendar events during the relevant scheduling period to identify busy times and help prevent double-booking.<\/li>\n<\/ul>\n\n\n\n<p class=\"wp-block-paragraph\">Aura currently requests the Google Calendar scope:<\/p>\n\n\n\n<p class=\"wp-block-paragraph\"><a href=\"https:\/\/www.googleapis.com\/auth\/calendar.events\">https:\/\/www.googleapis.com\/auth\/calendar.events<\/a><\/p>\n\n\n\n<p class=\"wp-block-paragraph\">Aura does not request Google Calendar permissions that are not required by these features.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">Google Calendar event data is not used for advertising, sold to third parties, or used to create, train, or improve generalized artificial intelligence or machine-learning models.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">Google Calendar data is not intentionally transferred to Aura&#8217;s AI provider for AI processing or model training.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">The provider can disconnect Google Calendar from Aura at any time through Aura&#8217;s integration settings or through their Google Account permissions.<\/p>\n\n\n\n<hr class=\"wp-block-separator has-alpha-channel-opacity\"\/>\n\n\n\n<h2 class=\"wp-block-heading\">10. Google Limited Use Commitment<\/h2>\n\n\n\n<p class=\"wp-block-paragraph\">Aura&#8217;s use and transfer of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">Aura limits its use of Google Calendar data to providing the calendar synchronization and scheduling features described above. Google Calendar data is not used for advertising, sold to data brokers, or used to create, train, or improve generalized artificial intelligence or machine-learning models.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">Access to Google Calendar data is limited to the purposes described in this Privacy Policy and to the operation, security, and support of the requested Aura calendar functionality.<\/p>\n\n\n\n<hr class=\"wp-block-separator has-alpha-channel-opacity\"\/>\n\n\n\n<h2 class=\"wp-block-heading\">11. AI Service Data Protection<\/h2>\n\n\n\n<p class=\"wp-block-paragraph\">Aura&#8217;s AI feature is separate from the Google Calendar integration. Google Calendar data is not intentionally supplied to the AI service.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">Where client or clinical information is submitted to the configured AI service through Aura AI, that processing occurs only when an authorized provider uses the AI feature. The AI service and applicable account or service terms may govern processing of that information. Aura will maintain appropriate contractual, technical, and organizational safeguards for such processing.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">The AI provider currently configured for Aura should be identified in the application&#8217;s current privacy disclosures and reviewed whenever the configured AI provider, endpoint, processing terms, or data-handling arrangements change.<\/p>\n\n\n\n<hr class=\"wp-block-separator has-alpha-channel-opacity\"\/>\n\n\n\n<h2 class=\"wp-block-heading\">12 \u00b7 International transfers<\/h2>\n\n\n\n<p class=\"wp-block-paragraph\">The Platform is hosted with Hostinger. Providers and clients may access it from anywhere. Where personal data is transferred across borders \u2014 including to integration vendors you enable under \u00a77 \u2014 we rely on contractual safeguards and the transfer provisions of Jordan&#8217;s Personal Data Protection Law No. 24 of 2023, and we respect the data-protection laws applicable where our users reside (including the Saudi PDPL and Egypt&#8217;s Law No. 151 of 2020 for users in those markets). Provider-directed transfers (webhooks, calendars, pixels) are made at the Provider&#8217;s instruction and responsibility.<\/p>\n\n\n\n<hr class=\"wp-block-separator has-alpha-channel-opacity\"\/>\n\n\n\n<h2 class=\"wp-block-heading\">13 \u00b7 Marketing communications<\/h2>\n\n\n\n<ul class=\"wp-block-list\">\n<li><strong>Transactional messages<\/strong> (booking confirmations, payment receipts, payout receipts, security alerts, plan and trial notices) are part of operating the service and <strong>cannot be opted out of<\/strong> while you hold an account, because the service cannot function safely without them.<\/li>\n\n\n\n<li><strong>Non-essential announcements<\/strong> to Providers include an unsubscribe link; opting out is honored platform-wide via our suppression list.<\/li>\n\n\n\n<li><strong>We never email a Provider&#8217;s clients for Aura&#8217;s own marketing.<\/strong> Client emails exist to serve the Provider\u2013client relationship only.<\/li>\n\n\n\n<li>Booking-related emails sent &#8220;from&#8221; a Provider are sent on that Provider&#8217;s behalf as processor.<\/li>\n<\/ul>\n\n\n\n<hr class=\"wp-block-separator has-alpha-channel-opacity\"\/>\n\n\n\n<h2 class=\"wp-block-heading\">14 \u00b7 Cookies and similar technologies<\/h2>\n\n\n\n<p class=\"wp-block-paragraph\">We use only the functional cookies and local-storage keys listed in \u00a72.3. We set <strong>no advertising or cross-site tracking cookies of our own<\/strong>. Third-party cookies can appear in exactly two situations: (a) on a Provider&#8217;s public page where that Provider has deployed marketing pixels (\u00a77 \u2014 the Provider&#8217;s responsibility, including any consent requirements), and (b) embedded content such as YouTube video covers a Provider adds to their page. Blocking cookies in your browser may break language preference and sign-in.<\/p>\n\n\n\n<hr class=\"wp-block-separator has-alpha-channel-opacity\"\/>\n\n\n\n<h2 class=\"wp-block-heading\">15 \u00b7 Security<\/h2>\n\n\n\n<p class=\"wp-block-paragraph\">We apply layered safeguards: encrypted transport (HTTPS) across the Platform; hashed credentials; role-based access control enforced at the API layer (including the assistant restrictions in \u00a76.2); brute-force lockout after repeated failed logins with administrator-controlled unlock; nonce-verified authenticated API requests; least-privilege administrative access; and diagnostic logging for incident investigation. No system is impenetrable; \u00a713 describes our breach response.<\/p>\n\n\n\n<hr class=\"wp-block-separator has-alpha-channel-opacity\"\/>\n\n\n\n<h2 class=\"wp-block-heading\">16 \u00b7 Retention and deletion<\/h2>\n\n\n\n<figure class=\"wp-block-table\"><table class=\"has-fixed-layout\"><thead><tr><th>Data<\/th><th>Retention<\/th><\/tr><\/thead><tbody><tr><td>Provider account &amp; practice data<\/td><td>Life of the account + 90 days, then deleted or anonymized<\/td><\/tr><tr><td>Patient records<\/td><td>Retained per the <strong>treating Provider&#8217;s instructions and the medical-records retention law of the Provider&#8217;s place of practice under their license<\/strong> \u2014 the Provider is responsible for knowing that obligation. Records are deleted or exported <strong>upon the Provider&#8217;s request, never automatically<\/strong>, so that no lawful retention duty is ever breached by an automated purge.<\/td><\/tr><tr><td>Bookings &amp; financial records<\/td><td>7 years, for accounting and tax law<\/td><\/tr><tr><td>Payout bank details<\/td><td>Until removed by the Provider or 90 days after the last payout<\/td><\/tr><tr><td>Server &amp; diagnostic logs<\/td><td>90 days<\/td><\/tr><tr><td>Email suppression list<\/td><td>Indefinitely (it exists to honor your opt-out)<\/td><\/tr><tr><td>Backups<\/td><td>Rolling 90-day cycle; deleted data ages out of backups within that cycle<\/td><\/tr><\/tbody><\/table><\/figure>\n\n\n\n<hr class=\"wp-block-separator has-alpha-channel-opacity\"\/>\n\n\n\n<h2 class=\"wp-block-heading\">17 \u00b7 Data breach response<\/h2>\n\n\n\n<p class=\"wp-block-paragraph\">If we become aware of a breach affecting personal data, we will: contain and investigate; notify the competent authority where required by applicable law and within its deadline; notify affected Providers <strong>so they can meet their own controller obligations toward patients<\/strong>; and document the incident. Providers must promptly notify us at care@theprivateclinic.me of any suspected compromise of their account or endpoints.<\/p>\n\n\n\n<hr class=\"wp-block-separator has-alpha-channel-opacity\"\/>\n\n\n\n<h2 class=\"wp-block-heading\">18 \u00b7 Your rights<\/h2>\n\n\n\n<p class=\"wp-block-paragraph\">Subject to applicable law, Providers and clients may request: access to their data, correction, deletion, restriction, portability, and objection to processing based on legitimate interest, and may withdraw consent where consent is the basis (withdrawal does not undo prior lawful processing).<\/p>\n\n\n\n<p class=\"wp-block-paragraph\"><strong>Routing rule that prevents disputes:<\/strong> requests concerning <strong>clinical records must be directed to the treating Provider<\/strong>, who controls them; Aura will assist the Provider as processor. Requests concerning platform account data go to care@theprivateclinic.me. We answer within 30 days, may verify identity first, and will explain any legal ground on which a request is declined (e.g., a medical-records retention law that overrides deletion). You may lodge a complaint with your supervisory authority.<\/p>\n\n\n\n<hr class=\"wp-block-separator has-alpha-channel-opacity\"\/>\n\n\n\n<h2 class=\"wp-block-heading\">19 \u00b7 Children<\/h2>\n\n\n\n<p class=\"wp-block-paragraph\">The Platform is not directed at children. Account holders \u2014 Provider or client \u2014 must be <strong>18 years of age or older<\/strong>. A Provider account holder must additionally be licensed or qualified to offer their services. Where a Provider treats minors, <strong>the Provider is responsible for obtaining guardian consent as required by law<\/strong>; booking accounts must be created by an adult guardian.<\/p>\n\n\n\n<hr class=\"wp-block-separator has-alpha-channel-opacity\"\/>\n\n\n\n<h2 class=\"wp-block-heading\">21 \u00b7 What this policy does not cover<\/h2>\n\n\n\n<p class=\"wp-block-paragraph\">Third-party sites reached through links on Provider pages; the independent practices of integration vendors you enable; the content of communications between Provider and client outside the Platform; and care.theprivateclinic.me&#8217;s own storefront policies, which are published separately.<\/p>\n\n\n\n<hr class=\"wp-block-separator has-alpha-channel-opacity\"\/>\n\n\n\n<h2 class=\"wp-block-heading\">22 \u00b7 Changes<\/h2>\n\n\n\n<p class=\"wp-block-paragraph\">We may amend this policy. Material changes will be announced to account holders (dashboard notice and\/or email) at least 14 days before taking effect; the &#8220;Effective date&#8221; above always reflects the current version. Continued use after the effective date constitutes acceptance.<\/p>\n\n\n\n<hr class=\"wp-block-separator has-alpha-channel-opacity\"\/>\n\n\n\n<h2 class=\"wp-block-heading\">23 \u00b7 Contact<\/h2>\n\n\n\n<p class=\"wp-block-paragraph\">Privacy questions, rights requests and complaints: <strong><a href=\"mailto:care@theprivateclinic.me\">care@theprivateclinic.me<\/a><\/strong> (The Private Clinic \u2014 \u0627\u0644\u0639\u064a\u0627\u062f\u0629 \u0627\u0644\u0634\u062e\u0635\u064a\u0629 \u0627\u0644\u0637\u0628\u064a\u0629, Company No. 75818, Jordan).<\/p>","protected":false},"excerpt":{"rendered":"<p>Version 1.0 \u00b7 Effective date: 20 July 2026 Operator: The Private Clinic \u2014 \u0627\u0644\u0639\u064a\u0627\u062f\u0629 \u0627\u0644\u0634\u062e\u0635\u064a\u0629 \u0627\u0644\u0637\u0628\u064a\u0629, a company registered in the Hashemite Kingdom of Jordan, Company No. 75818, National Establishment ID 200204705 (&#8220;Aura&#8220;, &#8220;we&#8220;, &#8220;us&#8220;). Contact \/ Privacy Officer: care@theprivateclinic.me 1 \u00b7 Who this policy covers, and the three roles Aura is a booking, practice-management [&hellip;]<\/p>\n","protected":false},"author":1,"featured_media":0,"parent":0,"menu_order":0,"comment_status":"closed","ping_status":"closed","template":"","meta":{"footnotes":""},"class_list":["post-129","page","type-page","status-publish","hentry"],"yoast_head":"<!-- This site is optimized with the Yoast SEO plugin v28.6 - https:\/\/yoast.com\/product\/yoast-seo-wordpress\/ -->\n<title>Aura \u2014 Privacy Policy | Aura | The Private Clinic | Booking Link in Bio<\/title>\n<meta name=\"robots\" content=\"index, follow, max-snippet:-1, max-image-preview:large, max-video-preview:-1\" \/>\n<link rel=\"canonical\" href=\"https:\/\/link.theprivateclinic.me\/ar\/aura-privacy-policy\/\" \/>\n<meta property=\"og:locale\" content=\"ar_AR\" \/>\n<meta property=\"og:type\" content=\"article\" \/>\n<meta property=\"og:title\" content=\"Aura \u2014 Privacy Policy | Aura | The Private Clinic | Booking Link in Bio\" \/>\n<meta property=\"og:description\" content=\"Version 1.0 \u00b7 Effective date: 20 July 2026 Operator: The Private Clinic \u2014 \u0627\u0644\u0639\u064a\u0627\u062f\u0629 \u0627\u0644\u0634\u062e\u0635\u064a\u0629 \u0627\u0644\u0637\u0628\u064a\u0629, a company registered in the Hashemite Kingdom of Jordan, Company No. 75818, National Establishment ID 200204705 (&#8220;Aura&#8220;, &#8220;we&#8220;, &#8220;us&#8220;). Contact \/ Privacy Officer: care@theprivateclinic.me 1 \u00b7 Who this policy covers, and the three roles Aura is a booking, practice-management [&hellip;]\" \/>\n<meta property=\"og:url\" content=\"https:\/\/link.theprivateclinic.me\/ar\/aura-privacy-policy\/\" \/>\n<meta property=\"og:site_name\" content=\"Aura | The Private Clinic | Booking Link in Bio\" \/>\n<meta property=\"article:modified_time\" content=\"2026-09-19T07:41:12+00:00\" \/>\n<meta property=\"og:image\" content=\"https:\/\/link.theprivateclinic.me\/wp-content\/uploads\/sites\/4\/2026\/07\/Provider-Onboarding-Launch-Ad-3-\u2014-Full-bleed-Overlay.png\" \/>\n\t<meta property=\"og:image:width\" content=\"1080\" \/>\n\t<meta property=\"og:image:height\" content=\"1350\" \/>\n\t<meta property=\"og:image:type\" content=\"image\/png\" \/>\n<meta name=\"twitter:card\" content=\"summary_large_image\" \/>\n<meta name=\"twitter:label1\" content=\"\u0648\u0642\u062a \u0627\u0644\u0642\u0631\u0627\u0621\u0629 \u0627\u0644\u0645\u064f\u0642\u062f\u0651\u0631\" \/>\n\t<meta name=\"twitter:data1\" content=\"14 \u062f\u0642\u064a\u0642\u0629\" \/>\n<script type=\"application\/ld+json\" class=\"yoast-schema-graph\">{\"@context\":\"https:\\\/\\\/schema.org\",\"@graph\":[{\"@type\":\"WebPage\",\"@id\":\"https:\\\/\\\/link.theprivateclinic.me\\\/aura-privacy-policy\\\/\",\"url\":\"https:\\\/\\\/link.theprivateclinic.me\\\/aura-privacy-policy\\\/\",\"name\":\"Aura \u2014 Privacy Policy | Aura | The Private Clinic | Booking Link in Bio\",\"isPartOf\":{\"@id\":\"https:\\\/\\\/link.theprivateclinic.me\\\/#website\"},\"datePublished\":\"2026-07-20T10:49:40+00:00\",\"dateModified\":\"2026-09-19T07:41:12+00:00\",\"breadcrumb\":{\"@id\":\"https:\\\/\\\/link.theprivateclinic.me\\\/aura-privacy-policy\\\/#breadcrumb\"},\"inLanguage\":\"ar\",\"potentialAction\":[{\"@type\":\"ReadAction\",\"target\":[\"https:\\\/\\\/link.theprivateclinic.me\\\/aura-privacy-policy\\\/\"]}]},{\"@type\":\"BreadcrumbList\",\"@id\":\"https:\\\/\\\/link.theprivateclinic.me\\\/aura-privacy-policy\\\/#breadcrumb\",\"itemListElement\":[{\"@type\":\"ListItem\",\"position\":1,\"name\":\"Home\",\"item\":\"https:\\\/\\\/link.theprivateclinic.me\\\/\"},{\"@type\":\"ListItem\",\"position\":2,\"name\":\"Aura \u2014 Privacy Policy\"}]},{\"@type\":\"WebSite\",\"@id\":\"https:\\\/\\\/link.theprivateclinic.me\\\/#website\",\"url\":\"https:\\\/\\\/link.theprivateclinic.me\\\/\",\"name\":\"Aura | The Private Clinic | Booking Link in Bio\",\"description\":\"Your wellness practice, beautifully managed. Link-in-bio booking + EMR for every provider.\",\"publisher\":{\"@id\":\"https:\\\/\\\/link.theprivateclinic.me\\\/#organization\"},\"potentialAction\":[{\"@type\":\"SearchAction\",\"target\":{\"@type\":\"EntryPoint\",\"urlTemplate\":\"https:\\\/\\\/link.theprivateclinic.me\\\/?s={search_term_string}\"},\"query-input\":{\"@type\":\"PropertyValueSpecification\",\"valueRequired\":true,\"valueName\":\"search_term_string\"}}],\"inLanguage\":\"ar\"},{\"@type\":\"Organization\",\"@id\":\"https:\\\/\\\/link.theprivateclinic.me\\\/#organization\",\"name\":\"Aura | The Private Clinic | Booking Link in Bio\",\"url\":\"https:\\\/\\\/link.theprivateclinic.me\\\/\",\"logo\":{\"@type\":\"ImageObject\",\"inLanguage\":\"ar\",\"@id\":\"https:\\\/\\\/link.theprivateclinic.me\\\/#\\\/schema\\\/logo\\\/image\\\/\",\"url\":\"https:\\\/\\\/link.theprivateclinic.me\\\/wp-content\\\/uploads\\\/sites\\\/4\\\/2026\\\/06\\\/Aura-Logo.png\",\"contentUrl\":\"https:\\\/\\\/link.theprivateclinic.me\\\/wp-content\\\/uploads\\\/sites\\\/4\\\/2026\\\/06\\\/Aura-Logo.png\",\"width\":424,\"height\":424,\"caption\":\"Aura | The Private Clinic | Booking Link in Bio\"},\"image\":{\"@id\":\"https:\\\/\\\/link.theprivateclinic.me\\\/#\\\/schema\\\/logo\\\/image\\\/\"}}]}<\/script>\n<!-- \/ Yoast SEO plugin. -->","yoast_head_json":{"title":"Aura \u2014 Privacy Policy | Aura | The Private Clinic | Booking Link in Bio","robots":{"index":"index","follow":"follow","max-snippet":"max-snippet:-1","max-image-preview":"max-image-preview:large","max-video-preview":"max-video-preview:-1"},"canonical":"https:\/\/link.theprivateclinic.me\/ar\/aura-privacy-policy\/","og_locale":"ar_AR","og_type":"article","og_title":"Aura \u2014 Privacy Policy | Aura | The Private Clinic | Booking Link in Bio","og_description":"Version 1.0 \u00b7 Effective date: 20 July 2026 Operator: The Private Clinic \u2014 \u0627\u0644\u0639\u064a\u0627\u062f\u0629 \u0627\u0644\u0634\u062e\u0635\u064a\u0629 \u0627\u0644\u0637\u0628\u064a\u0629, a company registered in the Hashemite Kingdom of Jordan, Company No. 75818, National Establishment ID 200204705 (&#8220;Aura&#8220;, &#8220;we&#8220;, &#8220;us&#8220;). Contact \/ Privacy Officer: care@theprivateclinic.me 1 \u00b7 Who this policy covers, and the three roles Aura is a booking, practice-management [&hellip;]","og_url":"https:\/\/link.theprivateclinic.me\/ar\/aura-privacy-policy\/","og_site_name":"Aura | The Private Clinic | Booking Link in Bio","article_modified_time":"2026-09-19T07:41:12+00:00","og_image":[{"width":1080,"height":1350,"url":"https:\/\/link.theprivateclinic.me\/wp-content\/uploads\/sites\/4\/2026\/07\/Provider-Onboarding-Launch-Ad-3-\u2014-Full-bleed-Overlay.png","type":"image\/png"}],"twitter_card":"summary_large_image","twitter_misc":{"\u0648\u0642\u062a \u0627\u0644\u0642\u0631\u0627\u0621\u0629 \u0627\u0644\u0645\u064f\u0642\u062f\u0651\u0631":"14 \u062f\u0642\u064a\u0642\u0629"},"schema":{"@context":"https:\/\/schema.org","@graph":[{"@type":"WebPage","@id":"https:\/\/link.theprivateclinic.me\/aura-privacy-policy\/","url":"https:\/\/link.theprivateclinic.me\/aura-privacy-policy\/","name":"Aura \u2014 Privacy Policy | Aura | The Private Clinic | Booking Link in Bio","isPartOf":{"@id":"https:\/\/link.theprivateclinic.me\/#website"},"datePublished":"2026-07-20T10:49:40+00:00","dateModified":"2026-09-19T07:41:12+00:00","breadcrumb":{"@id":"https:\/\/link.theprivateclinic.me\/aura-privacy-policy\/#breadcrumb"},"inLanguage":"ar","potentialAction":[{"@type":"ReadAction","target":["https:\/\/link.theprivateclinic.me\/aura-privacy-policy\/"]}]},{"@type":"BreadcrumbList","@id":"https:\/\/link.theprivateclinic.me\/aura-privacy-policy\/#breadcrumb","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https:\/\/link.theprivateclinic.me\/"},{"@type":"ListItem","position":2,"name":"Aura \u2014 Privacy Policy"}]},{"@type":"WebSite","@id":"https:\/\/link.theprivateclinic.me\/#website","url":"https:\/\/link.theprivateclinic.me\/","name":"\u0623\u0648\u0631\u0627 | \u0627\u0644\u0639\u064a\u0627\u062f\u0629 \u0627\u0644\u062e\u0627\u0635\u0629 | \u0631\u0627\u0628\u0637 \u0627\u0644\u062d\u062c\u0632 \u0641\u064a \u0627\u0644\u0628\u0627\u064a\u0648","description":"\u0639\u064a\u0627\u062f\u062a\u0643 \u0627\u0644\u0635\u062d\u064a\u0629\u060c \u0645\u064f\u062f\u0627\u0631\u0629 \u0628\u0634\u0643\u0644 \u0631\u0627\u0626\u0639. \u0631\u0627\u0628\u0637 \u0627\u0644\u062d\u062c\u0632 \u0641\u064a \u0627\u0644\u0645\u0644\u0641 \u0627\u0644\u0634\u062e\u0635\u064a + \u0633\u062c\u0644 \u0637\u0628\u064a \u0625\u0644\u0643\u062a\u0631\u0648\u0646\u064a \u0644\u0643\u0644 \u0645\u064f\u0642\u062f\u0651\u0645 \u062e\u062f\u0645\u0629.","publisher":{"@id":"https:\/\/link.theprivateclinic.me\/#organization"},"potentialAction":[{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https:\/\/link.theprivateclinic.me\/?s={search_term_string}"},"query-input":{"@type":"PropertyValueSpecification","valueRequired":true,"valueName":"search_term_string"}}],"inLanguage":"ar"},{"@type":"Organization","@id":"https:\/\/link.theprivateclinic.me\/#organization","name":"\u0623\u0648\u0631\u0627 | \u0627\u0644\u0639\u064a\u0627\u062f\u0629 \u0627\u0644\u062e\u0627\u0635\u0629 | \u0631\u0627\u0628\u0637 \u0627\u0644\u062d\u062c\u0632 \u0641\u064a \u0627\u0644\u0628\u0627\u064a\u0648","url":"https:\/\/link.theprivateclinic.me\/","logo":{"@type":"ImageObject","inLanguage":"ar","@id":"https:\/\/link.theprivateclinic.me\/#\/schema\/logo\/image\/","url":"https:\/\/link.theprivateclinic.me\/wp-content\/uploads\/sites\/4\/2026\/06\/Aura-Logo.png","contentUrl":"https:\/\/link.theprivateclinic.me\/wp-content\/uploads\/sites\/4\/2026\/06\/Aura-Logo.png","width":424,"height":424,"caption":"Aura | The Private Clinic | Booking Link in Bio"},"image":{"@id":"https:\/\/link.theprivateclinic.me\/#\/schema\/logo\/image\/"}}]}},"_links":{"self":[{"href":"https:\/\/link.theprivateclinic.me\/ar\/wp-json\/wp\/v2\/pages\/129","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/link.theprivateclinic.me\/ar\/wp-json\/wp\/v2\/pages"}],"about":[{"href":"https:\/\/link.theprivateclinic.me\/ar\/wp-json\/wp\/v2\/types\/page"}],"author":[{"embeddable":true,"href":"https:\/\/link.theprivateclinic.me\/ar\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/link.theprivateclinic.me\/ar\/wp-json\/wp\/v2\/comments?post=129"}],"version-history":[{"count":4,"href":"https:\/\/link.theprivateclinic.me\/ar\/wp-json\/wp\/v2\/pages\/129\/revisions"}],"predecessor-version":[{"id":228,"href":"https:\/\/link.theprivateclinic.me\/ar\/wp-json\/wp\/v2\/pages\/129\/revisions\/228"}],"wp:attachment":[{"href":"https:\/\/link.theprivateclinic.me\/ar\/wp-json\/wp\/v2\/media?parent=129"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}