Version 1.0 \u00b7 Effective date: 22 July 2026<\/strong> Operator:<\/strong> The Private Clinic \u2014 \u0627\u0644\u0639\u064a\u0627\u062f\u0629 \u0627\u0644\u0634\u062e\u0635\u064a\u0629 \u0627\u0644\u0637\u0628\u064a\u0629, registered in the Hashemite Kingdom of Jordan, Company No. 75818, National Establishment ID 200204705 (“\u0623\u0648\u0631\u0627<\/strong>“, “we<\/strong>“, “us<\/strong>“). Contact:<\/strong> care@theprivateclinic.me<\/a><\/p>\n\n\n\n These Terms & Conditions (the “\u0634\u0631\u0648\u0637<\/strong>“) are a single, global agreement that governs all use of the Aura platform on link.theprivateclinic.me<\/strong> and its connection to care.theprivateclinic.me<\/strong> (the “\u0627\u0644\u0645\u0646\u0635\u0629<\/strong>“). They incorporate and replace the separate signature of a Data Processing Addendum and the distribution of a standalone patient privacy notice: everything in this document takes effect automatically through use of the Platform \u2014 no signature, form, or written acceptance is required from any Provider or client.<\/strong> Creating an account, entering data, or making a booking constitutes full acceptance. If you do not accept these Terms, do not use the Platform.<\/p>\n\n\n\n For Provider account data and platform operations, Aura is the data controller. For every client and patient record a Provider creates or collects through the Platform \u2014 bookings, charts, session notes, medications, communications \u2014 the Provider is the data controller and Aura acts exclusively as a data processor on the Provider’s instructions.<\/strong> This allocation applies automatically and continuously; it is not subject to negotiation, signature or opt-out.<\/p>\n\n\n\n Aura provides booking, scheduling, group classes, packages, client records, payments facilitation, analytics, messaging automations and related tools. Aura is a technology platform only<\/strong>: it is not a healthcare provider, does not employ Providers, does not supervise treatment, does not verify the clinical content Providers create, and is not a party to the professional relationship between a Provider and a client.<\/p>\n\n\n\n Account holders must be 18 years of age or older<\/strong>. You are responsible for the confidentiality of your credentials and for all activity under your account. Accounts lock automatically after repeated failed sign-ins; contact care@theprivateclinic.me<\/a> to restore access. Aura may suspend or terminate accounts that violate these Terms, abuse the Platform, or create legal risk.<\/p>\n\n\n\n The Provider is solely and entirely responsible for:<\/strong><\/p>\n\n\n\n (a) holding, maintaining and complying with every license, registration, qualification and permission<\/strong> required to offer their services in their place of practice; (b) the nature, quality, legality and outcomes of their practice<\/strong>, including diagnoses, treatment, advice, prescriptions and clinical decisions; (c) compliance with the laws of their country and place of practice<\/strong> \u2014 including health law, professional-secrecy law, medical-records and retention law, consumer law, tax law and data-protection law \u2014 as those laws apply to their license and specialty; (d) determining and honoring a lawful basis (and, where required, valid consent)<\/strong> for every item of client or patient data they process through the Platform; (e) informing their patients about how their data is handled where local law requires it \u2014 Part IV of these Terms provides that information publicly on the Provider’s behalf, and the Provider is responsible for confirming this satisfies, or supplementing it to satisfy, their local obligations; (f) the accuracy of everything they publish on their public page, and ensuring no client or patient information ever appears on it<\/strong>; (g) the security and lawfulness of every endpoint they direct data to<\/strong> \u2014 webhook receivers, connected calendars, automation tools and advertising pixels; (h) obtaining guardian consent<\/strong> where they lawfully treat minors.<\/p>\n\n\n\n Indemnity.<\/strong> The Provider indemnifies and holds harmless Aura, its owners, and personnel against any claim, penalty, loss or expense arising from the Provider’s breach of this Section 4, from their professional practice, or from data they unlawfully process or publish.<\/p>\n\n\n\n For all client and patient data, Aura commits \u2014 automatically and without signature \u2014 to the following processor terms:<\/p>\n\n\n\n 5.1 Instructions.<\/strong> Aura processes such data only to operate the features the Provider uses, to transmit data to third parties the Provider has enabled (Part III \u00a79), and to comply with law. No analytics on clinical content, no advertising use, no sale, no model training \u2014 ever.<\/p>\n\n\n\n 5.2 Confidentiality.<\/strong> Personnel access data on a strict need-to-know basis and are bound by confidentiality. Clinical content is not read except where strictly necessary to execute a support request initiated by the Provider, or as required by law.<\/p>\n\n\n\n 5.3 Security.<\/strong> Encrypted transport (HTTPS); hashed credentials; role-based access enforced at the API layer \u2014 front-desk assistants can never access clinical charts, notes, medications, revenue or content, by both interface and API enforcement<\/strong>; brute-force sign-in lockout; nonce-verified authenticated requests; least-privilege administration; diagnostic logging.<\/p>\n\n\n\n 5.4 Sub-processor.<\/strong> Hostinger (hosting and email infrastructure). Aura will update its published policies before adding any sub-processor that touches personal data. Vendors the Provider enables (Google, Microsoft, Zoom, automation endpoints, payment processors, pixel vendors) are recipients at the Provider’s direction, not Aura sub-processors<\/strong>.<\/p>\n\n\n\n 5.5 Breach.<\/strong> Aura will notify affected Providers without undue delay \u2014 and in any event within 72 hours of becoming aware \u2014 of a breach affecting their clients’ data, so the Provider can meet their own notification duties. Providers must promptly report suspected compromise of their account or endpoints to care@theprivateclinic.me<\/a>.<\/p>\n\n\n\n 5.6 Assistance.<\/strong> Aura executes retrievals, corrections, exports and deletions of clinical records as the Provider instructs, so the Provider can answer their patients’ requests.<\/p>\n\n\n\n 5.7 Retention & deletion.<\/strong> Patient records are never deleted automatically<\/strong>. Disposition follows the Provider’s request, consistent with the retention law of their place of practice. If, 90 days after account termination and written prompt, the Provider gives no instruction, Aura may delete residual data unless law requires storage. Deleted data ages out of rolling 90-day backups.<\/p>\n\n\n\n 5.8 Audit.<\/strong> On reasonable written request (at most annually, absent a breach), Aura provides documentation demonstrating compliance with this Section 5.<\/p>\n\n\n\n From Providers:<\/strong> identity and profile, professional credentials, practice configuration (services, classes, seats, schedules, prices, currencies), plan and billing history, payout bank details (bank name, branch, beneficiary, account, IBAN, SWIFT, address, country \u2014 used solely to execute payouts), integration tokens (OAuth tokens, never passwords), team roles.<\/p>\n\n\n\n From clients:<\/strong> account data (name, email, hashed credentials), bookings (service, class seat, time, timezone, status, amount, currency, package credits), and \u2014 under the Provider’s control per Part II \u2014 health records.<\/p>\n\n\n\n Technical, from everyone:<\/strong> functional cookies ( Aura does not collect government ID numbers, biometrics or precise geolocation. Payment card details never touch Aura’s systems.<\/p>\n\n\n\n Client payments and plan purchases are processed by HyperPay, PayTabs, Paymob and Zbooni<\/strong> under their own terms and privacy policies; Aura receives only order outcome, amount, currency and status. Provider payouts are computed from completed sessions minus the platform commission applicable to the Provider’s plan (or an individually agreed rate); each payout receipt itemizes amount earned, commission and payout amount.<\/p>\n\n\n\n Everything a Provider publishes at Every integration is off by default and activates only at the Provider’s direction. Enabling one instructs Aura to transmit the described data to that vendor, whose own terms then govern it: calendar sync (booking events with the client identifier the Provider configures \u2014 full name or anonymous label), listing sync to care.theprivateclinic.me (public data only, never clinical), booking webhooks to Provider-controlled URLs, Zoom links in confirmations, and marketing pixels that run on the public page only \u2014 never on the dashboard or any page containing clinical data<\/strong>.<\/p>\n\n\n\n Transactional messages (confirmations, reminders, payment and payout receipts, security and plan notices) are inherent to the service and cannot be opted out of while an account exists. Non-essential Provider announcements carry an unsubscribe link honored platform-wide. Aura never messages a Provider’s clients for Aura’s own marketing.<\/strong> Providers using WhatsApp or other channels via automations are responsible for obtaining any opt-ins those channels require.<\/p>\n\n\n\n This Part is addressed to clients and patients<\/strong> and constitutes the standing privacy information for data processed when booking or receiving care through the Platform. It applies automatically; no Provider needs to distribute, adapt or obtain signature of any separate notice for Platform processing<\/strong> (though local law may require a Provider to give additional information \u2014 Part II \u00a74(e)).<\/p>\n\n\n\n Who is responsible.<\/strong> Your booking account is operated by Aura. Your health information \u2014 the notes, history and medications your practitioner records \u2014 is controlled by your treating practitioner<\/strong>, who uses Aura as a secure storage and management tool. Aura makes no use of your health information of its own: no advertising, no sale, no analysis of clinical content.<\/p>\n\n\n\n What is processed.<\/strong> Your name, contact details and timezone; your bookings and their payment status; and the clinical records your practitioner keeps. Payments are handled by licensed processors (HyperPay, PayTabs, Paymob, Zbooni); your card details never reach Aura or your practitioner through the Platform.<\/p>\n\n\n\n Who can see what.<\/strong> Your clinical notes are visible only to your treating practitioner<\/strong> (and, in team practices, the practice owner who administers that practice). Front-desk staff see appointment times and contact details only \u2014 never clinical notes.<\/strong> Nothing clinical is shown to other clients, to visitors, or on any public page. If your practitioner has enabled calendar sync, your appointment may appear in their personal calendar under your full name or an anonymous label, per their configuration; appointment details (never clinical notes) may flow to scheduling automations they control.<\/p>\n\n\n\n Reviews.<\/strong> If you rate a session, your rating and any comment you choose to write may appear publicly on your practitioner’s page with your name masked to its first letter only<\/strong> (e.g., “a****”). Do not include personal or health details in a review comment.<\/p>\n\n\n\n How long.<\/strong> Clinical records are retained per the medical-records law applicable to your practitioner’s license and place of practice, and are disposed of on your practitioner’s lawful instruction \u2014 never by automatic deletion.<\/p>\n\n\n\n Your rights.<\/strong> Subject to applicable law you may request access, correction, a copy, or deletion of your data. Requests about clinical records go to your treating practitioner<\/strong>, who controls them; Aura assists as processor. Requests about your booking account go to care@theprivateclinic.me<\/a>. Answers within 30 days; identity may be verified; retention laws may lawfully override deletion. You may complain to the data-protection authority in your country.<\/p>\n\n\n\n Minors.<\/strong> Booking and consent for anyone under 18 must be provided by a parent or legal guardian.<\/p>\n\n\n\n No unlawful content or activity; no data entry concerning persons without a genuine professional relationship; no scraping, probing, or circumvention of access controls; no misrepresentation of identity, credentials or affiliation; no use of the Platform to send spam or unlawful communications.<\/p>\n\n\n\n The Platform is provided “as is” and “as available.” Aura may modify features, apply maintenance windows, and update these Terms; material changes are announced to account holders at least 14 days before taking effect. Continued use after the effective date constitutes acceptance.<\/p>\n\n\n\n To the maximum extent permitted by law: Aura is not liable for the acts, omissions, or professional conduct of any Provider, for the content of clinical records, for outcomes of care, for third-party services (payment processors, calendar vendors, automation endpoints, pixel vendors), or for indirect, consequential or lost-profit damages. Aura’s aggregate liability to any Provider is limited to the platform fees that Provider paid in the twelve months preceding the claim; toward clients, to the amount of the booking concerned. Nothing limits liability that cannot lawfully be limited.<\/p>\n\n\n\n Providers may close their account at any time; Part II \u00a75.7 governs record disposition. Aura may terminate for breach with notice, or immediately where the breach creates legal or safety risk. Sections 4, 5, 13 and 15 survive termination.<\/p>\n\n\n\n These Terms are governed by the laws of the Hashemite Kingdom of Jordan<\/strong>, including the Personal Data Protection Law No. 24 of 2023 \u2014 without prejudice to the mandatory laws of the Provider’s place of practice, which remain the Provider’s own responsibility under Part II<\/strong>. Disputes are subject to the competent courts of Jordan, after a good-faith attempt at amicable resolution via care@theprivateclinic.me<\/a>.<\/p>\n\n\n\n These Terms, together with the Privacy Policy, form the entire agreement for use of the Platform and supersede any separate data-processing addendum or notice previously published. If any provision is held invalid, the remainder stands.<\/p>\n\n\n\n
\n\n\n\nPart I \u2014 General<\/h2>\n\n\n\n
1 \u00b7 The three roles<\/h3>\n\n\n\n
\n
2 \u00b7 The service<\/h3>\n\n\n\n
3 \u00b7 Accounts<\/h3>\n\n\n\n
\n\n\n\nPart II \u2014 Provider responsibility (the core allocation)<\/h2>\n\n\n\n
4 \u00b7 Your license, your law, your practice<\/h3>\n\n\n\n
5 \u00b7 Data processing terms (processor commitments)<\/h3>\n\n\n\n
\n\n\n\nPart III \u2014 Platform data practices<\/h2>\n\n\n\n
6 \u00b7 What Aura collects<\/h3>\n\n\n\n
aura_pref_lang<\/code>, aura_lang_applied<\/code>, aura_lang_auto<\/code>, aura_client_tz<\/code>, WordPress session cookies), interface state in local storage (tour progress, dismissed banners \u2014 no tracking identifiers), page-view and click counts on public pages aggregated for the Provider’s own analytics, and security logs retained 90 days.<\/p>\n\n\n\n7 \u00b7 Payments<\/h3>\n\n\n\n
8 \u00b7 Public pages<\/h3>\n\n\n\n
\/@handle<\/code> is publicly accessible, indexable and shareable<\/strong>. Link previews in messaging apps display a QR code encoding the page address (a third-party QR service receives only the URL). Aura cannot recall copies cached by search engines or third parties after unpublishing.<\/p>\n\n\n\n9 \u00b7 Integrations<\/h3>\n\n\n\n
10 \u00b7 Communications<\/h3>\n\n\n\n
\n\n\n\nPart IV \u2014 Patient information (public notice, no distribution required)<\/h2>\n\n\n\n
\n\n\n\nPart V \u2014 Legal<\/h2>\n\n\n\n
11 \u00b7 Acceptable use<\/h3>\n\n\n\n
12 \u00b7 Availability and changes<\/h3>\n\n\n\n
13 \u00b7 Liability<\/h3>\n\n\n\n
14 \u00b7 Term and termination<\/h3>\n\n\n\n
15 \u00b7 Governing law and disputes<\/h3>\n\n\n\n
16 \u00b7 Entire agreement<\/h3>\n\n\n\n
\n\n\n\n