Last Updated: 22 August 2026
This Privacy Policy describes how MyOncoDiary collects, uses, and protects your personal and medical information. Please read it carefully before using our platform.
MyOncoDiary ("we", "our", or "us") is committed to protecting the privacy and security of your personal and medical information. This Privacy Policy explains how we collect, use, store, and share your data when you use our platform, in accordance with the General Data Protection Regulation (GDPR) and applicable data protection laws.
MyOncoDiary is a patient education and monitoring platform designed to support oncology patients and healthcare providers. If you have any questions about this policy or your data, please contact us at: privacy@myoncodiary.com
We collect the following categories of information: • Personal Identifiers: Full name, email address, phone number, date of birth, CNIC/national ID, and profile picture. • Medical Information: Cancer diagnoses, chemotherapy protocols, treatment records, lab results, radiology and cardiology results, symptom diary entries, prescriptions, and clinical notes. • Health Metrics: Blood pressure, heart rate, oxygen saturation, weight, height, blood sugar, respiratory rate, and temperature. • Account & Billing Data: Subscription plan details and payment history (payment card details are processed exclusively by Stripe and never stored on our servers). • Communication Data: Messages exchanged between patients and healthcare providers within the platform. • Usage Data: Log-in timestamps and general platform usage for operational purposes.
We process your personal data on the following legal grounds: • Contractual Necessity: To provide you with the services described in our Terms of Service. • Legitimate Interests: To maintain platform security, prevent fraud, and improve our services. • Consent: For optional features such as marketing communications (where applicable). • Legal Obligation: To comply with applicable laws and regulations.
Your data is used to: • Provide, operate, and improve the MyOncoDiary platform. • Enable communication between patients and their assigned healthcare providers. • Generate treatment summaries, care plans, and medical reports. • Process subscription payments securely through Stripe. • Send important service notifications and account alerts. • Comply with legal and regulatory obligations.
We do not sell your personal data. We share data only with the following subprocessors, each bound by a Data Processing Agreement (DPA) and Standard Contractual Clauses (SCCs) where applicable: • Healthcare Providers: Doctors and nurses you have been assigned to, or who you have granted access to your records. • Base44 (Infrastructure & Hosting): Our platform is built on Base44, which processes data on our behalf under strict data processing agreements including Standard Contractual Clauses (SCCs). Base44 is GDPR compliant. • Stripe (Payments): Payment information is handled directly by Stripe, a PCI-DSS compliant payment processor. We receive only a confirmation of payment and a transaction reference — your card details never touch our servers. • AI / LLM Providers: When you use AI-assisted features (such as the in-app assistant or marketing material generation), data you submit may be processed by our AI model providers under DPA. We do not use your data to train third-party models. • Cloud File Storage: Uploaded files (reports, images, consent scans) are stored on secure cloud storage provided through the Base44 platform. • Legal Authorities: Where required by law or court order. A current list of subprocessors is maintained and available on request from our Data Protection Officer.
Your data is stored securely on Base44's infrastructure. All data in transit is encrypted using TLS. Access to patient records is strictly controlled through role-based permissions — only you and your assigned healthcare team can access your medical records. We retain your data for as long as your account is active, or as required by applicable medical record retention laws.
Under GDPR, you have the right to: • Access: Request a copy of the personal data we hold about you. • Rectification: Request correction of inaccurate or incomplete data. • Erasure: Request deletion of your data ("right to be forgotten"). Closing your account initiates a GDPR-compliant deletion process across all systems. • Restriction: Request that we restrict processing of your data in certain circumstances. • Portability: Request your data in a structured, machine-readable format. • Objection: Object to processing based on legitimate interests. To exercise any of these rights, please contact us at: privacy@myoncodiary.com
We retain personal data only for as long as necessary to fulfil the purposes set out in this policy, and in line with applicable medical record retention laws: • Active Accounts: Your data is retained while your account is active and you continue to use the platform. • Inactive Accounts: If your account is inactive for 24 months, we will contact you to confirm whether you wish to keep your data. Unconfirmed inactive accounts may be reviewed for deletion. • Medical Records: Clinical records (diagnoses, treatment logs, lab results, clinical notes) are retained for the minimum period required by applicable healthcare law in your jurisdiction (for example, 8 years for adult records in the UK, or until age 25 for minor records). Where no legal minimum applies, we retain for up to 10 years after your last interaction, then delete unless you request earlier deletion. • Billing Records: Subscription and payment records are retained for 7 years for tax and accounting compliance. • Audit Logs: Security audit logs are retained for 6 years to support breach investigation and regulatory compliance. • Account Deletion: Upon account deletion, we initiate a full GDPR-compliant data purge across all systems within 30 days. Some anonymised, aggregated data may be retained for platform improvement purposes and cannot be linked back to you.
MyOncoDiary uses essential cookies and local storage to maintain your session and preferences (such as language settings). We do not use advertising or tracking cookies.
Our platform is not intended for use by individuals under the age of 16 without verified parental or guardian consent. If you believe a minor has provided us with personal data, please contact us immediately.
We may update this Privacy Policy from time to time. When we do, we will notify you via the platform and update the "Last Updated" date below. Continued use of the platform after changes constitutes your acceptance of the revised policy.
If you have any questions, concerns, or requests regarding this Privacy Policy or your personal data, please contact our Data Protection Officer at: Email: privacy@myoncodiary.com We aim to respond to all requests within 30 days.