Your data and choices
Privacy policy
This policy explains how IVOREK LLC, the operator of TIB Index in Qatar, handles data when you use the website, manage profiles, request bookings or use the assistant on the website and WhatsApp.
Content last updated:
Operator and policy scope
IVOREK operates the platform and manages data processing for TIB Index services. This policy covers platform processing; healthcare organizations and channel providers may process data under their own policies.
For questions or privacy requests, use the IVOREK contact route listed on our contact page and identify your request as relating to TIB Index.
Data we handle
Data may include account, sign-in and organization access information; public professional information and its sources; documents submitted for review; and correction reports with any follow-up contact details you supply.
For booking requests, we process information needed to route and follow up on the request, such as your name, contact number, practitioner or service, organization and preferred appointment time. We may process your email if you provide it.
Assistant use involves messages, conversation context, search results and request details. If you choose voice, audio is processed for understanding or transcription. We also handle technical and operational data such as session information, events, errors and available visit measurements.
Why we use data
We use data to operate accounts and permissions, display and update the directory, review information and documents, handle corrections, prepare booking requests and notifications, operate the assistant, improve quality and protect the service.
Processing requirements depend on the service: fulfilling a request, consent where required, legitimate operational and security needs, or applicable obligations. Visiting a public page does not constitute consent to every use of data.
Conversations, voice and administrative review
Website and WhatsApp conversation text and voice transcripts may be stored in a protected quality archive. Authorized administrators may review them for quality improvement and troubleshooting.
Keeping a transcript does not mean storing the original audio file in the conversation archive. External processing of audio or messages also depends on the relevant provider terms and operating settings.
Do not send sensitive medical information or identity documents that your request does not require. The assistant supports discovery and request preparation, not emergencies or diagnosis.
Retention and deletion
Current settings use a 24-hour lifetime for WhatsApp conversation state, 7 days for quality archive messages and 30 days for archive access logs. Provider notification logs have an operational cleanup period of 30 days.
Deletion runs through cleanup tasks and may be delayed if a task fails. Provider notification log cleanup currently depends on the notification worker running. These periods do not guarantee simultaneous deletion from provider copies or backups.
Account, booking, document and review records are separate from the conversation archive period. They are retained according to follow-up, verification, security and applicable obligations; you can request clarification of retention or ask for deletion through the privacy contact route.
Ending a website session does not automatically delete the quality archive. The WhatsApp conversation deletion command addresses linked conversation state and archive data; it does not cancel earlier bookings or automatically delete healthcare provider copies.
Cookies, local storage and usage measurement
The service uses cookies and local storage for sign-in, session security, preferences and relevant consent choices. Available visit and interaction events support operational measurement and improvements.
You can manage storage in your browser. Clearing local data may sign you out or require consent again; it does not delete server or booking records. Optional tracking requiring consent must be linked to a clear choice when enabled.
Data and document protection
Protection relies on permissions, server-side checks and access controls. The conversation archive uses encryption, additional access protection and access logging.
Private documents submitted for authorization or review are not public publishing content. Access is limited to appropriate permissions. No digital service can guarantee zero risk.
Your requests and choices
You can request access, correction or deletion, raise an objection, request processing restrictions or withdraw consent where applicable. Proportionate identity checks may be needed to protect your data.
Some records may require retention for legal, security or ongoing request purposes; relevant limits are explained when handling your request. Withdrawing consent does not invalidate earlier lawful processing and may affect a service that requires it.
A guardian or authorized representative can contact us about someone they represent. Do not submit another person’s data without appropriate authority.
Policy updates
We update this policy when services or processing practices change and show the content review date on this page. Where a change requires new consent, it is requested in the relevant flow rather than treating continued browsing as blanket consent.