Privacy Policy

Draft for legal review.

First published and effective: 15 October 2026

This policy describes our information practices and the responsibilities of the healthcare providers using Sheba360.

1. Provider and scope

Sheba360 provides healthcare management software. This policy explains how information is handled when visitors, patients, doctors, staff, chambers, and healthcare organizations use our website and services.

Our office address, business phone, and email are listed in section 11. Read this policy together with our Terms & Conditions.

Terms & Conditions

2. Information we collect

We collect information you provide directly, information supplied by authorized healthcare organizations or people acting on their behalf, and information generated through service use. This may include account and contact details, organization and chamber profiles, patient identity and contact details, appointments, clinical notes, prescriptions, diagnoses, reports, and uploaded files.

Depending on the features used, we also handle workforce profiles, roles, attendance and payroll information; invoices, payment amounts, transaction references and payment status; and usage and security records such as IP addresses, browser or device details, login activity, and audit records. Only provide information you are authorized to share.

3. Purposes and healthcare provider control

Healthcare organizations and chambers control their patient records and decide which staff may access them. They are responsible for the authority and permissions needed to collect and use those records. Patients retain rights in their information.

Sheba360 processes information to deliver authorized services, manage accounts and subscriptions, support users, maintain and improve service operation, prevent misuse, secure the platform, and meet legal obligations. Authorized support or operational access may be necessary for these purposes.

4. AI features

Our policy is that patient records are not used to train AI models.

Where a feature uses an external AI service, information needed for that feature may be sent to that service for processing. The information involved depends on the feature and how it is used. Healthcare providers should use AI features only with appropriate authority and review outputs before clinical use.

We do not sell personal or patient data or share it for third-party advertising. Information may be accessible to authorized healthcare providers and staff, and to people you or your provider authorize through the service. If a provider enables a public profile or listing, the information selected for publication can be viewed publicly.

We may use operational service providers for hosting, file storage, payments, messaging, analytics, support, and, where a feature uses it, AI processing. Information may be shared as needed for those services or disclosed where required by law or lawful process. Depending on the services configured, information may be processed outside Bangladesh; we do not promise that all processing stays within Bangladesh.

6. Cookies, browser storage, and analytics

We use cookies and browser storage for authentication, trusted-device recognition, and preferences such as language and theme. Some features, including demos, may store state in your browser. When configured, Google Analytics collects information about visits and usage to help us understand how the website is used.

You can use browser settings to block or delete cookies and stored data and manage tracking controls. Blocking or clearing them may sign you out, remove trusted-device recognition or saved preferences, and affect some features. Analytics runs when configured.

7. How long information is retained

We retain information as needed to provide services and meet healthcare record obligations, billing and accounting needs, security requirements, legal obligations, and dispute resolution needs. The appropriate period depends on the information and its purpose.

Account closure or a deletion request may not immediately remove all records. Healthcare providers may need to retain clinical records, and information may remain in retained records or backups until applicable retention and backup cycles allow removal.

8. Requests and rights

For access to, correction of, or deletion of clinical records, contact the healthcare provider or organization responsible for those records first. That provider can assess the request in the context of care and its record-keeping obligations.

Sheba360 support assists where appropriate and handles platform-account requests through the contact details in section 11. We may ask for information to verify identity and authority. Requests are handled subject to applicable rights, authorization, and legal or healthcare retention obligations. Please do not send passwords, verification codes, or unnecessary clinical details to support.

9. Security

We use access controls and reasonable safeguards to help protect information against unauthorized access, misuse, loss, or disclosure. Organizations and chambers should grant appropriate staff permissions and users should protect their credentials.

No online service or transmission can be guaranteed completely secure. Contact support promptly if you suspect unauthorized access or a security issue.

10. Children’s information

Direct account registration is intended for adults. Authorized healthcare providers or guardians may manage children’s healthcare records as part of care.

Those submitting or managing a child’s information are responsible for having the appropriate authority and any required consent. This does not mean that Sheba360 automatically verifies age or guardianship.

11. Contact and policy updates

For questions about privacy or platform-account requests, contact Sheba360 support using the details below. For clinical-record requests, start with the responsible healthcare provider as explained in section 8.

We may update this policy as our service or applicable requirements change. We will publish the revised policy here and update its effective date; material changes will be communicated through the service or available contact channels. Where legally permitted, the English version controls if interpretation differs between English and Bangla.

Sheba360

169, Prestige Malek Tower, North Bhatara, Dhaka 1212, Bangladesh.

DNCC Zone 9, Bhatara, Ward 40

contact@sheba360.health +880 1739-601576