Privacy Policy
Last updated: October 2026
Aghsan is committed to protecting the privacy of children, families, and centers that use our platform. This policy explains what data we collect, why we collect it, how we use and protect it, and the choices and rights available to you.
Aghsan staff cannot access your center's clinical data
Your center's clinical records — including child profiles, therapy sessions, assessments, reports, invoices, and uploaded documents — are private by default. Aghsan platform staff have no standing access to this data.
- Any support access requires your center administrator's explicit approval.
- Access is always time-limited and expires automatically.
- Every support action is recorded in a full audit log visible only to your center.
- Your center admin can revoke support access at any time, immediately.
- Support staff can only read data — they cannot edit, delete, or export records without elevated access that you must explicitly enable.
You can review and manage support access at any time under Settings → Privacy & Security.
1. Who We Are
Aghsan ("the Platform", "we", "us") is a digital case-management system built specifically for special-needs and therapy centers operating in the Middle East and North Africa. Aghsan is operated by DAR AL AGHSAN TECHNOLOGIES L.L.C, a company established in Dubai, United Arab Emirates, with its address in Al Garhoud, Dubai. Centers, and the specialists and administrators they authorise, use Aghsan to manage child records, therapy sessions, assessments, goals, appointments, reports, and billing. For the clinical and operational data a center enters into Aghsan, we act as a data processor on behalf of that center, which remains the data controller. For account, technical, and platform-usage data described below, Aghsan acts as the data controller. This policy applies to aghsan.co, its subdomains (including app.aghsan.co), and the Aghsan mobile and web applications.
2. Scope of This Policy
This policy applies to everyone who interacts with Aghsan: center administrators and owners, specialists and other staff invited by a center, parents and guardians using the parent portal, and visitors to our public website who submit the contact form or browse our content. It covers data we collect directly, data centers and specialists enter about children and families in their care, and data we receive automatically through use of the service, including through third-party integrations you choose to connect, such as Google and Zoom.
3. Data We Collect
Account and identity data: name, email address, phone number, role, and password (stored as a salted hash, never in plain text). Organizational data: center name, address, specialties offered, and staff roster. Clinical and case data entered by centers and specialists: child profiles (name, date of birth, diagnosis, care plan), session notes and therapy records, assessment results, goal-tracking data, treatment plans, uploaded documents and attachments, and appointment and billing records. Parent and guardian data: contact details (including the phone number used to sign in to the parent portal and to receive WhatsApp notifications), relationship to child, and, where the center has turned messaging on, messages exchanged with the center through the parent portal. Technical and usage data: IP address, browser and device type, operating system, pages visited, timestamps, and error/crash diagnostics, collected automatically for security, troubleshooting, and reliability purposes. Integration data: account identifiers and OAuth tokens for any third-party service you connect (see the Google and Zoom sections below). Communications: messages you send us through the contact form, support requests, and any correspondence with our team. Aghsan does not knowingly collect more personal data than is necessary to operate the service.
4. Cookies, Analytics, and Similar Technologies
We use a small number of cookies and similar technologies to operate the site. Essential storage remembers your language preference and, for signed-in users, keeps you authenticated; it cannot be disabled without breaking core functionality. Optional analytics and advertising cookies stay off unless you accept them in our consent notice. Before you accept, the Google tag runs in Consent Mode: it sets no cookies and sends Google only cookieless signals (such as a page view or a completed demo booking, without advertising identifiers) that Google Analytics 4 and Google Ads use for aggregate, modeled measurement. If you accept, PostHog helps us understand aggregate product usage, Google Analytics 4 measures website visits, Google Ads measures which ads lead to demo bookings, and Meta Pixel measures campaign performance. You may reject optional tracking without losing access to the site and may withdraw consent by clearing the site's stored consent choice. Our contact form uses Cloudflare Turnstile to distinguish human visitors from automated bots and may process limited browser and network signals. We use Sentry for automated error monitoring and configure it to avoid clinical data. We do not sell analytics data or use it to profile individual children.
5. How We Use Your Data
Clinical data — including child profiles, session records, assessments, and reports — is used solely to deliver the service to your center and its authorised staff. This includes displaying records to authorised center staff, generating progress reports, scheduling and managing appointments, processing billing within the platform, and delivering parent-visible summaries through the secure parent portal. Account and technical data is used to authenticate users, secure the platform, provide customer support, send service-related notifications, such as reminders of upcoming sessions, new reports, upcoming payments, and security alerts, in the parent portal, by email, or through WhatsApp, and maintain and improve the reliability of the service. Platform improvement and reliability work is carried out using only anonymised, aggregate technical telemetry (such as error rates, response times, and feature-usage counts) — never clinical records. Aghsan staff do not access clinical data to develop, test, or improve the product. We do not sell, rent, or share personal data with third parties for marketing purposes, and we do not use clinical data to train artificial-intelligence or machine-learning models. AI-assisted features: Aghsan is building optional AI-assisted features, such as drafts of session notes and reports that a specialist reviews before using them. A center can turn AI features off. Clinical text is not sent outside Aghsan's systems for AI processing. If that changes, we will list the provider in section 8 and give notice as described in section 18.
6. Legal Basis for Processing
We process personal data on the following bases: performance of our contract with a subscribing center (to deliver the service you and your center rely on); the center's own legal basis as data controller for the clinical data it enters (typically consent from a parent/guardian or another basis available under applicable law, which remains the center's responsibility to establish); our legitimate interests in securing the platform, preventing fraud and abuse, and improving reliability, balanced against your rights; your consent where we ask for it specifically, such as for optional integrations or marketing communications, which you may withdraw at any time; and compliance with applicable legal obligations, including the UAE Federal Decree-Law No. 45 of 2021 on the Protection of Personal Data, which Aghsan follows as a company established in Dubai. Each center remains responsible for the data protection laws that apply where it operates.
7. Children's Privacy
We take the privacy of children in our care extremely seriously. Aghsan is a business-to-business platform provided to therapy and special-needs centers, not a consumer service directed at children, and children do not create their own Aghsan accounts. Child records are entered by centers and specialists and are accessible only to the center that created them and the specific specialists and parents granted access by that center. We implement role-based access controls to ensure that no user sees data beyond their authorised scope, and centers are responsible for obtaining any consents required by applicable law before entering a child's information into the platform. Centers are likewise responsible for agreeing with parents and guardians that they will receive notifications, including through the parent portal and WhatsApp.
8. Data Sharing and Service Providers
We share data only in limited circumstances: with the center's own staff and parents as configured by the center administrator; with service providers that help us operate the service, including Railway, Sentry, PostHog, Google Analytics, Google Ads, Calendly (for demo bookings), Meta (for WhatsApp messaging and, only with consent, ad measurement), Stripe and Tap Payments (for payment processing), Cloudflare Turnstile, and, where a center connects them, Google and Zoom; and when required by law or a valid legal order. Optional analytics and campaign providers receive cookie-based data only after website consent; before consent Google receives only the cookieless signals described in section 4. Each provider is limited to the purposes described in this policy. We do not sell, rent, or trade personal data to third parties for their own marketing purposes. WhatsApp notifications are sent through Meta's WhatsApp Business service and contain a link and a short summary; centers are responsible for agreeing with parents that they will receive them.
9. International Data Transfers
Aghsan currently hosts its servers, databases, file storage, and backups in Europe. The centers we serve are in the UAE and the wider Middle East and North Africa, so personal data is transferred from the center's own country to Europe. Some sub-processors described in this policy (for example, error monitoring and analytics providers) may process data in other jurisdictions as part of delivering their services to us; clinical data is not sent to our error-monitoring or analytics tools. Where personal data is transferred internationally, we require appropriate safeguards, such as contractual data-protection commitments from the sub-processor, and we do not transfer data outside these arrangements without equivalent protection.
10. Data Retention
We retain personal data for as long as a center subscription is active and for a reasonable period thereafter to allow data export or account recovery. Centers may request the deletion of their data at any time by contacting our support team, and individual records within an active subscription are managed by the center administrator. Technical logs and error diagnostics are retained only as long as needed for security and troubleshooting purposes and are then deleted or anonymised. Data associated with a specific third-party integration (Google or Zoom) is deleted when that integration is disconnected, as described in the sections below.
11. Security
We use industry-standard security measures including TLS encryption in transit, encrypted storage for sensitive fields, role-based access control, and regular security audits. Access to production systems is strictly controlled and limited to authorised personnel on a need-to-know basis. Despite these measures, no digital system is completely risk-free; we encourage centers to use strong, unique passwords and to promptly report any suspicious activity to [email protected].
12. Your Rights
Depending on your jurisdiction, you may have the right to access, correct, export, or request deletion of your personal data, and to object to or restrict certain processing. Parents and specialist staff should first contact their center administrator, since the center controls the underlying clinical records. Centers may contact us directly at [email protected] to exercise rights over account and technical data we control. We will verify your identity before acting on a request and will respond to all requests within 30 days.
13. Marketing Communications
We may send you service-related communications (such as appointment reminders, security notices, or changes to this policy) as part of delivering the service; these are not optional while your account is active. We only send promotional or marketing communications, such as product updates or newsletters, with your consent, and every such message includes a way to unsubscribe. Unsubscribing from marketing communications does not affect service-related messages.
14. Automated Decision-Making
Aghsan does not use personal or clinical data to make automated decisions that produce legal or similarly significant effects on children, parents, or staff without human involvement. Product analytics and error monitoring are used only in aggregate, anonymised form to improve reliability and are never used to profile individual children or make clinical decisions.
15. Google API Integrations
When a user connects a Google account, Aghsan accesses the account identifier, email address, basic profile information, and OAuth access and refresh tokens needed to provide the selected integration. For Google Calendar, Aghsan uses the authorised access only to create, update, and delete calendar events associated with appointments managed in Aghsan; event details may include the service type, date, time, location, and a note that the event is managed in Aghsan. Aghsan does not import, read, or use calendar events that were not created through Aghsan. For Google Meet, Aghsan creates meeting spaces for online appointments and stores the resulting space identifier and joining URL. Aghsan does not access Meet recordings, transcripts, chat messages, participant information, or spaces not created through Aghsan. We store the connected account email, encrypted OAuth credentials, external event or meeting identifiers, and generated joining URLs only as needed to provide the integration. Credentials are encrypted at rest, transmitted using TLS, restricted to authorised services, and are not written to application logs. Google user data is used only to provide user-requested calendar and meeting functionality; it is never used for advertising, never sold to third parties, and never used to train artificial-intelligence or machine-learning models. It is shared only with service providers acting on our behalf where strictly necessary to operate Aghsan, or when legally required. Disconnecting a Google integration immediately deletes its stored OAuth credentials and internal integration mappings from Aghsan. Previously created Calendar events or Meet spaces may remain in the user's Google account and can be removed there directly. Users may also revoke Aghsan's access at any time through their Google Account permissions (myaccount.google.com/permissions) or request deletion of related data by contacting [email protected]. Aghsan's use and transfer of information received from Google APIs complies with the Google API Services User Data Policy, including its Limited Use requirements.
16. Zoom Integration
When a user connects a Zoom account, Aghsan accesses the account email and basic profile information solely to identify the connected account, together with OAuth access and refresh tokens needed to operate the integration. Aghsan uses the authorised meeting permissions only to create, update, and delete Zoom meetings associated with online appointments managed in Aghsan. Information sent to Zoom may include a meeting topic based on the appointment service type, its start time, duration, and time zone. Aghsan stores the connected account email, encrypted OAuth credentials, Zoom meeting identifier, and joining URL while the integration is active and as needed to provide the service. Credentials are encrypted at rest, transmitted using TLS, restricted to authorised services, and are not written to application logs. Aghsan does not request or access Zoom recordings, transcripts, chat messages, audio, video, or meetings not created through Aghsan. Zoom data is used only to provide user-requested meeting functionality; it is never used for advertising, never sold to third parties, and never used to train artificial-intelligence models. It is shared only with service providers acting on our behalf where strictly necessary to operate Aghsan, or when legally required. Disconnecting Zoom immediately removes the stored OAuth credentials and internal mappings and requests deletion of linked Zoom meetings created through Aghsan. Users may also remove the Aghsan app through the Zoom App Marketplace (marketplace.zoom.us) or request deletion of related data by contacting [email protected].
17. Third-Party Links
Our website and platform may contain links to third-party sites, such as Google or Zoom's own privacy policies, or resources we reference in our help center. This policy does not apply to those third-party sites, and we encourage you to review their privacy policies before providing them with personal data.
18. Changes to This Policy
We may update this privacy policy from time to time to reflect changes in our practices, the services we offer, or applicable law. We will notify active centers of material changes by email or in-app notice at least 14 days before they take effect. The date at the top of this page always reflects the current version, and we encourage you to review it periodically.
19. Contact Us
For privacy-related questions, requests, or complaints, please contact us at: [email protected] or through the contact form on our website. We aim to acknowledge all privacy inquiries promptly and to resolve them within 30 days. Aghsan is operated by DAR AL AGHSAN TECHNOLOGIES L.L.C, Al Garhoud, Dubai, United Arab Emirates.