Privacy Policy

• Identity — full name, date of birth, gender, NIRA national ID (for Somali nationals) or passport number and country (for foreign-trained applicants), profession.
• Contact — the email address on your Google account, optional phone number.
• Credentials — uploaded education certificates, internship records, NCHE equivalence certificates for foreign-trained applicants, and other documents you submit as part of an application.
• Application metadata — submission status, review notes from NHPC officers, timestamps, and the licence number issued on approval.
• Technical — server-side request logs (IP, user-agent, page) and small functional cookies for language (lang), theme (theme), and authentication session.

We do not use advertising trackers, third-party analytics, or behavioural profiling.

• To process your application and issue a licence on approval.
• To allow NHPC reviewers (Officer → Head of Licensing & Accreditation → Secretary General) to evaluate eligibility and credentials.
• To make issued licences publicly verifiable at /verify by licence number — this surfaces only the holder's name, profession, status, and validity dates.
• To send transactional notifications (application status, licence renewal reminders).
• To meet our legal and regulatory obligations.

• NHPC and the Ministry of Health — the regulator on whose behalf we issue licences.
• Public licence verifier — anyone with a licence number can confirm a licence's authenticity at /verify; contact details and uploaded documents are never exposed there.
• Trusted service providers that run the platform on our behalf — covering sign-in, cloud hosting, database and file storage, email delivery, and payment processing. They may process data only to provide their service to us, under contract.
• Law enforcement or courts — only when compelled by valid legal process under Somali law.

We do not sell, rent, or trade personal information.

• Active profiles + licences: kept for the life of the licence and renewal cycles, plus the period required by NHPC retention rules.
• Rejected applications: kept for two years to support reapplication and audit.
• Audit logs of regulator decisions: kept permanently as part of NHPC's public-record obligations.

You can:

• See and correct your profile and application details inside the app at any time.
• Ask for a copy of all data we hold about you, in machine-readable form.
• Ask us to delete your account. NHPC may keep regulatory decisions that mention you, but other personal data will be erased.
• Withdraw consent for non-essential processing.

Email info@ehr.so and we will respond within 14 days.

All traffic is encrypted in transit (HTTPS). Data at rest is held in a managed cloud database with encryption, with access scoped by role: applicants see their own data; NHPC reviewers see only what their stage of the review requires; super-admins manage configuration. Authentication is handled by Google OAuth — eHR never sees or stores your Google password.

eHR is for licensed and aspiring health professionals; it is not directed at anyone under 18. We do not knowingly collect data about children.

Data is hosted with cloud providers that may store and process it outside Somalia. By using eHR you consent to that transfer. We choose providers with industry-standard security and contractual data protections.

When we make material changes to this policy we will publish the new version here and update the effective date. For significant changes we will also notify active users by email.

Questions about privacy or general support: info@ehr.so.