Privacy policy
Last updated: November 2, 2026
Version before legal review
This text explains in plain language how the service works. Once a lawyer has reviewed it, the final version will be published on this page.
This policy explains how personal data of users of the Medbor mobile app, the Medbor website and the Medbor Telegram bot (the service) is collected, used and protected. By using the service, you agree to this policy.
1. Data controller
The service operator is Medbor. Legal entity details (name, address, taxpayer ID) will be published here once the company is registered. For personal data enquiries:
2. What data is collected
Your phone number and Telegram ID; profile data (name, date of birth, gender — if you provide them); family member profiles; visit history; messages with clinics and files you send; medical records written by doctors; your reviews; messages to the AI assistant; a device token for push notifications. Your location is used only to sort nearby clinics and is not stored.
3. Signing in with Telegram
You sign in without a password, via Telegram: the Medbor bot asks for your phone number and confirms the sign-in. We store your phone number and Telegram ID; no patient password is created or stored. Clinic staff sign in to the panel with a phone number, a password and a Telegram code.
4. Booking appointments
When you book, the chosen clinic sees your name, phone number, visit time and service. Your full phone number is visible to staff only while the visit is active. Medical records are visible only to you and your treating doctor; a doctor at another clinic sees them only with your permission, which you can revoke at any time. Clinic managers do not see medical data. Every staff access to medical data is recorded in an audit log.
5. AI assistant
Text (and images) you send to the AI assistant is passed to external AI providers — Groq and Google Gemini (USA) — after names, phone numbers and addresses are removed. The AI does not diagnose and does not replace a doctor. AI conversations are kept for 30 days and then deleted.
6. Push notifications
Notifications are sent via Google Firebase Cloud Messaging and Telegram. Notification text contains no medical information — only a general message.
7. Analytics and cookies
The website and app use no ad tracking or analytics services. The browser stores only what the service needs to work (for example, your chosen language and theme, and your sign-in session). For clinic advertising, only the number of views and clicks is counted, without personal data. Personal data is removed from technical error reports.
9. Retention
Data is kept while your account is active. If you delete your account, you can restore it within 30 days by signing in again; after that your name, phone number, Telegram ID, date of birth and gender are deleted. Visit history and medical records remain for the clinic's records without being linked to you. AI conversations are kept for 30 days.
10. Your rights
You can view and correct your data in the app, revoke permission to access your medical records, and delete your account (in the app or on the “Delete account” page of the website). For other requests, write to the address below.
11. Contact
For questions, requests and enquiries about your data: