Privacy policy

1. This website

This website uses Google Analytics to understand how people use its public pages and improve the site. It loads automatically when JavaScript is available. We do not display advertising or use Google Analytics for advertising.

Website and service search tools find matches on your device. Their local operation is separate from the website analytics described below. Your browser-history entry can retain a search, selected filters and return position for that page. If you switch between the light and dark themes, your choice is saved in your own browser.

Planning tools can remember selected public services, preparation checkboxes, practice steps and reading progress in this browser tab for up to 24 hours. They do not save quote amounts, patient details or identity documents, and do not send these choices to us. Use Clear planning progress on a planning page when using a shared device. Closing the tab normally ends this session; some browsers can restore a previous session.

You can copy a planning summary to your clipboard or print it using your device. Share it only when you choose to, and check which service information it contains.

The Contact form prepares an email on your device. It does not submit information to this website, send a message or subscribe you to notifications. You review and send any prepared message through your own email service. If you email us, we use your message and email address to reply. If you message us on WhatsApp, the message travels through WhatsApp, a Meta service, under its own terms and privacy policy; we use your number and message only to reply and do not add you to any list or broadcast. Do not include patient records or identity numbers in website, email or WhatsApp enquiries.

The launch updates form on the Launch status page sends registration details to us. With your consent, it sends your name, your mobile number or email address, your city, whether you need care or are a nurse who wants to join, and the language of the page you used. We use these details only to tell you when Nurse at Home opens in your city and to reply if you write back. They are kept in our database with Google Cloud in Doha (Qatar), only our administrators and support team can see them, and we never share them with advertisers or use them for any other marketing. The form sets no cookie. We delete your entry 12 months after you sign up, or sooner if you ask: email support@nurseathome.pk with the mobile number or email address you used.

The website is hosted on Google Firebase Hosting and delivered through Cloudflare’s network, which process technical information such as your IP address and browser details to deliver pages and protect the service.

If you choose to save an approved guide for connection failures, this device stores its public page, version, saved date and necessary fonts. Saving does not store a patient record or booking. Saved guides can remain after a tab closes; use Remove all saved guides in the guide’s saving controls to delete them. Browser storage can also be removed by the browser. Corrections and withdrawals can only be checked when connected.

A private launch-update removal link allows removal of the registration it identifies. Opening the page does not remove it: the removal form sends the private token to our API only after confirmation. Do not forward that link. You can also ask the support team to remove your registration.

Launch emails will use our Google Workspace sender only after delivery is configured and approved. Google Workspace will process your email address and the message to deliver the launch update you requested. This does not add a marketing purpose. We keep minimal campaign and recipient status records and a pseudonymous reference to prevent accidental repeat messages for at most 365 days, without a separate plain-text copy of your contact details. Removing a registration takes effect immediately, but a message already handed to Google Workspace cannot be recalled.

Google Analytics

Google Analytics 4 (measurement ID G-XYLLYDZ213) receives information such as the public pages viewed, visit and engagement information, device and browser details, and language. Google also processes technical information such as your IP address when receiving requests. Analytics cookies, including _ga and _ga_XYLLYDZ213, help distinguish browsers and sessions. We configure a one-year lifetime for these first-party cookies. Some analytics cookies may be renewed when you return or interact with the site, and your browser may limit their lifetime further.

Our analytics configuration sends the page’s canonical address without query strings or fragments, overrides the referrer with an empty value, and turns off Google signals and advertising personalisation signals. Our code does not add names, contact details, patient records, identity numbers or form entries as analytics parameters. Automatic measurement may also collect search terms from page addresses and interaction details such as link addresses and form metadata, according to the Google Analytics property’s settings. Do not enter private medical or identity information in public website tools or page addresses.

Google processes analytics information on its infrastructure, which may be outside Pakistan. This is separate from the app database and launch-update records held in Doha. Analytics event-data retention and Google’s handling of information depend on the property settings and Google’s policies. Read how Google uses information from sites that use its services and the Google Privacy Policy.

You can manage cookies through your browser settings or use the Google Analytics opt-out browser add-on. Browser privacy settings and content blockers may also limit analytics. Blocking future collection or clearing cookies does not automatically delete information already collected by Google. Google Analytics does not load without JavaScript or while viewing a saved guide.

2. Information the app uses

• Account: your name, date of birth and the email address from Google Sign-In, and your language and theme settings.
• Patients: each patient’s name, relationship to you, date of birth, gender, allergies, conditions and mobility needs.
• Addresses: visit addresses with a map pin, access notes and the household safety information you declare.
• Identity checks: your CNIC number, photos of both sides of your CNIC and a short face-check video.
• Nurses: PNMC registration details and the information returned by the official PNMC register, training records for procedures, profile photo, services and prices, service area, and location while on duty.
• Care: requests, bookings, consent records, prescriptions and other documents, emergency-check answers, visit records, supplies and receipts, messages, ratings and complaints.
• Payments: online payments are not open yet. PayFast is our payment partner for nurse availability-pass purchases in the app. The payment information described below will be used only when that payment service opens; this website does not collect payment details.
• Device: a hashed device identifier and a notification token, so we can send you updates.
• Emergency contact: the name and number you save for your SOS menu.

PayFast payments

When pass payments open, the app will send payment details securely through Nurse at Home to PayFast to authorise and verify the payment and handle payment problems or approved refunds. Depending on the method selected, this includes your payment contact number, wallet or bank account details, CNIC information required by the payment provider, and an email address when used by the selected payment flow. PayFast also receives the order and transaction references, amount, date, IP address and a payment-user reference that does not reveal your Nurse at Home account ID. Medical records are never sent to PayFast.

For a card payment, the card number, expiry and security code will also pass securely through Nurse at Home to PayFast. We keep order and transaction references, amounts, payment outcomes, payment-attempt and refund records, and masked payment-method details. Payment contact numbers and retained payment tokens are encrypted. Full account or card details, security codes and CNIC information entered for a payment are used for processing rather than saved as payment-method records or written to logs. A wallet number may also be the payment contact number we retain.

Saving an eligible wallet or bank account, if offered in the app, requires you to choose that option. PayFast will hold the saved method; Nurse at Home will keep its encrypted payment reference and masked details so you can select it again or remove it in the app. Cards cannot be saved. Saving a method does not authorise automatic pass renewal or automatic future charges.

3. How we use information

We use information to verify identities and nurse registrations, match families with nurses, run bookings and visits, keep care records, check consent and clinical orders, sell availability passes, handle complaints and privacy requests, keep the service safe and secure, send notifications and meet legal obligations. We do not sell personal information, and we do not use health information for advertising.

4. Location and Google Maps

The app uses location to place accurate visit pins, to show families how far away nearby nurses are, and to confirm that a nurse is at the right address when a visit starts and ends. While a nurse is on duty, families see only how far away the nurse is, never where the nurse is. Nurses see only an approximate distance to a visit until they set off for it.

Live trip sharing is separate and opt-in. It runs only while the chosen nurse is travelling to the patient, only the family and that nurse can see it, and only the latest position is kept. It expires within minutes and is deleted when the nurse arrives or the booking ends.

Maps, visit locations and routes in the app use Google Maps Platform. To show the map and calculate a route, Google processes the nurse’s latest position and the visit pin; names and care details are not sent for routing. Your use of these map features is also subject to the Google Maps Platform Terms of Service and the Google Privacy Policy.

5. Who we share information with

• The family and the nurse on a booking see what each needs for the visit. The exact address is released only to the chosen nurse when they set off, and a prescription is shown to nurses replying to a request only if the family allows it.
• Service providers that run parts of the service for us, including Google (Sign-In, Firebase Cloud Messaging, Maps Platform, Firebase Hosting and website Analytics), Cloudflare for delivering this website, and Google Cloud, which runs our server and keeps our database and private documents in its Doha (Qatar) region. Google Analytics processing is described above and is not confined to our Doha app database.
• PayFast and the bank or wallet involved in your payment, when availability-pass payments open, receive the payment information needed to authorise, process, verify or refund the purchase. PayFast’s payment processing is separate from the care service and from our Doha app database. The planned payment flow and retained payment information are described above.
• The Pakistan Nursing & Midwifery Council register, which we search with a nurse’s CNIC to check their registration.
• Authorities, when the law requires it or to protect someone from serious harm.

CNIC cards are read and the face check is screened on your own phone with Google ML Kit, before anything is uploaded. Health details, CNIC numbers and precise locations are kept out of notification text.

6. How we protect information

Sensitive fields, including CNIC numbers, addresses and access notes, patient names, care notes, messages and emergency contact numbers, are encrypted in our database with AES-256-GCM. Identity documents, prescriptions and receipts are kept in private storage, never on public links. Staff access is limited by role, and reviews of evidence and records are written to a tamper-evident audit log.

7. How long we keep information

Some information expires automatically: live trip locations within minutes, face-check challenges after seven days and in-app notifications after a year. Launch update sign-ups from this website are deleted 12 months after sign-up. Clinical records, consent records, bookings, payments, complaints and audit records are kept for as long as the law requires, and clinical records for at least seven years. These duties can mean some information cannot be deleted straight away.

Payment retention covers order and transaction references, amounts, payment outcomes and refund or dispute records, rather than a stored copy of full payment-instrument details. Removing a saved wallet or bank account prevents its future selection in the app; it does not erase records of earlier payments or refunds that we must retain. Banks, wallets and PayFast also keep their own transaction records under their applicable obligations.

8. Your rights

You can ask for a copy of your data, a correction or deletion from Profile > Privacy requests in the app, and each request has a 30-day response deadline. If a legal or clinical duty stops us deleting something, we will tell you. You can also withdraw consent for a booked service, and care for that service then stops.

9. Contact

For privacy questions, email support@nurseathome.pk. HEELS.PK (PRIVATE) LIMITED, Rawalpindi, Pakistan.

Business address

Phone: +92 333 1550012