We are committed to safeguarding your privacy and ensuring that all personal data is handled in strict compliance with Jordan's Personal Data Protection Law No. (24) of 2023 and its implementing regulations. This Privacy Policy applies to all users of Tamini and governs our collection, use, storage, disclosure, and processing of personal data. By registering for, accessing, or continuing to interact with Tamini, you acknowledge that you have read, understood, and agreed to the terms set out in this Privacy Policy.

1. Personal Data We Collect

We collect only the personal data necessary to provide, operate, manage, and optimise Tamini. Because Tamini handles your personal data, we are transparent about what we collect and why. The personal data listed below is collected for the specific operational, analytical, administrative and legal purposes detailed in Section 2 (How We Use Your Personal Data) and is retained strictly in accordance with Section 7 (Data Retention Period).

Account and registration data

• Your phone number (from WhatsApp) — used as your account identifier.
• Your name, preferred language and time zone — given at registration.
• Your account number, and a record of your registration consent: the date and time you agreed, the version of this policy and the Terms you agreed to, the channel you used, and the words of your reply.
• Subscription and payment information when you subscribe to a paid plan: the plan you chose, the amount and currency, whether your subscription is active and when its current period ends, and the reference numbers our payment provider returns to us. We never receive your card number, expiry date or security code.
• If you begin registering but do not finish, the identifier you wrote from and what you sent during registration, kept for up to 30 days and then deleted.
• If you delete your account, your account number, a record of your plan and usage costs, and a record of when you agreed to our policies and to which versions — without your name, number or any health information — kept for accounting, billing and as proof of your consent.

Health data (sensitive data)

• Conditions, allergies and dietary restrictions you share with us.
• Medications (name, dose, timing, food interactions) that you tell us about or that we extract from documents.
• Medical reports you upload — lab results, prescriptions, discharge summaries, specialist reports, radiology images, vaccination records — and the text we read from them. A report can also name other people, such as your doctor or laboratory staff; we use their details only as part of your record.
• Lab values extracted from your reports, with trend comparisons against your previous results, and our automated assessment of them (for example, whether a value is outside its reference range).
• Food diary entries extracted automatically from your messages, with our automated estimate of each meal's calories and nutrients.
• Your doctors (name, speciality, clinic, phone).
• Your weight, your weight goal, and each weigh-in you record.

Messages and voice notes

• All text and voice messages you send over WhatsApp. Voice messages are converted to text and processed in the same way.
• Conversation history, including the topics of our weekly check-ins, is retained to provide continuity of care.

Caregiver and family data

When you link family members or caregivers, we store their names, identifiers and messages within the shared family conversation. Tamini supports three roles: primary caregiver (full access), patient, and sibling (read-only via a secure link).

Technical data

• Timestamps, error logs and basic usage metrics — for maintaining the service and improving its quality.
• Notes from our internal quality reviews of the service, which may quote parts of your conversation or records. They are used only to find and fix errors, and are deleted with your account.
• When a message to you cannot be delivered, a short extract of it, kept so that delivery can be retried and the fault investigated.

2. How We Use Your Personal Data

We use your personal data to:

• Operate, deliver, host, maintain, troubleshoot, and optimise the Tamini service and underlying infrastructure.
• Provide personalised health and nutrition advice based on your conditions, medications and needs.
• Track your food and warn you about anything that may conflict with your conditions or medications.
• Read and store your medical reports and track trends in your lab results.
• Manage your medication list and send reminders on time.
• Relay messages between you, your caregivers and the bot within the family conversation.
• Manage subscription, billing and technical support.
• Maintain security, prevent misuse and improve quality.

We do not sell or rent your personal data, and we do not share it with third parties for marketing purposes. We only share personal data with trusted third-party service providers (such as cloud hosting facilities, messaging and communications platforms, AI inference infrastructure vendors, and payment processors) who process information strictly on our instructions and under binding confidentiality and data protection terms, or where disclosure is required by applicable law, regulatory directive, or court order. We do not use your personal data to train AI models. We do not show you advertisements based on your personal data.

3. Consent

We collect, use, store, transfer, disclose and process your personal data on the basis of your explicit consent. Consent is obtained at registration, before your account is established. Your continued access to, use of, and interaction with Tamini constitutes your ongoing and binding consent to the collection, use, transfer, processing, storage, and disclosure of your personal and health data in the manner and for the purposes set out in this Privacy Policy.

Where a primary caregiver establishes a family plan or links a patient, the caregiver warrants and represents that the patient has given explicit, informed consent for their health and personal data to be accessed, processed, and managed by the caregiver and any linked siblings in the manner described herein, or that the caregiver holds lawful authority to act on the patient’s behalf. When a patient within a family requests data deletion, the caregiver is notified. Where a patient is linked to a family plan, that patient’s continued use of and interaction with the service constitutes their express consent to their health and personal data being accessed, processed and managed by the designated caregiver and any linked siblings.

You may withdraw your consent at any time; doing so may restrict or end the service, as personal data is essential for providing the service.

4. Data Storage and Security

We implement reasonable and appropriate administrative, physical, and technical security arrangements to protect your personal data against unauthorised access, collection, use, disclosure, copying, modification, disposal, loss, or similar risks. These safeguards include industry-standard encryption protocols for data in transit and at rest, strict role-based access restrictions, and secure backup procedures. While we take all reasonable precautions to safeguard your personal data, no method of transmission over the internet or electronic storage is completely secure, and we cannot guarantee absolute security.

5. Service Providers and Transfers Outside Your Country

To provide the service, we only share personal data with trusted third-party service providers (such as cloud hosting facilities, messaging and communications platforms, AI inference providers, and payment processors) who process data strictly on our instructions and under binding confidentiality and data protection obligations, or where disclosure is required by applicable law, regulatory directive, or court order. We do not use or permit our service providers to use your personal data to train public artificial intelligence models.

Payment information. When you purchase a paid plan, payment is processed by a licensed third-party payment service provider. Your card or payment-instrument details are submitted directly to that provider on a page it hosts; we do not collect, receive or store your full card number, security code or bank credentials. We receive from the provider a record of the transaction, which includes a transaction identifier, the amount and currency, the date, the outcome of the payment, the last four digits and card type where applicable, and the country associated with the payment method. We use that record to provide and support your subscription, to process refunds and disputes, and to meet our accounting, tax and record-keeping obligations. Our payment providers operate internationally and your payment information may be processed outside the Hashemite Kingdom of Jordan, on the same basis as any other transfer described in this Section; we rely on the contractual and technical safeguards those providers apply. We retain transaction records for the period required by applicable accounting and tax law, even after your account is deleted.

Transfers outside Jordan

To deliver the service, your personal and health data may be transferred to, stored, or processed outside the Hashemite Kingdom of Jordan, where our third-party infrastructure and technology providers operate. We transfer personal data outside the Kingdom only where the level of protection afforded to that data is not less than the level of protection required within the Kingdom, or where you have given your express consent to the transfer after being informed that adequate protection is not available. In either case we take appropriate steps to ensure that the recipient is bound by legally enforceable obligations to protect the transferred personal data.

6. Your Rights

You are entitled to the following rights in respect of your personal data:

• Access: You may request access to the personal data we hold about you.
• Correction: You may request that we correct any error or omission in your personal data in our possession or under our control.
• Deletion: You may type "delete my data" in the bot at any time. After you confirm, your account is closed and your access stops at once; your personal data is permanently deleted from our database and from every backup within 30 days. Your account number and billing records are kept as described in Section 11 of the Terms.
• A copy of your data: You may request a copy of your personal data.
• Withdrawal of consent: You may withdraw your consent for the continued collection, use, or disclosure of your personal data at any time (this may end the service).

To exercise any of these rights, contact our Data Protection Officer at info@almaseer.co with sufficient information for us to verify your identity and locate the requested records. We will respond to your request within 30 days. If you are not satisfied with our response, you may escalate your complaint to the Personal Data Protection Unit at the Ministry of Digital Economy and Entrepreneurship, which considers complaints free of charge and responds within ten (10) days.

7. Data Retention Period

We retain your personal data only for as long as necessary to fulfil the purposes for which it was collected, to provide the service to you, or as required or permitted by applicable law (including satisfying statutory, accounting, or legal requirements, and resolving disputes). When retention is no longer necessary for the foregoing purposes, we will securely delete or anonymise your personal data in accordance with applicable law.

8. Data Breach Notification

In the event of a breach affecting your personal data, we will assess the incident and notify the competent regulatory authority and affected individuals where and in the manner required by applicable law.

9. Children's Data

Tamini is designed strictly for individuals aged eighteen (18) years or older. We do not knowingly collect, solicit or process any personal data from anyone under the age of eighteen (18). If we discover that personal data of an individual under 18 has been collected without valid parental or legal guardian consent, or if a parent or legal guardian notifies us of the same, we will delete the data.

10. Changes to This Policy

We may update this policy from time to time. We will notify users of material changes through the bot before they take effect, and continued use after notification constitutes acceptance. If you do not agree to the updated terms, you may stop using the service.

11. Contact