Privacy policy

Last updated: 27 October 2026

This policy explains what data we collect on oculaos.com and in the Ocula system, why we collect it and how we protect it. It follows Egypt's Personal Data Protection Law No. 151 of 2020 and its executive regulations.

1. Who we are, and who is responsible for the data

Ocula is a cloud platform for running eye clinics and optical shops. There are two kinds of data, and each has a different party responsible for it:

• Your account and business data (your name, e-mail, phone, clinic name, and what you pay us): Ocula is responsible for it (the controller).
• Patient data that a clinic enters into the system: the clinic is the controller, and Ocula is a processor that stores and runs it on the clinic's behalf and only on its instructions. If you are a patient and want to see or correct your data, please contact your clinic first; we will help it handle your request.

2. What we collect on the website

• This website uses no tracking cookies and no analytics or advertising tools. The only thing saved in your browser is your language choice (Arabic or English).
• The "Contact support" form does not send your data to our servers. It opens WhatsApp or the e-mail app on your device with a ready message, and you decide whether to send it.
• Videos are served from YouTube in privacy-enhanced mode (youtube-nocookie.com) and load only when you press play.
• Our network provider (Cloudflare) logs general technical data such as IP address and browser type for a short time to protect the site from attacks.

3. What we collect in the system

• When you create an account or start a trial: name, e-mail, phone number, business name, type and specialty, and password (stored hashed; nobody can read it).
• While you use it: the patient records, exams, measurements, images, prescriptions, appointments and invoices the clinic enters.
• Security log: sign-in times, device, and who opened which record and when, to protect the account and review any unauthorised use.
• Payments: subscription payments go through Paymob. We never see or store your card number; we keep only the result, amount and date of the transaction.

Guest mode and the 60-minute trial are for exploring the system with sample data. Please do not enter real patient data before you subscribe and accept the service agreement.

4. Why we use the data

• To run the system and provide the service you subscribed to.
• To verify your account and send sign-in codes and necessary notices.
• To collect subscriptions and issue invoices.
• For technical support, and to protect the system from fraud and intrusion.
• To comply with the law and with requests from competent authorities.

We do not sell or rent data, and we never use patient data for advertising or to train any AI model. We may use aggregated statistics that identify no person or clinic (such as the total number of visits in the system) to improve the service.

5. How we protect the data

• Encrypted connections (HTTPS) on every page.
• Sensitive fields such as national ID and phone numbers are encrypted in the database with AES-256.
• Each clinic's data is isolated from every other clinic at the database level.
• Two-step verification, and permissions by role (doctor, reception, accountant, manager).
• An encrypted backup every day, kept for 14 days in a separate location.
• Our team accesses patient data only when a clinic asks for support, and every access is logged.

6. Who we share data with

We use a small number of service providers, each limited to what its job needs:

• Our cloud hosting provider (servers and database).
• Cloudflare (site protection and storage of encrypted backups).
• Our e-mail provider (verification codes and notices).
• Paymob (payment collection).
• Meta / WhatsApp Business, only if a clinic turns on WhatsApp appointment reminders (patient name, number and appointment time).

We disclose data to no one else except under a court order or a binding legal request.

7. Where data is stored

Data is stored on secured servers with a cloud hosting provider. Any transfer of personal data outside Egypt happens only under the licence issued by the Personal Data Protection Center and with equivalent safeguards. We tell subscribing clinics where data is hosted, and give 30 days' notice of any change.

8. How long we keep data

• Clinic data is kept for as long as the subscription is active.
• After a subscription ends, the data stays available to read and export for 30 days, is then deleted, and is erased from backups within a further 14 days.
• Trial accounts that do not subscribe are deleted 30 days after the trial ends.
• Invoices and payment records are kept for as long as tax law requires.

9. Your rights

Under Law 151 of 2020 you have the right to know what data is held about you and get a copy, to correct it, to ask for it to be deleted or its processing restricted, to object to processing, and to withdraw your consent. Send your request to [email protected]; we reply within 30 days at most. You may also complain to the Personal Data Protection Center.

10. Data breaches

If a breach affects personal data, we notify the affected clinic within 24 hours and the Personal Data Protection Center within 72 hours, and help notify the affected people as the executive regulations require.

11. Children

The system is meant for clinics, not for children. Clinics enter data about minor patients with a guardian's consent and under their own responsibility.

12. Changes to this policy

If we change this policy materially, we announce it on the website and inside the system, and notify subscribing clinics 30 days before it takes effect.

13. Contact

For any privacy question: [email protected]