Privacy Notice | PethHub

Summary

We collect what we need to run a healthcare directory and booking service: your account, your profile, family members you add, your appointments, reviews and saved items.
My Health is optional. Its contents are stored encrypted, and you can delete them at any time.
Clinics you book with see what they need for your appointment.
We do not sell personal information, show advertising or use third-party tracking cookies. YouTube videos and Facebook posts on provider websites load only if you choose to show them.

Information we collect

Information you give us

Account: your email address, your password (we store only a secure one-way hash of it, never the password itself) and whether your email address is verified.
Profile: your name, date of birth, sex, address (province, district and address line), preferred language and, if you add one, a profile photo.
Family members: the name, date of birth, sex and relationship of the people you add to My Family. If you add someone, please make sure they (or their guardian) know you are sharing their information with us.
Appointments: who the appointment is for, the clinic, service, professional, date, time and status. PethHub does not ask for the reason for your visit.
Reviews: the rating and text you write, and any reports you make about reviews.
Saved items: the professionals and clinics you save. They are visible only to you.
Preferences: your language and notification settings and the consents you give.
Messages: what you send us when you contact us.

My Health (only if you turn it on): health information that you, or a doctor you have seen, enter — for example measurements, test results, conditions, medicines, allergies, investigations, vaccinations and check-ups — and your answers to the “About you” questions, your health plans and your emergency care card. See “My Health” below.

Professionals and clinics: the business and professional details shown on public profiles, licence or registration numbers (masked on public pages), information we use to verify them, and the photos they upload.

Information collected automatically

Sign-in sessions: a record of each signed-in session, including the IP address and browser details (user agent), so we can keep you signed in and protect your account.
Security log: a record of important actions — for example sign-ins, bookings and changes to records — with the time and IP address.
Usage statistics: anonymous events, such as which profiles are viewed and which kind of search was made, linked to a random identifier stored in a cookie. They are never linked to your account and never include the words you searched for. See our Cookie Notice.

How we use your information

We use personal information:

to create and run your account and keep it secure;
to show the directory and let you search, save and book;
to send your appointment requests to clinics and keep you and them informed of changes;
to send service emails, such as email verification, password reset and appointment updates, and — if you allow them — optional emails such as an invitation to review a past visit;
to provide My Health, if you turn it on;
to publish reviews and moderate content;
to verify professionals and clinics;
to understand, in aggregate, how PethHub is used so that we can improve it;
to prevent fraud and misuse, investigate security incidents and meet our legal obligations.

We do not send marketing emails. If we start, we will send them only to people who have agreed to receive them. We do not sell personal information or use it for advertising.

Why we may use it

We use your information to provide the service you ask for; with your consent where we ask for it (for example, for My Health); to meet our legal obligations; and where it is needed to run a safe and reliable service. You can withdraw a consent at any time; this does not affect what we did before you withdrew it.

My Health

My Health stays off until you agree to its consent text. Your consent covers you and the family members you manage.
The content of your health entries is stored encrypted with a key that is kept separately from the database. Some labels — for example, which type of measurement was recorded — are stored unencrypted so that charts work; the values and notes are encrypted.
A doctor can add entries for you only after a confirmed or completed appointment with them, and only while My Health is on. A doctor sees only the entries they wrote. The entries you make yourself are not shared with clinics.
Each time health entries are viewed or changed, this is recorded in our security log, without the health values.
You can delete your My Health data at any time by turning My Health off (withdrawing your consent). This immediately deletes all your entries, including those added by doctors, and your health profile, plans, care card and explanations, for you and your family members.
AI explanations: where an AI explanation feature is offered and you use it, we send a limited summary to our AI service provider, Anthropic, which may process it outside Cambodia, including in the United States. The summary contains age, sex, recent readings and their ranges, the names of conditions, medicines and allergies, your “About you” answers and risk results. It does not contain your name, date of birth, account identifiers or free-text notes. The explanation is stored encrypted with your records.

Clinics and professionals you book with: the name of the person the appointment is for and the service, time and status of the appointment. Clinic staff manage bookings in PethHub's clinic workspace.
Clinic software: if a clinic connects its own practice-management system to PethHub, we send that system appointment identifiers and status changes for that clinic only, with an anonymous reference instead of your name or contact details.
The public: reviews you publish, shown with a shortened version of your name. Your profile, family members, appointments, saved items and My Health are never public.
Service providers that work for us, such as hosting, database, file storage, email delivery and AI providers. They may use the information only to provide their service to us.
Authorities, when the law requires it, or when it is needed to protect someone's safety or our legal rights.
A buyer or successor, if our business is reorganised or sold. This Notice will continue to apply to your information.

Where your information is processed

Some of our service providers, including hosting, email and AI providers, may store or process information outside Cambodia.

How long we keep information

Sign-in sessions and one-time links (such as password-reset links) are deleted automatically 30 days after they expire or are used.
Other information is kept while your account is open. We are setting specific retention periods for each type of information and will update this notice when they apply.
When an account is closed, we delete or anonymise information as described in “Your choices and rights”.
Deleted information can remain in backup copies until those backups expire.

Your choices and rights

You can:

view and correct your profile and family members at any time in your dashboard;
change your language and email-notification settings;
turn My Health off, which deletes your My Health data;
ask for a copy of your personal information;
ask us to close your account and delete or anonymise your information;
object to, or ask us to limit, how we use your information, or withdraw a consent you gave.

To make a request, email [Privacy contact email]. To protect you, we check that a request comes from the account holder (for example, by asking you to write from the email address of your account) before we act on it. We aim to respond within 30 days.

When we close an account, we delete your profile, profile photo, preferences, notifications, saved items and sign-in sessions; anonymise your family members and your account; and remove the text of your reviews from public view. We keep appointment records, which then no longer identify you, because clinics rely on them, and our security log. If you have upcoming appointments, we will ask you to cancel them first so the clinic is told. We recommend turning My Health off before you ask us to close your account; if you have not, we will delete your My Health data as part of closing it.

Security

We protect information with measures such as encrypted connections, hashed passwords, encryption of My Health content, access controls that keep each person's information separate, and security logs. No online service can be completely secure. If we become aware of a security breach that affects you, we will tell you and the authorities where required.

Children

PethHub accounts are for adults. Information about children is provided by a parent or guardian who adds them as a family member and manages their bookings and, if turned on, their My Health entries.

Changes to this notice

We will update this notice when our practices change. The date and version at the top of this page show the current version, and we will tell account holders about important changes.

Contact us

BOSIA Technology, [Registered address]. For privacy questions and requests: [Privacy contact email].