Privacy policy

YABAAY is a platform that helps patients from different countries find and coordinate medical treatment abroad, and lets partner agents refer patients. This policy explains what personal data the YABAAY app collects, why we collect it, and the choices you have.

• Account details: your name, mobile number, country of residence, an optional email, and whether you are a patient or an agent.
• Treatment requests: the details you submit and the medical information and files you choose to upload, such as reports, scans and photos.
• Messages: your conversations with the care team and the AI assistant, and your support tickets.
• Payments: payment instructions and the proofs you upload.
• Agents: the referral code, the patients you referred (shown with limited details) and your commissions.
• Device: a notification token, the device platform and the app language, so we can send you notifications. The camera and your photos are used only when you choose to attach a file.

We use your data to create and secure your account, sign you in with a one-time code, review your treatment request, prepare treatment options, coordinate travel and treatment, answer your messages, send you notifications about your case, calculate agent commissions, prevent abuse and meet legal obligations. We do not sell your personal data and we do not use it for advertising.

Your medical file is handled by the YABAAY medical and operations team. Partner clinics receive the medical information needed to prepare a treatment offer in an anonymous form, and receive your identity only when it is needed to carry out your treatment. Agents see only limited details about the patients they referred.

We use trusted service providers to run the app: server hosting, SMS delivery of sign-in codes, Firebase Cloud Messaging for notifications, and an AI service that processes the messages you send to the AI assistant. We disclose data when the law requires it.

Data travels over encrypted connections (HTTPS), access is limited by role, and sign-in uses one-time codes. No system is perfectly secure, so please keep your phone and your codes private.

You can delete your account at any time from Profile > Delete account in the app, or by following the steps on our account deletion page. Deleting your account signs you out everywhere, removes your name, mobile number, email and photo, and stops notifications. Treatment, payment and audit records are kept without your identity, because medical and financial records must be kept for legal and safety reasons. Other data is kept only as long as needed for the purposes above.

You can ask us to access or correct your data through Help and support in the app. You can turn notifications off in your phone settings. To remove files you uploaded, contact support.

The app is for adults aged 18 and over. If we change this policy we will update the date above and, when the change is important, tell you in the app. For any question about your data, write to us from Help and support in the app.