Privacy Policy

Glyph is a clinical assistant built by KhaM Health, a company based in Dhaka, Bangladesh. Glyph helps doctors run patient intake, prepare for consultations, draft visit notes, and follow up with patients over WhatsApp.

This policy explains what information Glyph handles, why, and the choices you have. It applies to the Glyph web application, the patient record links we issue, and the WhatsApp service operating from KhaM Health's verified business number.

Health information you or your clinic provide: symptoms and history captured during intake, photographs of prior prescriptions and lab reports, the consultation record, and the visit note your doctor approves.

Identifiers needed to link a record to the right person: name, age, phone number, and clinic. For doctors, we also hold professional details such as BMDC registration.

WhatsApp messages you send to or receive from the Glyph number, including text, images, and delivery status, so the service can respond and keep your record current.

Basic technical and consent records — for example, when and how consent was given or withdrawn — which we are required to keep for accountability.

To prepare a briefing for your doctor before your visit, to draft a visit note in the standard Bangladesh prescription format, to answer questions you raise over WhatsApp with general guidance, and to send follow-up reminders.

Glyph never replaces a doctor. It does not diagnose or prescribe. Anything it suggests is for the doctor to decide on, and any guidance sent to a patient is general and points you back to a clinician when needed.

Health data is sensitive personal data under Bangladesh's Personal Data Protection Ordinance 2025. We collect and process it only with consent, recorded at the point it is given, and you may withdraw consent at any time.

Where a family member or attendant speaks on a patient's behalf — common in Bangladeshi clinics — we record who provided each piece of information. Sending the Glyph number a message, or sharing a clinic code, is itself an opt-in to the WhatsApp service, and you can stop it at any time by replying with a stop word.

Glyph uses AI models to read documents, summarise intake, and draft notes. Before free text or images leave our systems for an AI model, we remove direct identifiers such as names, phone numbers, and national ID numbers, and we send the minimum needed for the task.

Those AI models are operated by third-party providers, and the request may be routed through an aggregation provider (OpenRouter, Inc.). This means de-identified content may be processed on servers outside Bangladesh. We do not allow these providers to use your data to train their models, and every external call is gated and logged.

The WhatsApp service runs on the WhatsApp Business Platform provided by Meta. When you message Glyph, Meta processes that message to deliver it, under Meta's own terms and privacy policy. We use it only for the purposes above and never for advertising.

We do not send unsolicited marketing on WhatsApp. Proactive messages are limited to clinical follow-ups and appointment reminders for patients who are linked to a doctor.

We do not sell your information. We share it only with the doctor and clinic responsible for your care, with the service providers that host and process data on our behalf under contract, and where the law requires it.

When a pharmacy verifies a prescription Glyph issued, it confirms only that the prescription is valid and not revoked — it does not expose your wider record.

Records are stored on managed cloud infrastructure (Supabase) hosted in Singapore (ap-southeast-1), with access restricted to the clinic responsible for the patient. Document images are kept in private storage that is not publicly reachable.

We keep health records for as long as needed to provide care and to meet legal and medical record-keeping obligations, and we delete or anonymise them when that need ends or on a valid request.

You may ask us what information we hold about you, ask us to correct it, withdraw consent, or ask us to delete it, subject to any record-keeping the law requires. Patients can view their own record through the secure link issued by their clinic.

To make any of these requests, contact us using the details below and we will respond within a reasonable time.

We protect information with access controls scoped to each clinic, private document storage, encryption of sensitive keys, and an append-only record of when data is shared externally. No system is perfectly secure, but we design Glyph to send as little as possible and to fail safe.

KhaM Health, Dhaka, Bangladesh. Email: hello@khamhealth.com.

We may update this policy as Glyph develops or as the law requires. The effective date below reflects the latest version, and material changes will be made clear on this page.