Legal

Privacy Policy

Last updated: 8 September 2026

1. Introduction

This Privacy Policy explains how Hashwa (“we”, “us”, or “our”) collects, uses, shares, and stores information when you use the Hashwa mobile application, website at hashwa.app, and related services (together, the “Services”).

By using the Services, you agree to this policy. If you do not agree, please do not use Hashwa.

2. Nature of the Platform

Hashwa is a technology platform that facilitates appointment discovery and scheduling between users and independent professionals. Users can browse professional profiles, view availability, and request or book appointments. Professionals can manage their profile, schedule, and appointment requests.

Hashwa itself does not provide professional, medical, dental, diagnostic, treatment, or advisory services. Hashwa is not a clinic, hospital, or dental practice. Hashwa does not diagnose conditions, recommend treatments, prescribe medication, make automated medical decisions, or deliver healthcare. Any professional service that follows an appointment is provided independently by the relevant professional, not by Hashwa.

The typical flow is: a user discovers a professional, views that professional’s profile and availability, requests or books an appointment, appointment information is shared as needed to arrange the visit, and the appointment is then managed through the platform.

3. Information We Collect

We collect only information that the Services actually use. We do not process payments in the app.

3.1 Users (customers)

• Phone number — required to create an account. We send a one-time verification code to that number to confirm you control it and to reduce fake accounts.
• Name — collected when you complete your profile after first sign-in. Used on your account and shown to a professional when needed for an appointment.
• Gender — optional. You may leave this blank.
• Date of birth — optional. You may leave this blank.
• Email and address — optional if you add them to your profile.
• Profile photo — optional if you upload one.
• Saved professionals — professionals you mark as favorites.

3.2 Appointment information

• Date and time of the requested visit
• Optional reason and visit type that you enter
• Status (for example pending, confirmed, completed, cancelled, or no-show)
• Ratings you give after a completed visit, and any written review you choose to leave

3.3 Independent professionals

If you apply to appear on Hashwa or already have a professional profile, we may store:

• Name, phone number, optional email, gender, and date of birth
• Whether you are a student or a practising professional
• University, study year, years of experience, and clinic or workplace name
• Address and map coordinates used to show you in nearby search
• Specialties, weekly availability, and verification status
• Optional profile photo, certificates, and work-sample files you or an administrator upload
• Application details submitted for review (including age and location if provided)

3.4 Device, location, and technical data

• Device tokens and platform — so we can send push notifications about appointments and account events.
• Device location — only if you allow it, used to show nearby professional profiles. You can decline; nearby search will be limited.
• Language preference stored on your device.
• Request identifiers and server logs used to operate and debug the Services.
• Public IP address — looked up in limited cases when a network error is reported, to help diagnose connectivity issues.

3.5 Analytics and crash data

In release builds, the app uses Firebase Analytics (Google Analytics for Firebase) and Firebase Crashlytics. See the Analytics and Third-Party Services sections below.

4. How We Use Information

• Create and verify your account, and keep you signed in.
• Show professional profiles, specialties, and available appointment times.
• Create, confirm, update, cancel, and remind you about appointments.
• Show a customer’s name and contact details to the professional on a booking, and show the professional’s profile details to the customer.
• Display ratings and reviews that users choose to submit.
• Review applications from people who want to appear as professionals, and operate the admin dashboard.
• Send in-app and push notifications related to appointments, applications, and account activity.
• Understand product usage and fix crashes.
• Keep the Services secure and prevent abuse.
• Comply with law and respond to lawful requests.

We do not use your information to diagnose conditions, recommend treatments, or make automated medical decisions.

5. Appointment Information

When you request or book an appointment, we store the time, the professional, your account, and any reason or visit type you provide. Both sides can see that booking and its status. After a visit is marked completed, you may rate that visit and, once, leave a written review of that professional.

Hashwa’s role is limited to recording and displaying this scheduling information. Hashwa does not attend, deliver, or supervise the professional service itself.

6. Information Shared With Other Users and Professionals

We share information when it is needed for discovery or for a specific appointment. We do not sell personal information.

• Public or in-app professional profiles may show name, specialties, student or practitioner status, university, clinic or workplace name, address, availability, ratings, reviews, and other profile fields the professional provides.
• On an appointment, the professional can see the customer’s name, phone number, and, if present on the account, gender, date of birth, email, and address. The customer can see the professional’s name, phone number, and profile details needed to attend the visit.
• Reviews you write may be visible to other users on that professional’s profile.
• Administrators can see account, appointment, and application records in order to operate Hashwa.

7. Analytics

Hashwa uses Firebase Analytics (Google’s analytics product for mobile apps, also known as Google Analytics for Firebase) in release versions of the app. We use it to understand how people use Hashwa, not to deliver professional services.

Analytics may record:

• Which screens you open and which buttons or features you use
• Sign-in, sign-up, and account events (including that you requested or verified a code, without the code itself)
• Search terms you type in the app
• Which professional profile you opened (internal id and display name)
• Whether a booking was started or submitted, and high-level result (success or error)
• Tab and language changes, and similar product events
• An internal user id and a role property (guest, customer, or professional)

Google may also collect standard mobile analytics signals (such as device and app version) under its own terms. See Firebase Privacy and Security and Google’s Privacy Policy.

8. Third-Party Services

We use the following services that may process information. We do not use payment processors in the app. We do not use Supabase.

• Hosting (DigitalOcean). Runs the Hashwa website, API, and database.
• Amazon S3. Stores files you or administrators upload (for example profile photos, certificates, and category icons).
• Firebase Cloud Messaging. Delivers push notifications to your device.
• Firebase Analytics. Product usage analytics, as described above.
• Firebase Crashlytics. Crash and error reports. May include an internal user id, the failing request path, and, for some network errors, a public IP address obtained from ipify.
• Firebase Realtime Database. Stores app-wide settings only (for example minimum app version and maintenance mode). It is not used as your account database.
• Sentry. Server-side error reporting when enabled, to help us fix API failures.
• ipify. A public-IP lookup used only as extra context on certain crash reports.

These providers process data on our instructions or under their own privacy policies where they act as independent controllers (especially Google/Firebase analytics and crash reporting).

9. Data Retention

We keep account, appointment, review, and related records while you use Hashwa and for a reasonable period afterward so we can operate the platform, handle disputes, and meet legal duties.

One-time verification codes are stored only until they expire or are used. Refresh-token sessions are stored as a hash, not as the raw token. Device tokens are removed when you sign out of push notifications or delete your account.

Some records may be kept longer if the law requires it, or if they are needed to show a past appointment to the other party.

10. Account and Data Deletion

You can delete your account in the Hashwa app: open Profile, choose Delete Account, and confirm. That calls our account-deletion API.

When you delete your account we:

• Sign you out and end your sessions
• Stop push notifications and remove this device’s notification token
• Archive the account so it no longer appears in sign-in or search (the phone number is changed so it cannot be used to sign in again on that record)

Appointment history, reviews, and similar records tied to past bookings are not fully erased, because the other party to a visit may still need that history. You may create a new account later with the same phone number; it will be a new account, not a restore of the old one.

You can also email zaid@hashwa.iq if you cannot use the in-app control.

11. Security

We use reasonable measures given the nature of the Services, including HTTPS, hashed session tokens, access controls, and limited admin access. No online service is completely secure. We do not claim that your information can never be accessed or that use of Hashwa is anonymous.

12. Your Rights

• Update your name and photo in the app.
• Leave gender or date of birth blank.
• Turn off push notifications in your device settings.
• Decline location permission.
• Delete your account as described above.
• Ask us for access to, or correction of, personal data we hold, by contacting us.

13. Children's Privacy

Hashwa is intended for adults who book appointments for themselves. We do not knowingly collect personal information from children under 13. If you believe a child has created an account, contact us and we will take appropriate steps.

14. International Processing

Our hosting, file storage, analytics, and crash-reporting providers may process information outside Iraq (including in the United States and the European Union). By using the Services you understand that your information may be processed in those locations.

15. Changes to This Policy

We may update this Privacy Policy from time to time. The “Last updated” date will change when we do. Continued use of the Services after an update means you accept the revised policy.

16. Contact Information

Hashwa
Iraq
Web: https://hashwa.app
Email: zaid@hashwa.iq