PRIVATE PRACTICE PORTAL
Clinical portal privacy notice
How this separate portal handles practice information · 18 October 2026
What belongs here
This portal is separate from the public WordPress website. After the practice verifies identity and obtains account consent, it can hold patient contact and identity details, dates of birth, recorded sex, authorized family relationships, appointments, patient-reported health information, clinical notes, issued prescriptions, private documents, messages and manual billing records.
The public website’s request forms are for administrative enquiries. Do not send medical reports, passwords, activation codes or meeting links through those forms or the public chat assistant.
Who can see information
The doctor can access clinical records. Clinical assistants can work with records and draft observations, but cannot issue prescriptions. Reception handles verified identity and bookings; billing handles identity and invoices. Reception and billing cannot read clinical notes. Technical support accounts have no patient-record access. Each staff member has a separate account and must use an authenticator.
Patients can see their own released information. Access for a family member or guardian requires verified authority or recorded consent. The doctor can revoke that access, and patients can revoke delegates to their own record. Consent history is retained.
Storage and account protection
The application and its private storage run on the practice’s Hostinger VPS. Patient information payloads and document contents are encrypted. Operational metadata, such as appointment times, status and opaque record identifiers, remain in the database. Passwords and session tokens are stored as hashes. Infrastructure administrators control the server and its encryption key.
Private documents are checked for file type and scanned before acceptance. The portal uses protected connections, access checks and expiring sessions. Do not share your sign-in or recovery codes. Sign out after using a shared device.
Video, messages and payments
Online visits use a private Google Meet or Zoom link. The practice must manage the provider’s waiting room, identity checks and meeting access. Opening a joining link takes you to that provider, whose privacy arrangements also apply. Routine video recording is not enabled by this portal.
Messages remain in the private portal and are reviewed during practice hours. Automatic email and SMS delivery are not connected. Payments are recorded manually; this portal does not collect card details or process online payments.
Retention, corrections and recovery
No automatic clinical-record deletion is configured. The practice must approve its clinical retention and privacy handling procedure before intake opens; contact the practice about the retention arrangements for your records. The public website’s 90-day administrative-request setting does not apply to clinical records.
Issued prescriptions are retained unchanged. A correction creates another version, and earlier identity details and consent history are preserved. A privacy or deletion request requires practice review and does not automatically erase a clinical record or its backups.
Encrypted backups and isolated restore checks support recovery. Copies on the same server do not provide off-server disaster recovery. The owner is responsible for separate backup copies and private encryption-key recovery arrangements.
Your questions and choices
Use Privacy & preferences after signing in to download your accessible records, change contact preferences or sign out other sessions. Contact the practice to correct verified identity details, request a review of your information or discuss access for a guardian.
Call 01521527783 during practice hours, Saturday, Monday and Wednesday, 4–6 pm Bangladesh time. Please ask for a private channel before sending sensitive information.