Privacy Policy

1. Who we are

PosturePro Rehabilitation("we", "our", "us") is a physiotherapy clinic in Pakistan operating the website https://postureprocare.com. This policy covers information collected through that website. Information you give the clinic in person during treatment — your medical history, assessment findings, treatment notes — is held separately under clinical confidentiality and is not stored on this website.

2. What we collect

When you book an appointment we collect:

• Your name, so the clinic knows who is coming.
• Your mobile number, which we verify with a one-time code so we can reach you about the appointment.
• Your email address, only if you choose to give one. It is optional.
• The service and time you selected, and any notes you add.

If you use the contact form, we collect the name, email, phone number and message you enter.

We do not ask for your CNIC, date of birth, address, photograph or payment card details on this website, and there is no way to enter medical history here. Payments are handled at the clinic, not online.

3. Why we collect it

• To reserve your appointment slot and put it in the clinic's diary.
• To send you a confirmation, and to contact you if the appointment has to change.
• To confirm the mobile number you gave is really yours, which stops fake bookings taking slots from patients who need them.
• To answer enquiries you send us.

We do not use your information for advertising, and we do not build profiles of you.

4. Where your information is stored

This website keeps no database. Your booking is stored in the services below, which means it leaves Pakistan and is processed on servers operated by these companies under their own privacy policies:

• Google (Google Calendar): your name, mobile number, optional email, chosen service and any notes are saved as a calendar event on the clinic's calendar. This is the clinic's record of your appointment.
• Meta (WhatsApp): your mobile number and the text of the confirmation and verification messages we send you.
• Resend: delivers email — your booking confirmation if you gave an email address, and contact form enquiries to the clinic.
• Vercel: hosts the website and keeps short-lived server logs, which may include your IP address.

We share your information with these providers only to deliver the service you asked for. We do not sell your personal information to anyone, and we do not share it with advertisers or data brokers.

5. How long we keep it

• Appointments stay in the clinic's calendar as part of its treatment records until the clinic deletes them.
• WhatsApp messages remain in the conversation between you and the clinic until either side deletes them.
• Contact form enquiries stay in the clinic's email inbox.
• Verification codes are held only in your browser, in an encrypted cookie, and expire after 10 minutes.

6. Cookies

We use a small number of cookies, all strictly necessary to make booking work. There are no analytics, advertising or third-party tracking cookies on this site.

• A short-lived cookie holding your pending verification code, so we can check the code you type. It expires after 10 minutes.
• A cookie recording that your number was verified, so you can finish booking. It expires after 30 minutes.
• A sign-in cookie, used only by clinic staff on the admin pages.

These cookies cannot be read by JavaScript and are signed so they cannot be altered. Blocking them will prevent online booking from working.

7. Security

• All traffic to this website is encrypted in transit using HTTPS.
• Verification codes are never stored in readable form; only a cryptographic hash is kept.
• Only the mobile number you verified can be used to make a booking in your name.
• Access to the clinic's calendar and admin pages is limited to named clinic staff.

No system is perfectly secure. If you believe your information has been exposed, contact us at the address below and we will investigate.

8. Your rights

You may ask us to:

• Tell you what information we hold about you.
• Correct anything that is wrong, such as a misspelled name or an old number.
• Delete your booking information, subject to any records the clinic must keep by law.
• Stop contacting you about anything other than an appointment you have booked.

Write to us using the details below. Because bookings are identified by mobile number, please contact us from the number you booked with, or be ready to confirm it.

9. Children

We treat children, and the clinic offers paediatric physiotherapy. Appointments for a child should be booked by a parent or guardian using their own mobile number, and the parent or guardian is the person we will contact.

10. Changes to this policy

If we change how this website handles your information, we will update this page and the date at the top. Material changes to how we use existing information will be notified to affected patients where we are able to reach them.

11. Contact us

For any question about this policy, or to exercise any of the rights above: