Privacy Policy

REGAIN is the orthopedic sports medicine and performance clinic of Dr. Maher Baroudi, located next to the Central Bank of Lebanon in Tripoli, Lebanon. This policy covers the REGAIN website (regainlb.com), the patient portal, and the REGAIN mobile app for iOS and Android.

The clinic is the controller of the information described here: we decide what is collected and why, and we are responsible for keeping it safe. For any question about this policy, write to info@regainlb.com.

We collect only what the clinic needs to treat you and to run your care. There is no advertising, no profiling, and no tracking of you across other apps or websites.

Identity information

Your full name, date of birth, gender, and — where the clinic or an insurer requires it — a national ID or passport number, an insurance payer and policy number, and your REGAIN patient identifier. For a patient under guardianship, we also record the guardian and the relationship.

Contact information

Your phone number, email address, home address or city, preferred language, and an emergency contact (name, phone, relationship).

Health-related information

The clinical record of your care: your presenting complaint, consultation and examination notes, diagnoses, imaging and reports you or the clinic upload, procedures and surgeries, prescriptions, and the appointments themselves. It also includes the care instructions your doctor writes for you, your recovery program and the exercises in it, and your own self-reports — the pain, function and confidence check-ins you submit and the exercises you tick off.

Account and device information

The email address you sign in with, a user identifier, and — if you turn on reminders — a push notification token for your device. If you enable Face ID or fingerprint unlock, that check happens on your own device: the biometric data never leaves it and we never receive it.

Billing information

What was charged for a visit, procedure or surgery, what was paid, by which method, and the outstanding balance. We do not store card numbers; where an online payment provider is used, the card details are handled by that provider and never reach us.

Referral and intake details

How you heard about the clinic, who referred you, and — if you are an athlete — your sport, club or team and activity level, because these change how a recovery program is written.

The mobile app requests access to your camera and photo library only so you can upload imaging and documents to the clinic. It reads nothing from your photos unless you pick a file to send.

Every use below exists to deliver or support your care. We do not use your information for anything else without asking you first.

• To provide medical care — to examine, diagnose and treat you, and to keep the clinical record that makes safe follow-up possible.
• To manage your appointments — to book, confirm, reschedule or cancel a visit, and to send you reminders before it.
• To deliver your instructions and recovery program — so the do's and don'ts after an injection or surgery, and your phase-by-phase pathway, reach you and stay available offline.
• To measure your progress — your check-ins and exercise completions let your care team see whether the plan is working and adjust it.
• To communicate with you — appointment messages, results, and answers to what you send the clinic.
• To handle billing — to record what is owed and paid for your care.
• To keep the service secure and working — to authenticate your sign-in, prevent unauthorised access, keep an audit trail of who opened a record, and diagnose faults.
• To meet legal and professional obligations — Lebanese medical record-keeping duties, and lawful requests we are required to answer.

We rely on your consent for the patient portal and app, and on the necessity of providing medical care and meeting our legal obligations for the clinical record itself. You can withdraw consent to the app at any time without affecting your care at the clinic.

REGAIN does not sell, rent or trade your personal or health information — to anyone, for any price. We do not share it with advertisers, data brokers or marketing networks, and we do not use it to target you with advertising anywhere.

The app contains no advertising SDKs and no cross-app tracking. Nothing you enter is used to build a commercial profile of you.

Inside the clinic, your record is visible to Dr. Baroudi and to the staff involved in your care — reception for scheduling, nursing and assisting clinicians for treatment, and administration for billing. Access is enforced by the system itself, not by convention: each account is limited to the patients it is entitled to see, and record openings are logged.

In the app and the portal you see only your own records, and those of a dependent you are the registered guardian of.

Outside the clinic, we share information only in these situations:

• With a hospital, surgeon, anaesthetist, laboratory or imaging centre involved in a procedure the clinic arranges for you — limited to what that step requires.
• With a physiotherapist or other practitioner you are referred to, or who referred you, when continuing your care requires it.
• With your insurer, when you ask us to bill them or a claim requires supporting documentation.
• With the service providers listed below, who process data strictly on our instructions.
• When the law requires it — a court order, a lawful request from a competent authority, or a duty imposed on the treating physician.
• With anyone you explicitly ask us to share it with.

Your information is stored in a managed PostgreSQL database hosted by Supabase, together with the files (imaging, reports, documents) you or the clinic upload. Data is encrypted in transit with TLS and encrypted at rest on Supabase's infrastructure. The database enforces row-level security, so a request can only ever return the records the signed-in account is entitled to.

Supabase operates outside Lebanon, which means your information is stored on servers abroad under that provider's security and data-protection commitments. Using the app or portal involves that transfer.

On your own device, your session is held in the platform's secure storage — the iOS Keychain or the Android Keystore — and you can add Face ID or fingerprint unlock on top of it. Sign-in uses a one-time code sent to your email; there is no password to be reused or leaked.

No system is perfectly secure. If a breach ever affects your information, we will tell you and the relevant authorities as promptly as we reasonably can, and describe what happened and what we are doing about it.

We use a small number of providers to run the service. Each processes data only to perform its function for us, under contract, and none is permitted to use it for its own purposes.

Supabase

Database, file storage and authentication — this is where your record physically lives.

Vercel

Hosting for the website, portal and API. Serves pages and passes requests through; it does not retain your clinical data.

Expo / Apple / Google push services

Delivery of appointment reminders and notifications to your device. A notification carries only what is needed to bring you into the app — never a diagnosis or clinical detail.

Anthropic

AI assistance used inside the clinic to summarise and organise clinical information for your care team. Anthropic does not train its models on data sent through its business API.

REGAIN uses automated tools to help summarise and organise clinical information for the care team — for example, drawing the relevant history together before a consultation. AI never makes a decision about your treatment, and nothing an automated tool produces enters your file without a clinician reviewing it. You are never diagnosed or treated by software.

The website and portal set only the cookies needed to keep you signed in and to remember your language. There are no advertising cookies and no third-party analytics or crash-reporting tools collecting your activity. If we add analytics or crash reporting later, we will update this policy and say so before it starts.

Medical records are kept for as long as Lebanese law and professional practice require a treating physician to keep them, which outlasts your use of the app. Keeping the clinical record is a duty we owe you as a patient, not a choice we make as a business.

• Clinical records — retained for the statutory period, and longer where an ongoing matter requires it.
• Billing records — retained as long as accounting and tax rules require.
• App and portal account data — removed when you close your account, except where it forms part of the clinical or billing record above.
• Push notification tokens — deleted when you turn off notifications, sign out, or remove the app.
• Access and audit logs — kept for a limited period so an unauthorised access can be investigated.

Your record is about you, and you can act on it. You may:

• Ask for a copy of what we hold about you.
• Ask us to correct anything inaccurate — a misspelt name, a wrong date of birth, an outdated phone number.
• Ask us to delete your data, and to close your app or portal account.
• Withdraw your consent to the app or portal at any time; your care at the clinic is unaffected.
• Turn off notifications, from the app or from your device settings.
• Object to a particular use of your information, or ask us to restrict it.

To make any of these requests — including deletion — email info@regainlb.com from the address on your file, or ask at the clinic reception. Say what you want done. We will confirm your identity before acting, so that nobody else can obtain or erase your record, and we will respond within 30 days.

What deletion means: we close your account and erase your app and portal data, your uploads, your self-reports and your notification tokens. Where the law obliges a physician to retain the clinical record of care already given, that record is retained for the required period and nothing further is done with it, then it is destroyed. We will tell you plainly which parts of your request we can complete immediately and which are held by that obligation.

The clinic treats young athletes, and a minor's record is created and managed by the clinic with the consent of a parent or guardian. App and portal access for a dependent is held by their registered guardian, not by the child. We do not knowingly create an independent account for anyone under 18. A guardian may exercise every right in the section above on the child's behalf.

If this policy changes in substance, we publish the new version here with a new version number and date, and the app asks you to read and accept it the next time you open it. Your acceptance is recorded against the version you actually saw.

Questions about this policy, requests about your data, and complaints all go to the same place — and a person at the clinic answers them.

Email

info@regainlb.com

Phone / WhatsApp

+961 81 060 626

In person

REGAIN — Next to Central Bank of Lebanon, Tripoli, Lebanon

If you are not satisfied with our answer, you may raise the matter with the competent Lebanese authority or with the Lebanese Order of Physicians.