Effective date: July 30, 2026
Last updated: July 30, 2026
Sohtak ("Sohtak," "we," "us," or "our") provides a practice management platform for independent wellness practitioners — physiotherapists, nutritionists, and mental health practitioners — in Lebanon, with planned expansion to the GCC. This Privacy Policy explains what information we collect, how we use it, and the choices available to you.
This Policy applies to two groups of people, and their information is handled differently:
- Practitioners — the professionals who create an account on Sohtak, subscribe to our tools, and use them to run their practice.
- Patients — the individuals a practitioner books, treats, and manages through Sohtak on the practitioner's behalf.
If you are a patient of a Sohtak practitioner, please also see Section 6 ("If You Are a Patient") below, which explains your relationship to Sohtak specifically.
1. Who We Are, and What Role We Play
Sohtak is the software layer independent practitioners use to run their practice: booking, patient records, session notes, reminders, and related tools.
- For practitioner account data (how a practitioner signs up, subscribes, and uses Sohtak), Sohtak is the data controller — we decide how and why that data is processed.
- For patient data that a practitioner enters, stores, or manages through Sohtak (names, contact details, booking history, clinical or session notes), the practitioner is the data controller, and Sohtak acts as a data processor / infrastructure provider on their behalf. The practitioner is responsible for having a lawful basis to collect and store that information and for their own duties to their patients — including confidentiality obligations arising from their profession. Sohtak processes patient data only to provide the platform's functionality (e.g., sending a booking confirmation) and does not use it for our own independent purposes.
2. Information We Collect
From practitioners, directly:
- Account and identity information: name, WhatsApp number (used as your account credential and verified by one-time password), email, practice category, professional details you choose to add to your profile.
- Subscription and plan information: the tier you're on and your billing status. Sohtak does not process, store, or transmit payment card numbers or bank account details. Any payment mechanism connected to your subscription is handled by a third-party processor or offline arrangement, never by Sohtak's own systems.
- Content you upload: profile content, documents, session templates, and anything else you choose to add.
From practitioners, on behalf of their patients:
- Patient contact details (name, phone number) entered so bookings and reminders can be sent.
- Booking and scheduling data (appointment times, service type, status).
- Session notes, progress tracking, and CRM notes the practitioner records.
- Any other information a practitioner chooses to store about a patient within the platform.
Automatically, when you use our marketing site or product:
- Usage and analytics data (pages visited, features used, session duration) via our analytics tooling.
- Cookies and similar identifiers on our marketing site, used to understand how visitors find us and to remember form progress (see Section 7).
- Device and log information (IP address, browser type, timestamps) generated in the ordinary course of running the service.
3. How We Use Information
We use information to:
- Create and secure practitioner accounts, including verifying your WhatsApp number via OTP.
- Operate the core product: booking, calendar management, CRM/patient records, session notes.
- Send transactional WhatsApp notifications on a practitioner's behalf — for example, booking confirmations and reminders sent to their patients. These are triggered by actions inside the platform and delivered through our messaging infrastructure (currently via an automation layer and a WhatsApp Business API delivery partner).
- Provide customer support and respond to inquiries.
- Understand product usage so we can improve Sohtak.
- Communicate with practitioners about their account, product updates, and (where a practitioner has opted in) marketing or educational content.
- Meet legal, tax, and regulatory obligations.
We do not sell personal information, and we do not use patient data collected on a practitioner's behalf for advertising.
4. WhatsApp Notifications
Sohtak's notification system sends messages (such as booking confirmations) directly to patients via WhatsApp, triggered by events in a practitioner's account. To do this, a patient's phone number and relevant booking details are shared with our messaging delivery infrastructure solely for the purpose of sending that message. This infrastructure does not use patient information for any purpose beyond delivering the message the practitioner triggered.
5. Google API Services User Data Policy
Sohtak’s use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements.
Sohtak does not use raw, aggregated, anonymized, or derived Google Workspace API data to develop, improve, or train generalized artificial intelligence or machine-learning models.
6. Who We Share Information With
We share information only as needed to run the platform:
- Service providers/subprocessors who help us operate Sohtak — for example, our CRM and marketing tooling, scheduling infrastructure, workflow automation layer, WhatsApp message delivery partner, analytics provider, and email delivery provider. Each is bound to use information only to provide their service to us.
- Legal and safety reasons — if required by law, regulation, court order, or to protect the rights, safety, or property of Sohtak, our practitioners, or others.
- Business transfers — if Sohtak is involved in a merger, acquisition, or sale of assets, information may transfer as part of that transaction, subject to this Policy (or a policy offering equivalent protection).
We do not share patient data with other practitioners or third parties for their own marketing purposes.
7. If You Are a Patient
If you're booked, treated, or managed through Sohtak by a practitioner, your primary relationship for that data is with your practitioner, not with Sohtak. Your practitioner controls what information is stored about you, for how long, and for what clinical purpose. Sohtak simply provides the infrastructure they use to do that.
If you have questions about what a practitioner has recorded about you, want it corrected, or want it deleted, your first point of contact should be your practitioner directly. If you're unable to resolve something with your practitioner, you can also reach us at admin@sohtak.app and we'll assist where we're able to, consistent with our role as processor.
8. Cookies and Similar Technologies
Our marketing site uses cookies and similar technologies to:
- Remember where a visitor came from (for example, which campaign or link brought them to the site), so we can understand what's working.
- Support forms and scheduling tools embedded on the site.
- Measure site usage in aggregate.
You can control cookies through your browser settings. Disabling cookies may affect some site functionality, such as form pre-fill.
9. Data Retention
- Practitioner account data is retained for as long as the account is active, and for a reasonable period afterward to meet legal, accounting, or dispute-resolution needs.
- Patient data is retained according to the practitioner's own instructions and practice, subject to any minimum retention period required by the practitioner's professional or legal obligations. When a practitioner deletes a patient record or closes their account, we delete the associated data from our active systems within a reasonable period, except where retention is required by law.
10. Data Storage and International Transfer
Sohtak is built for practitioners in Lebanon, with planned expansion into the GCC. Some of the infrastructure and service providers we rely on to operate the platform (hosting, messaging, CRM, analytics) may store or process data outside Lebanon. Where this happens, we work with providers who maintain appropriate security practices for the information they handle.
11. Security
We use reasonable technical and organizational measures to protect information stored on Sohtak, including access controls and secured integrations between our systems and third-party service providers. No system is completely secure, and we cannot guarantee absolute security, but we work to keep the platform's practices in line with what's appropriate for the sensitivity of the data involved.
12. Your Rights
Depending on applicable law, you may have the right to request access to, correction of, or deletion of personal information we hold, or to object to certain processing. Practitioners can manage most of their own account and patient information directly within the product. For anything else, contact us at admin@sohtak.app and we'll respond within a reasonable time.
13. Children
Sohtak's practitioner accounts are intended for licensed adult professionals. Patient records may include minors where a practitioner treats minors as part of their practice — in those cases, the practitioner (not Sohtak) is responsible for obtaining any parental or guardian consent required under applicable law and their professional obligations.
14. Changes to This Policy
We may update this Policy as our product, practices, or legal obligations evolve. If we make material changes, we'll notify practitioners through the platform or by email. Continued use of Sohtak after an update means you accept the revised Policy.
15. Contact Us
Sohtak¹
Hermitage L1, Ghandour El Saad, Beirut, Lebanon
¹ A registered legal entity for Sohtak is in the process of being finalized. This page will be updated with the full legal entity name once incorporation is complete.
This Privacy Policy is a plain-language summary of our data practices and does not constitute legal advice to you. We recommend reviewing it with qualified counsel familiar with Lebanese and, where relevant, GCC data protection requirements before relying on it as your final published policy.