Privacy policy

The National Heart Foundation Hospital & Research Institute (NHF) runs the QuitPath programme and is responsible for the information collected through it. Health workers at Upazila Health Complexes, Community Clinics, Union Sub Centres and other public facilities use the app to enrol patients, follow them up every month and refer them to cessation counselling.

About patients, collected by a health worker with the patient's consent:

• name, age, sex, mobile number and address (village, union, upazila, district);
• national ID (NID) number, if the patient gives it. When the health worker scans the card's barcode, the app also reads the name and date of birth printed on it. Fingerprint and signature data in the barcode are never stored;
• tobacco use: each product used, its daily amount and years of use, and motivation to quit;
• the identifier on the NCD corner QR card, if the patient has one;
• monthly follow-up results, notes, and referrals to a cessation centre with the outcome of counselling calls.

About staff who use the app or dashboard: name, email, mobile number, role and facility, when and where each record was made, and the app version and phone model used.

Location. When a health worker saves an enrolment or follow-up, the app records the phone's GPS position at that moment. This shows where programme work takes place. The app does not track location in the background or when it is closed.

• to remind health workers when a patient's monthly follow-up is due;
• to refer patients who want help to a cessation centre for call counselling;
• to monitor and report on the programme, such as how many people have quit, by area and facility;
• to check that data is collected properly and to support staff.

Reports and maps use combined numbers. We do not sell personal information or use it for advertising.

• health workers see only the patients of their own facility;
• programme supervisors and administrators approved by NHF see the dashboard;
• counsellors at the cessation centre a patient is referred to see the details they need to call that patient.

Every account needs approval by an NHF administrator. Information may be shared with government health authorities only in combined form, or where the law requires it.

Data is stored in Google Firebase (Cloud Firestore and Firebase Authentication), in Google's data centre in Mumbai, India. It is encrypted in transit and at rest. Security rules on the server enforce who can read or change each record. So the app works without internet, a phone keeps a copy of its own facility's records. The app can only be opened by a signed-in, approved health worker, and changes made offline are sent to the server when the phone is back online.

We keep records for as long as the programme needs them to support patients and to report on results, and in line with NHF's record-keeping rules. Records are then deleted or made anonymous.

Taking part is voluntary. A patient can ask to see or correct their information, stop follow-up calls, or have their information deleted, by telling their health worker or contacting NHF. Stopping does not affect the care they receive.

Staff can delete their own account in the app (Profile, Delete account) or as described at quitpath.nhf.org.bd/delete-account.

National Heart Foundation Hospital & Research Institute
Plot 26/4, Section 1, Darus Salam Road, Mirpur, Dhaka 1216
Phone: 02-58054708 (lines 58054708-12)

We may update this policy. The date at the top shows when it last changed.