Terms of Service

PHC — Personal Health Care, Lebanon. Last updated 14 September 2026.

These terms govern your use of the PHC Card and the PHC platform. By registering, buying a card, or using any PHC service, you accept them.

What PHC is

PHC issues a personal health card and runs the platform that lets you carry your health record and share it with a clinic or pharmacy you choose. PHC does not provide medical care and does not give medical advice. Your doctor and your pharmacist remain responsible for your treatment and for what they record.

Your account

Keep your Card PIN to yourself. Anything confirmed with your PIN is treated as done by you. Tell us at once if your card is lost or you believe someone else has used your account.

Payment

Card fees and subscription prices are shown before you pay and are quoted in US dollars; payment in Lebanese pounds uses the exchange rate shown on the receipt. A subscription runs for the period you bought, with a grace period after it ends before the record locks.

Messages

Messages you receive from PHC, and how to stop them, are described in the Privacy Policy. Consent to messages is never a condition of buying or using anything from PHC.

Using it properly

Do not ask for access to a record that is not yours, do not share another person's information, and do not attempt to break, overload or probe the platform. Clinics and pharmacies must ask for access for care, and may not use emergency access to avoid asking.

If something goes wrong

We work to keep PHC available and accurate, but we do not promise it will never be interrupted. We are not responsible for the clinical decisions of a doctor or pharmacist, nor for what they record. Nothing in these terms limits any right you have under Lebanese law.

How PHC is secured

PHC is built to Lebanese Law 81/2018 on electronic transactions and personal data. These are the protections that are in place, described plainly so you can hold us to them:

• Everything needs a sign-in. The only page that works without one is the emergency view of a card, which shows the few facts an ambulance needs and no medical history.
• Encrypted in transit. Every connection to PHC uses HTTPS, and the site is served only over a secure connection.
• Passwords are never stored. They are kept as a one-way hash (Argon2id), so nobody at PHC can read your password, including us.
• A second step to sign in. Staff accounts use an authenticator app or a passkey in addition to a password.

• An Action PIN for anything that matters. Issuing a card, taking a payment, changing an address or opening a record is confirmed with a four-digit PIN separate from the password, and the screen states exactly what is being confirmed before you enter it.
• You control access to your record. A clinic or pharmacy sees it only after you allow them, with your Card PIN, for a limited time and a limited scope.
• Emergency access is limited and reviewed. It exists for when you cannot answer. It is time-limited, recorded with a reason, and examined by the PHC office afterwards.

• Every view is logged. Each time anyone opens your record or your identity document, the activity log records who, what, when and from where. You can see that list yourself.
• The log cannot be rewritten. Entries are chained so that altering or deleting one is detectable, and that chain is verified automatically several times an hour.
• Identity documents are watermarked. An ID opened by a member of staff carries their name across it, so a photograph of a screen leads back to who took it.
• Staff see only what their role needs. Permissions are granted per role, and the rules are enforced by the database itself, not only by the screens.
• Nothing is silently deleted. Records are voided with a reason and kept, so a correction never erases the history of what happened.

• Backups are taken nightly and restoring from them is rehearsed, so an incident does not become a loss of your record.
• Consent is per purpose, dated, and revocable. Agreeing to a receipt is not agreeing to a campaign, and neither is agreeing to be contacted about anything else. Each is stored separately and any of them can be withdrawn.

No system is beyond failure, and we do not claim otherwise. What we do claim is that access is limited, that every access is recorded, and that the record of it cannot be quietly altered. If we ever discover a breach affecting your personal data, we will tell you and the competent authority as Law 81/2018 requires.

Ending it

You may stop using PHC at any time and ask us to close your account. We may suspend an account that breaks these terms or the law. Records we must keep by law are kept even after an account closes.

Law

These terms are governed by the laws of Lebanon, including Law 81/2018 on electronic transactions and personal data, and disputes belong to the competent Lebanese courts.

Contact

PHC — Personal Health Care, Lebanon · hello@phccard.com