1. Privacy Commitment

People’s Primary Healthcare Initiative (PPHI) Balochistan is committed to protecting the privacy, confidentiality, integrity, and security of the information entrusted to us. As one of the largest public sector healthcare service providers in Balochistan, we recognize our responsibility to safeguard personal, medical, employee, operational, and organizational information while delivering quality healthcare services through secure digital technologies.

PPHI Balochistan continuously invests in modern information systems to improve healthcare delivery, strengthen organizational governance, enhance transparency, and support evidence-based decision-making across the province. These digital systems are designed with appropriate administrative, technical, and physical safeguards to protect the confidentiality and integrity of the information processed through them.

This Privacy Policy explains how PPHI Balochistan collects, uses, stores, protects, shares, and retains information obtained through its websites, enterprise systems, mobile applications, healthcare information systems, and other digital platforms.

By accessing or using any PPHI Balochistan digital service, you acknowledge that you have read and understood this Privacy Policy and agree to the practices described herein.

2. About PPHI Balochistan

People’s Primary Healthcare Initiative (PPHI) Balochistan is a public sector organization committed to improving access to quality primary healthcare services throughout the Province of Balochistan. Through an integrated healthcare delivery model, PPHI Balochistan manages and supports healthcare facilities across all districts of the province, delivering preventive, promotive, curative, maternal, newborn, child, adolescent, and emergency healthcare services.

To strengthen healthcare delivery and organizational efficiency, PPHI Balochistan operates multiple digital platforms that support clinical services, administration, human resource management, monitoring, finance, procurement, reporting, public health programs, and community engagement.

The organization is committed to ensuring that all information processed through these systems is handled responsibly, securely, and in accordance with applicable legal, regulatory, and organizational requirements.

3. Scope of this Privacy Policy

This Privacy Policy applies to all digital services, applications, websites, enterprise systems, and information systems owned, developed, operated, or managed by PPHI Balochistan.

The policy governs the collection, processing, storage, use, disclosure, and protection of information obtained through these services, regardless of whether access is provided through desktop computers, mobile devices, tablets, or other electronic platforms.

This Privacy Policy applies to:

• Employees
• Healthcare professionals
• Patients
• Visitors to the official website
• Consultants
• Contractors
• Vendors
• Development partners
• Monitoring officers
• District management teams
• Authorized government representatives
• Any other individual using or interacting with PPHI Balochistan digital services

This Privacy Policy applies regardless of the location from which authorized users access PPHI Balochistan systems.

4. Digital Services Covered

This Privacy Policy applies to all existing and future digital services provided by PPHI Balochistan, including but not limited to:

4.1 Official Website

The official PPHI Balochistan website provides organizational information, healthcare program updates, public notices, career opportunities, procurement information, publications, contact services, and other online resources.

Website: https://pphib.org

4.2 Enterprise Resource Planning (ERP)

The Enterprise Resource Planning (ERP) System supports organizational operations across the Head Office and all 39 districts of Balochistan.

The ERP platform facilitates integrated management of:

• Human Resource Management
• Employee Information
• Payroll Management
• Finance and Accounts
• Budget Management
• Procurement
• Inventory Management
• Fleet Management
• Administrative Services
• Approval Workflows
• Performance Monitoring
• Reporting and Analytics

Access to ERP services is restricted to authorized personnel based on role-based access controls.

4.3 ERP Self-Service Mobile Application

The ERP Self-Service Mobile Application enables authorized employees to securely access selected ERP services from mobile devices.

Features include:

• Employee Profile
• Attendance
• Leave Management
• Salary Information
• Notifications
• Approval Requests
• Organizational Announcements
• Personal Information Updates

Only authenticated employees may access these services.

4.4 PPHIB Monitoring Application

The Monitoring Application supports monitoring officers and authorized staff in conducting healthcare facility assessments, inspections, supervisory visits, and program monitoring activities.

The application assists in:

• Facility Monitoring
• Field Assessments
• Quality Assurance
• Observation Reporting
• Compliance Monitoring
• Program Evaluation
• Performance Tracking

4.5 Executive ERP

The Executive ERP portal enables authorized managers and senior officials to review organizational information, approve workflows, monitor operational performance, and access management reports.

Access is granted only to designated personnel with appropriate authorization.

4.6 OPD / Electronic Medical Record (EMR)

The OPD / EMR System supports healthcare professionals in documenting clinical encounters and maintaining electronic patient records.

Depending on authorized functionality, the system may support:

• Patient Registration
• Outpatient Services
• Medical History
• Clinical Notes
• Diagnosis
• Prescriptions
• Laboratory Requests
• Follow-Up Records
• Referral Management

Patient information is processed solely for healthcare delivery, continuity of care, and authorized public health reporting.

4.7 Sehat Dehleez

Sehat Dehleez is a digital healthcare platform developed to support community engagement and improve access to healthcare information and services.

The platform may provide services including:

• Health Awareness
• Community Engagement
• Health Information
• Service Requests
• Appointment-related Services
• Public Health Campaigns

Information collected through this platform is limited to that necessary for providing the requested services.

4.8 Future Digital Services

This Privacy Policy also applies to any future websites, mobile applications, cloud platforms, digital health systems, reporting portals, dashboards, or online services developed, deployed, or managed by PPHI Balochistan.

Unless otherwise stated, newly introduced digital services shall automatically fall within the scope of this Privacy Policy.

5. Definitions

For the purposes of this Privacy Policy:

Personal Information means any information that identifies or can reasonably identify an individual.

Patient Information means medical, clinical, demographic, diagnostic, treatment, laboratory, prescription, referral, and healthcare-related information collected through PPHI Balochistan healthcare systems.

Employee Information means employment-related information including attendance, payroll, leave, designation, organizational assignments, and performance records.

Processing means any operation performed on information, including collection, recording, storage, organization, retrieval, use, sharing, transmission, analysis, archival, or deletion.

Digital Services means all websites, enterprise systems, mobile applications, portals, dashboards, cloud services, and healthcare information systems operated by PPHI Balochistan.

Authorized User means an individual who has been granted permission by PPHI Balochistan to access one or more digital services.

6. Legal Basis for Processing Information

PPHI Balochistan processes information only for legitimate organizational purposes, including:

• Delivery of healthcare services
• Human resource administration
• Financial and administrative management
• Public health reporting
• Monitoring and evaluation
• Regulatory compliance
• Protection of organizational assets
• Improvement of healthcare services
• Statistical analysis using appropriate safeguards
• Fulfillment of contractual and legal obligations

Information is processed only to the extent necessary to perform authorized organizational functions.

7. Policy Applicability

This Privacy Policy applies to all employees, contractual staff, consultants, healthcare professionals, patients, volunteers, vendors, business partners, visitors, and any other authorized users of PPHI Balochistan digital services.

All users are expected to comply with this Privacy Policy while accessing or using PPHI Balochistan systems.

Failure to comply with organizational privacy and security requirements may result in restriction of access, disciplinary action, contractual remedies, or other actions permitted under applicable organizational policies and laws.

This Privacy Policy should be read together with applicable information security policies, acceptable use policies, human resource policies, and other organizational procedures issued by PPHI Balochistan.

Part 2 – Information We Collect

8. Information We Collect

PPHI Balochistan collects only the information necessary to provide healthcare services, manage organizational operations, support employees, maintain information security, comply with legal and regulatory obligations, and continuously improve the quality and efficiency of its digital services.

The type and extent of information collected depends on the digital platform being used, the role of the user, and the services being accessed. Different applications collect different categories of information based on their intended purpose and authorized functionality.

The information described below may be collected directly from users, generated through system activity, or received from authorized organizational records.

8.1 Employee Information

PPHI Balochistan processes employee information to administer employment, facilitate organizational operations, and provide secure access to digital services.

Depending on the application or system being used, employee information may include:

Personal Identification Information

1. Full Name
2. Employee ID
3. CNIC
4. Date of Birth
5. Gender
6. Designation
7. Department
8. District Assignment
9. Health Facility Assignment
10. Employment Status

Contact Information

• Mobile Number
• Official Email Address
• Residential Address (where applicable)
• Emergency Contact Details

Employment Information

• Date of Appointment
• Employment History
• Organizational Transfers
• Promotions
• Reporting Structure
• Supervisory Assignments
• Employment Category

Human Resource Information

The ERP and HR Self-Service systems may process information including:

• Attendance Records
• Leave Applications
• Leave Balances
• Salary Information
• Payroll Records
• Loans and Advances
• Allowances
• Performance Evaluations
• Training Records
• Service Certificates
• Official Notifications
• Employee Requests
• Approval History

Such information is processed exclusively for authorized human resource management and administrative purposes.

8.2 Patient Information

PPHI Balochistan operates healthcare information systems that support clinical service delivery and maintain electronic health records where applicable.

Depending on the healthcare service provided, patient information may include:

Demographic Information

• Patient Name
• Age
• Gender
• Date of Birth
• Contact Number
• Residential Address
• Guardian Information (where applicable)

Clinical Information

• Visit Date
• Medical History
• Presenting Complaints
• Clinical Examination
• Diagnosis
• Treatment Plan
• Prescriptions
• Laboratory Requests
• Laboratory Results
• Radiology Requests
• Referral Information
• Follow-up Visits
• Immunization Records
• Maternal Health Records
• Child Health Records
• Nutrition Information
• ANC / PNC Records
• Delivery Records

Patient information is collected solely to support healthcare delivery, continuity of care, clinical documentation, public health reporting, quality assurance, and other authorized healthcare functions.

Where practical, program reporting uses aggregated or anonymized information rather than identifiable patient records.

8.3 Organizational Information

The Enterprise Resource Planning (ERP) system processes organizational information required for efficient administration and service delivery.

Examples include:

• Payroll Information
• Budget Records
• Procurement Records
• Purchase Requests
• Inventory Information
• Fleet Management Records
• Asset Information
• Administrative Approvals
• Financial Transactions
• District Reports
• Performance Indicators
• Audit Records

Access to organizational information is restricted through role-based access controls.

8.4 Monitoring Information

The PPHIB Monitoring Application assists monitoring officers in evaluating healthcare facilities and documenting supervisory visits.

Depending on the monitoring activity, the application may collect:

• Facility Information
• Monitoring Checklists
• Assessment Results
• Observations
• Corrective Actions
• Compliance Status
• Quality Indicators
• Inspection Reports
• Supervisory Notes
• Follow-up Activities
• Supporting Photographs
• GPS Coordinates (only during authorized monitoring activities)

Monitoring information is used exclusively for improving healthcare quality, operational performance, accountability, and organizational reporting.

8.5 Website Information

When you visit the official PPHI Balochistan website, certain technical information may be collected automatically to support website operation, security, and performance.

This information may include:

1. Internet Protocol (IP) Address
2. Browser Type and Version
3. Device Type
4. Operating System
5. Language Preferences
6. Referring Website
7. Pages Visited
8. Time and Date of Access
9. Duration of Visit
10. Downloaded Resources
11. Error Logs
12. Security Logs

Visitors may also voluntarily provide information through online forms, including:

1. Contact Forms
2. Recruitment Applications
3. Feedback Forms
4. Complaint Forms
5. Procurement Enquiries
6. Partnership Requests

Information submitted voluntarily is used only for responding to the relevant request.

8.6 ERP Self-Service Mobile Application

The ERP Self-Service Mobile Application is designed exclusively for authorized employees of PPHI Balochistan.

Depending on the features used, the application may process:

1. Employee Profile Information
2. Attendance Records
3. Leave Applications
4. Leave Balances
5. Salary Slips
6. Notifications
7. Organizational Circulars
8. Approval Requests
9. User Preferences
10. Login Activity

The application does not provide public access and requires authentication using credentials issued by PPHI Balochistan.

8.7 Executive ERP

The Executive ERP platform enables authorized managers to review organizational operations and approve official workflows.

Depending on assigned permissions, Executive ERP users may access:

1. HR Approvals
2. Financial Approvals
3. Procurement Workflows
4. Budget Reviews
5. Organizational Reports
6. Performance Dashboards
7. Administrative Requests
8. Management Analytics

Access is granted strictly according to organizational roles and responsibilities.

8.8 Sehat Dehleez

The Sehat Dehleez platform supports digital healthcare services and community engagement.

Depending on available services, information collected may include:

1. User Registration Information
2. Contact Details
3. Appointment Requests
4. Service Requests
5. Healthcare Enquiries
6. Health Education Interactions
7. Community Feedback

Only information necessary for providing the requested services is collected.

8.9 Information Collection Matrix

The following summarizes the primary categories of information collected across PPHI Balochistan digital platforms.

Information Category	HR Self-Service	Monitoring	Executive ERP	OPD / EMR
Employee Profile	✓	✓	✓	✓ (Staff Access)
CNIC	✓	—	—	—
Phone Number	✓	—	✓	—
Official Email	✓	—	✓	—
Attendance Records	✓	—	—	—
Payroll Information	✓	—	✓	—
Leave Records	✓	—	—	—
Monitoring Reports	—	✓	—	—
Facility Information	—	✓	—	—
Clinical Records	—	—	—	✓
Device Information	✓	✓	✓	✓
GPS Location*	✓	✓	—	—
Camera Access*	✓	✓	—	—

Notes:

1. GPS information is collected only when required to verify attendance or monitoring activities.
2. Attendance applications do not perform continuous background location tracking.
3. Camera access is requested only where operationally necessary, such as attendance verification or facility monitoring.
4. Clinical information is processed only within authorized healthcare systems.

Part 3 – Permissions, Security, Data Sharing, User Rights & Contact Information

9. Application Permissions

PPHI Balochistan requests only those device permissions that are necessary for the secure and effective operation of its digital services. Permissions are requested only when required by the functionality of a specific application and are not used for unrelated purposes.

The permissions requested vary according to the application being used.

9.1 Location Permission

Applications:

11. ERP Self-Service
12. PPHIB Monitoring Application

Location information is collected only when operationally required, including:

• Marking employee attendance
• Verifying attendance location
• Checking in at healthcare facilities
• Recording monitoring visits
• Submitting monitoring reports

Important Principles

• GPS is collected only at the time of the authorized action.
• Background location tracking is never
• Users remain in control of location permissions through their device settings.
• Location information is used solely for official organizational purposes.

9.2 Camera Permission

Applications:

• ERP Self-Service (Attendance)
• Monitoring Application

The camera may be used for:

• Attendance verification
• Liveness verification
• Capturing facility photographs
• Recording monitoring evidence

Attendance photographs are processed for identity verification. Where technically implemented, biometric comparison may be performed on the user’s device and only the verification result or required metadata is transmitted to PPHI Balochistan systems.

Camera access is activated only when the user performs an authorized action requiring photographic evidence.

9.3 Notification Permission

Authorized applications may request permission to deliver notifications relating to:

• Leave approvals
• Attendance updates
• Payroll notifications
• Approval workflows
• Organizational announcements
• Monitoring observations
• System alerts
• Service updates

Notifications are intended solely for official organizational communication.

9.4 Biometric Authentication

Where supported by the user’s device, applications may allow fingerprint or other operating-system-provided biometric authentication to protect access to sensitive information.

PPHI Balochistan does not receive or store users’ fingerprint templates. Biometric data is managed by the device operating system.

9.5 Bluetooth Permission

The ERP Self-Service application may use Bluetooth functionality to facilitate secure offline synchronization of attendance information between authorized application instances where internet connectivity is unavailable.

Bluetooth functionality is not used for location tracking or unrelated device discovery.

10. Device and Technical Information

To maintain security, performance, and operational integrity, applications may automatically collect technical information, including:

• Device Identifier
• Device Model
• Operating System
• Application Version
• Browser Type
• IP Address
• Network Type
• Session Information
• Date and Time of Access
• Error Logs
• Crash Reports
• Performance Diagnostics

This information assists in troubleshooting, maintaining service availability, detecting unauthorized activity, and improving application performance.

11. Device Integrity and Security Controls

To protect organizational resources and reduce fraudulent activity, certain applications may verify the integrity of the device on which they are running.

Where implemented, security controls may detect:

• Rooted devices
• Developer mode (where relevant)
• Mock or simulated GPS providers
• Unauthorized modifications affecting application security

These checks are used exclusively to protect organizational systems and preserve the integrity of attendance and operational records.

12. Cookies and Website Analytics

The official PPHI Balochistan website may use cookies and similar technologies to:

5. Improve website functionality
6. Remember user preferences
7. Enhance security
8. Measure website performance
9. Understand visitor interactions
10. Improve accessibility and user experience

Cookies are not used to sell personal information or to create commercial advertising profiles.

Users may configure their web browsers to refuse or delete cookies; however, some website functionality may be affected.

13. How We Use Information

Information collected through PPHI Balochistan digital services may be used to:

11. Deliver healthcare services
12. Maintain patient medical records
13. Administer employment
14. Process payroll
15. Manage attendance
16. Facilitate leave management
17. Support procurement and finance operations
18. Conduct facility monitoring
19. Produce organizational reports
20. Support public health programs
21. Improve healthcare quality
22. Maintain system security
23. Detect misuse or fraud
24. Meet legal and regulatory obligations
25. Respond to user enquiries
26. Improve digital services

PPHI Balochistan does not sell personal information and does not use collected information for commercial advertising.

14. Information Sharing

PPHI Balochistan treats personal and organizational information as confidential.

Information may be shared only when necessary:

27. With authorized PPHI Balochistan personnel performing official duties
28. With government authorities where required by law
29. With auditors or regulators acting within their legal authority
30. With approved technology service providers supporting PPHI systems
31. During emergency situations where disclosure is legally required to protect life, public safety, or critical organizational interests

Information is never sold or disclosed for commercial marketing purposes.

15. Data Security

PPHI Balochistan implements administrative, technical, and physical safeguards to protect information against unauthorized access, alteration, disclosure, or destruction.

Security measures include:

32. Encrypted communication using HTTPS/TLS
33. Secure authentication mechanisms
34. Role-Based Access Control (RBAC)
35. Strong password policies
36. Multi-factor authentication where applicable
37. Audit logging
38. Firewall protection
39. Malware protection
40. Regular system updates
41. Secure backups
42. Disaster recovery planning
43. Continuous security monitoring

Although reasonable safeguards are implemented, no electronic system can guarantee absolute security. PPHI Balochistan continually reviews and improves its security controls to address evolving threats.

16. Data Retention

Information is retained only for as long as necessary to fulfill legitimate organizational, healthcare, legal, regulatory, and operational requirements.

Retention periods may vary depending on the type of information, applicable laws, healthcare regulations, audit requirements, and organizational policies.

Where retention is no longer required, information will be securely archived, anonymized, or permanently deleted in accordance with approved record management procedures.

17. Your Rights

Subject to applicable laws and organizational requirements, individuals may have the right to:

44. Request access to personal information held by PPHI Balochistan
45. Request correction of inaccurate or incomplete information
46. Update personal contact details
47. Request deletion of information where legally permissible
48. Object to inappropriate processing
49. Report suspected misuse of personal information
50. Submit privacy-related complaints or enquiries

Certain employment, financial, healthcare, or statutory records may be retained despite deletion requests where required by law or organizational obligations.

18. Children’s Privacy

PPHI Balochistan digital services are intended primarily for employees, authorized healthcare professionals, patients, and organizational stakeholders.

Information relating to children may be processed only where necessary to provide healthcare services, maintain clinical records, or fulfill authorized public health functions.

Such information is handled with additional care and confidentiality.

19. Changes to this Privacy Policy

PPHI Balochistan may revise this Privacy Policy periodically to reflect:

51. Changes in legislation
52. Technological developments
53. Organizational requirements
54. Security improvements
55. New digital services

The revised version will be published on the official PPHI Balochistan website and will become effective from the stated revision date.

Where appropriate, users may be notified of significant changes through official communication channels or within applicable applications.

20. Contact Us

For questions, concerns, requests, or complaints relating to this Privacy Policy or the processing of personal information, please contact:

People’s Primary Healthcare Initiative (PPHI) Balochistan

Head Office
House No. 8-A, Jinnah Town, Samungli Road, Quetta, Balochistan, Pakistan

Email: contact@pphib.org
Email: pphib.care@pphib.org

Telephone: +92-81-2863620

Website: https://pphib.org

Privacy-related enquiries will be reviewed by the appropriate department, and reasonable efforts will be made to respond in a timely manner.

21. Policy Approval

This Privacy Policy is approved for implementation by the management of PPHI Balochistan and applies to all digital platforms, websites, enterprise systems, mobile applications, and future digital services operated by the organization.

All employees, contractors, consultants, healthcare professionals, and authorized users are expected to comply with this Privacy Policy as part of their responsibilities when accessing or using PPHI Balochistan information systems.