Privacy Policy

1. Who we are and who does what

• We provide MedWorks to clinics and medical centres. For the data of the clinics' accounts and their users, we are responsible for it.
• For the patients' data a clinic enters in the system, the clinic is responsible for it; we process it on the clinic's behalf and only on its instructions, to provide the service. A patient who wants to see or change their data should contact their clinic.

2. The data we collect

• Account data: name, e-mail, phone number and password (stored hashed, so it cannot be read back).
• Clinic data: its name, address, doctors, services, hours, prices and settings.
• Patients' data entered by the clinic: appointments, medical records, prescriptions, tests, invoices and attached files, and the bookings patients make on the clinic's website.
• Technical data: IP address, browser, sign-in and usage logs, to protect accounts and run the service.
• Cookies needed for signing in and the language, and measurement tools only after you agree. Details on the cookie preferences page.
• Payments go through approved payment gateways; we do not store card numbers.

3. How we use the data

• To provide and run the service: bookings, records, invoices, reports, and the reminders a clinic sends its patients by WhatsApp, SMS or e-mail.
• To protect accounts and prevent misuse, for support, and for billing.
• To send messages about the account and the service. Promotional e-mails always carry an unsubscribe link.
• We do not sell data, and we never use patients' data for advertising.

4. Google user data

• Sign in with Google: we use your name, e-mail and picture (openid, email, profile) only to identify you and sign you in.
• Sending from a clinic's Gmail: if a clinic connects its mailbox, we use the send-only permission (gmail.send) to send the messages the clinic writes or the system sends on its behalf, such as reminders, prescriptions and invoices. We do not read the mailbox, access its contents or store them.
• Google Drive and Google Sheets: if a clinic turns on the export to Google Sheets, we use the drive.file permission only, so the system can reach only the files it creates and no other file in your account.
• MedWorks's use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.
• We do not sell Google user data or transfer it to anyone, we do not use it for advertising or to train AI models, and no one on our team reads it except with your consent, for security reasons, or when the law requires it.
• You can disconnect at any time in the clinic's settings, or from your Google account's permissions page: myaccount.google.com/permissions

5. Who we share data with

• Service providers we rely on to run the system (hosting, e-mail, SMS and WhatsApp, payments), under agreements that bind them to protect it and use it only for that purpose.
• When the law or a competent authority requires it.
• At the clinic's request or with its consent, such as transferring a patient's file to another provider.

6. How we protect data

• Connections are encrypted (HTTPS), passwords and connection keys are stored encrypted, the clinic owner sets each staff member's permissions, every sensitive action is written to an audit log, and we take regular backups.
• No method of protection on the internet is perfect, but we keep working to reduce the risks, and we tell the affected clinics if a breach touches their data.

7. How long we keep data

We keep data while the clinic's account is open. After the account is closed, the clinic can export its data; it is then deleted within 90 days, except what the law obliges us to keep, and it leaves the backups as they rotate.

8. Your rights

• You can ask to see, correct or delete your data or to get a copy of it, and object to promotional e-mails at any time.
• Patients contact their clinic directly, and we help the clinic carry out the request.

9. Children

The service is meant for clinics, not for children. Minors' data is entered by the clinic, which is responsible for the guardian's consent.

10. Changes to this policy

We may update this policy; the new date is shown at the top of the page, and clinics are told by e-mail of any significant change.