Privacy Policy

1 Information We Collect

Information you provide directly

• Account data — name, email address, phone number, and password when you register.
• Doctor profile data — specialization, qualification, experience, medical registration number, city, availability, skills, and profile summary.
• Hospital profile data — hospital name, type, location, contact details, and description.
• Job postings — role title, specialization, location, job type, salary, and description.
• Applications — when you apply for a job, we record the application and its status.
• Communications — messages or enquiries you send us via the contact form or email.

Information collected automatically

• Browser type, device type, and operating system.
• IP address and approximate location.
• Pages visited, time spent, and referring URLs.
• Authentication tokens stored in your browser's local storage.

2 How We Use Your Information

• To create and manage your account.
• To display your doctor or hospital profile to relevant parties on the platform.
• To process job applications and notify relevant hospitals.
• To send transactional emails (account confirmation, application updates).
• To respond to your support requests and enquiries.
• To improve platform features and fix technical issues.
• To comply with applicable laws and regulations.

3 Sharing Your Data

We share your data only in the following limited circumstances:

• With hospitals (for doctors) — your profile is visible to registered hospitals when you set yourself as "Open to Work". Your contact details are only shared with your explicit consent.
• With doctors (for hospitals) — your hospital profile and job postings are publicly visible on the platform.
• Service providers — we use Supabase (database hosting) and Railway (server hosting). These providers process data on our behalf under strict data processing agreements.
• Legal requirements — if required by law, court order, or government authority.

4 Data Storage & Security

Your data is stored on servers hosted by Supabase (PostgreSQL database) and Railway (application server), both of which operate with industry-standard security practices including encryption at rest and in transit (TLS/SSL).

Passwords are hashed using BCrypt and are never stored in plain text. Authentication tokens expire after 24 hours.

While we take reasonable precautions, no system is completely secure. We encourage you to use a strong, unique password for your account.

5 Your Rights

You have the right to:

• Access — request a copy of the personal data we hold about you.
• Correction — update or correct inaccurate information via your dashboard.
• Deletion — delete your doctor profile directly from your dashboard. To delete your account entirely, contact us at md@medoralink.com.
• Portability — request your data in a structured, machine-readable format.
• Objection — object to certain types of processing where we rely on legitimate interests.

To exercise any of these rights, email us at md@medoralink.com. We will respond within 30 days.

6 Cookies & Local Storage

We use browser local storage (not cookies) to store your authentication token and session data. This is strictly necessary for the platform to function — no tracking or advertising cookies are used.

You can clear local storage at any time via your browser settings, which will log you out of the platform.

7 Children's Privacy

Medoralink is intended for healthcare professionals and institutions. We do not knowingly collect data from anyone under the age of 18. If you believe a minor has created an account, please contact us immediately.

8 Changes to This Policy

We may update this Privacy Policy from time to time. When we do, we will update the "Last updated" date at the top of this page. Continued use of the platform after changes constitutes acceptance of the updated policy.

9 Contact Us