Your data, protected.

Information you provide directly:

• Account information — name, email address, phone number, organization, and password when you register or sign in.
• Patient & clinical records — demographic details, medical history, prescriptions, lab results, vitals, billing and insurance information entered by you or by a healthcare facility using our platform.
• Communications — messages, support tickets, and contact form submissions.

Information collected automatically:

• Usage data — pages visited, features used, device and browser type, IP address, and diagnostic logs to operate and improve the platform.
• Cookies & similar technologies — to keep you signed in, remember preferences, and understand how the platform is used. You can control cookies through your browser settings.

We use the information we collect to:

• Provide, operate, and maintain the Medineps platform and its features.
• Process appointments, prescriptions, billing, and other healthcare workflows.
• Authenticate users and keep accounts secure.
• Respond to support requests and customer inquiries.
• Send service updates, security notices, and (with consent) product communications.
• Monitor usage, diagnose technical issues, and improve performance and reliability.
• Comply with legal obligations and enforce our Terms of Service.

We do not sell personal information. We never use patient health information for advertising or marketing purposes.

We share information only in limited circumstances and only as needed to operate the service:

• With your healthcare facility — data entered on behalf of a facility belongs to that facility, and authorized staff may access it through the platform.
• Service providers — trusted vendors who help us host, secure, and operate the platform (for example, cloud infrastructure and email delivery), bound by confidentiality obligations.
• Legal requirements — when disclosure is required by law, regulation, or enforceable government request, or to protect the rights, safety, and property of Medineps, our users, or the public.
• Business transfers — in connection with a merger, acquisition, or sale of assets, with notice to affected users where practicable.

We take the security of health information seriously and implement industry-standard safeguards, including:

• Encryption of data in transit (TLS) and at rest.
• Role-based access controls so users only see what they are authorized to see.
• Secure password storage and session management.
• Continuous monitoring, logging, and regular security reviews.
• Access restricted to personnel with a legitimate business need, under confidentiality obligations.

No method of transmission or storage is 100% secure, but we work hard to protect your data and will notify affected parties and regulators as required by law in the event of a breach.

We retain personal and health information only as long as necessary to provide the service and fulfill the purposes described in this policy, or as required by applicable law (for example, medical record retention requirements in Nepal).

When you or your facility request deletion, we remove or anonymize data unless we are legally required to keep it. Facilities should consult their own policies and legal obligations regarding patient record retention.

Depending on your jurisdiction, you may have the right to:

• Access the personal information we hold about you.
• Correct inaccurate or incomplete information.
• Delete your information, subject to legal retention obligations.
• Object to or restrict certain processing activities.
• Portability — receive your data in a structured, machine-readable format where feasible.
• Withdraw consent for communications at any time (for example, via the unsubscribe link in emails).

To exercise these rights, contact the facility that holds your records (for patient data) or email us at hello@medineps.com. We respond within a reasonable time and in accordance with applicable law.

The platform is intended for use by healthcare professionals and adult patients. We do not knowingly collect personal information from children without the involvement of a parent or guardian. If you believe a child has provided us personal information without consent, contact us and we will take steps to remove it.

Our infrastructure may be hosted in data centers outside Nepal. Where personal information is transferred across borders, we apply appropriate safeguards to maintain the same level of protection described in this policy.

We may update this Privacy Policy from time to time. When we make material changes, we will post the updated policy on this page with a revised “Last updated” date and, where appropriate, notify you by email or in-app notice. Continued use of the platform after changes take effect constitutes acceptance of the revised policy.