Privacy policy

1. Who is responsible for your data

The data controller is the owner of the Medicore project, Farid Mammadov (Republic of Azerbaijan). Once the company is registered it will become the controller and we will update this document. For any question about your data: web.pro.farid@gmail.com.

We process data in line with the Law of the Republic of Azerbaijan "On Personal Data" and generally accepted data protection principles.

2. What we collect

Account: name, email address, phone number (if you add one) and interface language. If you sign in with Google or Apple, we receive only the name and email the provider allows us to see.

Using the service: appointments, reviews, messages with providers, attached photos and voice notes, family member profiles and visit history that you add yourself.

Technical data: IP address and browser or device details in server logs, and a push notification token in the app. We do not collect your precise location: the map shows places, not you.

For providers: staff, patients, appointments, medical documents, stock and till operations that the provider enters into its own workspace.

3. Why we use it

To run the service: finding providers, booking appointments, delivering messages, showing your history and sending reminders.

To keep the directory honest: moderating reviews and confirming a doctor's link to a clinic.

To keep things secure: protecting accounts, detecting abuse and logging access to medical records.

We do not sell personal data or use it for third-party advertising.

4. Who we share it with

The provider you book with or message: they see your name, contact details and what you send them.

Technical processors that store and process data on our behalf: Supabase (database and authentication), Vercel (hosting the website and service), Expo and Apple (push notification delivery), Google and Apple (if you sign in with them). Their servers may be located outside Azerbaijan.

Public authorities, only when legally required.

5. Medical data

Medical records are kept by the provider in its workspace. Access is limited by role: the clinic owner, front desk and cashier cannot see them. Every time a medical record is opened, it is written to an access log.

A signed medical document cannot be changed after the fact; it can only be amended.

6. How long we keep it

For as long as your account exists. When you delete your account, your personal data is deleted; anonymised records may remain in a provider's books where the law requires it.

Server logs are kept only as long as needed for security and troubleshooting.

7. Your rights

You can get a copy of your data, correct it, withdraw consent and delete your account. You can delete your account directly in the app: Profile - "Delete account".

For anything else, write to web.pro.farid@gmail.com. We reply within 30 days.

8. Children

The service is intended for adults. Children's details are added and managed by a parent or legal guardian in the "My family" section.

9. Changes to this policy

If this policy changes materially, we will say so on the website and in the app. The date of the last update is shown at the top of the page.