Last updated: August 11, 2026
MediTrack is a clinic management system that handles sensitive personal and health information. This policy explains what data we collect, why we collect it, how it is protected, and the rights you have over your information.
MediTrack collects the information needed to manage your clinic care, including your name, date of birth, gender, contact details (phone, email, address), blood group, allergies, and emergency contact.
For system users (doctors, receptionists, administrators), we also store your name, email, role, and an authentication password hash. Audit logs record actions you perform, the record affected, and the IP address of the request.
Your information is used exclusively for clinic operations: scheduling appointments, recording consultations, issuing prescriptions, coordinating care between staff, and maintaining an accurate medical history.
We do not sell or rent your personal data to third parties.
Medical records (visits, diagnoses, vitals, prescriptions) are retained as part of your permanent history for clinical and legal continuity.
When a patient record is removed from active use, it is soft-deleted — a deletion timestamp is recorded but the underlying clinical data is preserved for historical and auditing purposes. Records are never hard-deleted through the application.
Access to your data is governed by role-based permissions. Only authenticated users with an authorized role can reach protected areas, and each role sees only the information relevant to their responsibilities.
Patients can view only their own records. Doctors can access records for appointments assigned to them. Access to sensitive actions is recorded in the audit trail.
Passwords are never stored in plain text — they are hashed before storage. Sessions are maintained through signed JWT tokens. Database-level constraints prevent duplicate or invalid records.
Despite these measures, no system can be guaranteed perfectly secure. Access is logged to support accountability.
You may request access to the personal information we hold about you, ask for corrections to inaccurate data, or raise a concern about how your information is handled.
To exercise these rights, contact your clinic administrator.
This policy may be updated as the system evolves. Material changes will be reflected on this page with an updated effective date.
Questions about your privacy or this policy?
Contact your clinic administrator.