Privacy Policy

Who this policy covers

Med Assist (“we”, “us”) operates a practice-management platform for doctors in Bangladesh, at prescribe.med.com.bd. This policy explains what we collect from doctors, their assistants, and the patients whose records a doctor keeps on the platform, and what we do with it.

What we collect

From a doctor or assistant creating an account, we collect:

• Name, email address, and phone number
• Password (stored hashed, never in plain text) or Google account information if you sign in with Google
• BM&DC registration number, and, if you apply for verification, your registration certificate, a selfie, and both sides of your NID
• Chamber (practice location) details, such as address and hours

From patient records a doctor or assistant creates, we store:

• Patient name and phone number
• Prescription content: chief complaint, examination notes, diagnosis, medicines, tests, and advice
• Appointment and queue records

Patients do not create their own accounts. A doctor or their assistant enters this information; we process it on the doctor’s behalf, as their data processor.

How a prescription link works

Every prescription gets a shareable link (a public URL containing a unique code) that opens without a login, so a patient can view it from the SMS we send them. Anyone with that exact link can view the prescription; it is not further protected by a password. Treat the link the way you would treat a paper copy, and share it only with the patient it belongs to.

Payments and SMS

Subscription and SMS-credit payments are processed by bKash. We store the resulting transaction record (amount, status, a reference ID) but never your bKash PIN or full account details. Prescription links and account notifications are sent through a Bangladeshi bulk SMS gateway and, for account and security emails, our email provider, both of which receive only the phone number or email address needed to deliver that one message.

Where data is stored

Records live in our database, and uploaded files (verification documents, report uploads) are stored on Amazon S3. We do not sell any of this data, and we do not share patient records with anyone outside your own chamber staff and the assistants you’ve granted access to.

How long we keep it

We keep account and patient data for as long as your account is active. If a subscription lapses, existing data is preserved: reads are never blocked and nothing is automatically deleted, so that resubscribing restores full access. You can request deletion of your account and associated data by contacting us; we’ll confirm what can be deleted immediately and what we’re required to retain, such as payment records, for tax and dispute purposes.

Your account’s security

Sessions use short-lived access tokens and revocable refresh tokens. You’ll get an in-app alert and an email whenever your account is signed into from a new device. Two-factor authentication (email OTP or an authenticator app) is available as an optional extra step at login.

Children

Med Assist is built for doctors and clinic staff, not for direct use by children. Patient records may include minors, but only as entered by a doctor or assistant treating them, not through self-registration.

Changes to this policy

If this policy changes in a way that affects how your data is used, we’ll say so on this page with an updated date at the top.

Contact

For privacy questions or a data-deletion request, reach us on WhatsApp or at support@med.com.bd.