Your privacy at a glance
- Each center’s data is fully isolated from every other.
- The MADAD team can’t see patients, visits, invoices or reports.
- We never sell data, and never share patient data with advertisers or anyone else.
- No advertising trackers and no third-party scripts.
- The manager can export all the center’s data at any time.
Scope of this policy
This policy explains how MADAD processes the personal data of website visitors and Platform users — center managers, doctors, reception staff and advertisers — and the data that centers record about their patients. It forms part of the Terms and Conditions and complies with Jordan’s Personal Data Protection Law No. 24 of 2023.
Who is responsible for the data?
- The center is responsible for its patients’ data, visits, documentation and invoices, and decides what is recorded and who can see it within the center.
- MADAD processes this data on the center’s behalf and solely to provide the service, with no other use.
- MADAD is directly responsible for user account, subscription, advertiser and website visitor data.
The data we collect
- Center details: name, logo, clinic types, governorate, city, address and phone.
- User details: name, email, phone, username and password (hashed), role and permissions, and sign-in history.
- Patient data recorded by the center: administrative details, the medical record, visits and documentation including voice notes and files, invoices and insurance.
- Subscription data: plan, dates and uploaded payment receipts.
- Advertiser data: company details, contact person and ads.
- Whatever you send us through the contact form or WhatsApp.
How we use data
- To run the Platform and provide its services to the center and its users.
- To manage subscriptions, review payments and contact you about renewal.
- To protect accounts and prevent unauthorized use.
- To answer your questions and support requests.
- Aggregated statistics that identify no one, such as the number of centers per governorate, to improve the service.
We never use patient data for marketing, advertising or training any models, and we never sell any data to anyone.
Privacy within the center
- Each patient’s medical record is shared within the center, and the center’s doctors and manager can see it for continuity of care.
- Reception staff never see any medical content — only administrative details.
- Every opening of a patient’s record is logged with who and when, and the manager can review this log.
- The manager sets each user’s permissions precisely.
What the MADAD team can’t see
The MADAD team’s work is limited to managing subscriptions and the Platform, reviewing public community content (Bazaar listings, forum posts, ads and doctors directory details) and reviewing doctor verification requests (name, license number and center only). It cannot see any center’s patients, appointments, visits, documentation, patient invoices, doctor commissions or reports, and the Platform has no way to sign in as a center. All the team sees of a center’s internal data is its subscription details and usage counters as numbers (doctors, patients and storage used).
Voice notes and files
Voice notes are recorded and stored on MADAD’s servers only, and are never sent to any external service for transcription or analysis. Voice notes and attached files are treated exactly like the medical record in terms of permissions and protection.
Sharing data
- We share patient data with no one, advertisers included.
- Advertisers receive no data about clinics or their users either; any contact with an advertiser happens directly, at the clinic’s own initiative.
- We may disclose data if required by law or a court order, and only to the minimum extent necessary.
- We use hosting and infrastructure providers bound to protect the data, who may not use it for any other purpose.
Public data: directory and community
- The the doctors directory shows a doctor’s photo, name, specialty, clinic, governorate and personal phone number, and the doctor or the center manager can turn this off at any time.
- In the doctors’ forum, the author’s name and specialty are shown to forum members only; in the Doctors’ Bazaar — Buy & Sell, the contact details the seller provides are shown.
Data security
- Encrypted connections (HTTPS) on every page, and passwords stored with one-way hashing.
- Each center’s data isolated at the database level, with permissions checked on every request.
- Regular backups, and logs of sensitive operations.
- No third-party scripts and no advertising trackers on the Platform.
Cookies and local storage
We use only essential cookies for signing in and keeping your session secure, and we store your language and theme preferences in your browser. We don’t use advertising or third-party analytics cookies.
Retention
Free trial: if the trial ends and the center doesn’t subscribe within seven days, all data and files entered during it are deleted automatically and permanently.
A center’s data is not deleted when its subscription ends, and the manager can export all of it even while the account is locked. When an account is closed permanently at the center’s request, we keep the data for the period the law requires for medical records, then delete it securely.
Your rights
Under the law you may access your personal data, correct it, request its deletion where the law allows, and object to its processing. Because the center is responsible for its patients’ data, patients should direct requests to the center itself, and we help the center fulfil them.
Children’s data
Centers may record data about minors, such as pediatric patients; this data receives the same protection, and any related contact is with the patient’s guardian.
Changes to this policy
We may update this policy; every update carries a new version number and date at the top of this page, and we notify center managers of material changes within the Platform before they take effect.
Contact
For any question or request about privacy, contact us or email us at hello@madad.jo.