Skip to main content

Privacy Policy

Last updated: 9 October 2026

This policy explains what personal information MedLink collects, why we collect it, who we share it with, and the choices you have. It applies to this website, to physician public profiles and appointment-request forms hosted on it, and to the MedLink clinic management application used by physicians, clinic staff and their patients.

1. Who is responsible for your information

MedLink provides the software and operates this website. Who is responsible for a piece of information depends on what it is:

  • Information you give us directly (for example a message sent through Contact Admin, or an account you register on MedLink): MedLink is responsible for it.
  • Patient and appointment information held by a clinic (patient records, appointments, encounters, prescriptions, invoices, and appointment requests sent to a physician from their public profile): the physician or clinic that you are dealing with decides what is collected and how it is used. MedLink processes that information on the clinic's behalf, to provide the software. If you want to see, correct or delete your patient information, please contact your clinic first.

2. What we collect

If you visit this website

  • Technical information such as your IP address, browser type, the page you asked for and the time. This is recorded in security and error logs, and the logs also note which signed-in user performed an action in the application.
  • Website usage information, if we have switched on website analytics (see Cookies).

If you contact us

  • Contact Admin form: whether it is a request or a complaint, your name, email address, phone number, the subject and your message. We may reply by email and we send you a confirmation email.
  • Email, phone or WhatsApp: the details you share in those messages. If you open a WhatsApp link, your use of WhatsApp is governed by WhatsApp's own terms and privacy policy.

If you request an appointment from a physician's public profile

  • Your name, phone number, email address (optional), the clinic location, your preferred date and time, and your reason for visit. Please keep the reason brief and do not include highly sensitive information.
  • The request goes to that physician's practice, which decides whether to offer you an appointment. Submitting the form does not create an appointment or a medical record. To help the practice spot repeat submissions we also keep a reference number and a one-way fingerprint of the request.

If you register an account (physicians and clinic staff)

  • Your name, specialty, email address, phone number, username and password, and the name of your practice location. Your password is stored in a protected form, not as plain text.
  • Information about how the account is used, such as sign-in activity and a record of important actions (who did what, to which record, and when).

Information clinics keep in MedLink about patients

  • Identity and contact details, date of birth, sex, address, emergency contact, appointments, clinical notes and encounters, vital signs, prescriptions, billing and payments, and the other information a clinic chooses to record.
  • If a clinic invites you to the patient portal, we use your email address to send the invitation and to let you sign in and view your own information.
  • If you upload a medical report in the patient portal (a PDF or photo, with the title, type and any date, visit or note you add), it is stored privately and is visible only to you and to the physician and authorised clinical staff of the clinic you chose to send it to. Other clinics you are linked to cannot see it. If you remove a report from your portal it disappears from your view, but the clinic keeps its copy as part of its records. To ask the clinic about erasing a report, please contact the clinic.
  • If a physician uses speech-to-text to dictate a note, the recording is sent to OpenAI to be turned into text. MedLink does not keep the audio; it keeps the resulting text in the record and a usage log (the length of the recording, the language and the field it was for).

Subscription payments

  • Physicians pay for subscriptions through JazzCash. We keep a payment reference, the amount, the status and the confirmation details JazzCash returns. We do not receive or store your card number, mobile-wallet PIN or similar credentials.

3. How we use it

  • To run the website and the MedLink application, and to answer your messages and appointment requests.
  • To create and secure accounts, sign you in, send invitations, password-reset emails and confirmations.
  • To provide the features a clinic has chosen, such as scheduling, patient records, billing and speech-to-text.
  • To keep the service safe: preventing spam and abuse, investigating errors, and keeping an audit trail of important actions.
  • To understand how the website is used so we can improve it, if analytics is switched on.
  • To meet legal obligations and to protect our rights and those of our users.

We do not sell personal information, and we do not use it for advertising.

4. Cookies and similar technologies

A cookie is a small file that a website stores in your browser. This site uses:

  • Sign-in cookie (only if you sign in): keeps you signed in. It is marked secure and not readable by page scripts.
  • Form-protection and short-term message cookies: protect forms against forged submissions and carry a confirmation message to the next page.
  • Human-verification service: forms on this site may ask you to complete a verification (Cloudflare Turnstile, Google reCAPTCHA or hCaptcha, depending on how the site is set up) to block automated spam. The provider loads its own script and may set its own cookies or use your IP address and browser details for this purpose, under its own privacy policy.
  • Website analytics: we may use Google Analytics on the public pages to count visits and see which pages are useful. When it is switched on it sets cookies and sends usage information, including your IP address, to Google.
  • Browser storage: the patient portal may remember your light or dark display choice in your browser.

We do not use advertising or social-media tracking cookies. You can block or delete cookies in your browser settings; the sign-in cookie is needed to use your account, and some forms may not work without the form-protection cookie.

5. Who we share it with

We share personal information only as needed to run the service:

  • The clinic or physician you deal with. Appointment requests go to that practice, and patient information is visible to that practice's authorised staff only.
  • Service providers who process information for us: hosting and database providers; our email delivery service; the human-verification provider; OpenAI (speech-to-text, only when a physician uses it); JazzCash (subscription payments); and Google (analytics, if switched on). They may use the information only to provide their service to us.
  • Authorities and advisers where the law requires it, or to protect rights, safety or security.
  • A successor if MedLink's business is reorganised or transferred, subject to the same protections.

6. How long we keep it

We keep information for as long as it is needed for the purposes in this policy, then delete or anonymise it. In practice: support messages are kept while we deal with them and afterwards for our records; security and error logs are kept for troubleshooting and audit; account information is kept while the account is active; and each clinic decides how long to keep its patient records, taking into account the law and its professional duties. A medical report you upload becomes part of the clinic's record: removing it from your portal does not delete the clinic's copy.

7. How we protect it

  • Connections to the site are encrypted in transit.
  • Each clinic can see only its own data, and users see only what their role allows.
  • Passwords and stored credentials are protected, and sessions end after sign-out.
  • Important actions and errors are logged so that misuse can be found and investigated.

No online service is completely secure. Please choose a strong password, do not share it, and tell us straight away if you think your account has been misused.

8. Your choices and rights

You can ask us to:

  • tell you what personal information we hold about you and give you a copy;
  • correct information that is wrong or out of date;
  • delete your information, or restrict how we use it, where we are not required to keep it;
  • stop sending you emails that are not essential to the service.

For patient records, please make the request to your clinic, which is responsible for them; we will help the clinic respond. We may need to confirm who you are before acting on a request, and we will reply within a reasonable time.

9. Children

This website is not directed at children. Records about a child are created and managed by the child's clinic and parent or guardian, not by the child.

10. Where information is processed

Some of our service providers, including OpenAI, Cloudflare, Google and our email and hosting providers, may process information outside Pakistan. We choose providers carefully and share only what is needed for the service they provide.

11. Changes to this policy

We may update this policy as the service changes. The date at the top shows when it was last updated; if a change is significant we will make it clear on this website.

12. Contact us

Questions about this policy, or a request about your information: