1. The service and your clinic
MediFollow360 supports clinic administration, appointments, follow-up communications and clinical records. The doctor app is for healthcare staff whose accounts and access are provided by their clinic. The separate patient portal provides clinic-authorized access to patient-facing records.
Your healthcare organization decides how it uses the service for your care, which staff are authorized, and which clinical records it must maintain. This notice describes the service. Your clinic may also provide its own privacy notice. Contact your clinic for questions about treatment or the content of a medical record, and contact info@medifollow360.com for service privacy questions.
2. Information processed
- Accounts and access: staff or portal identity, name, email address, clinic and role, linked doctor or patient, language preference, authentication credentials and account status. Passwords are verified using stored password hashes; mobile authentication uses device credentials.
- Clinic and patient records: patient identifiers and contact details, appointments, schedules, care-team relationships, follow-up answers and communications, and payment or billing records where the clinic uses those modules.
- Clinical information: history, allergies, encounters, diagnoses, observations, medication and investigation records, results, clinician notes, issued documents, and the PDF or image evidence an authorized user selects and uploads. These may contain sensitive health information and other people’s personal information.
- Device and operational information: an app installation identifier, device label and platform, app version, language, device activity and revocation status, optional push registration token, Inbox recipient/read/delivery records, and security or audit events. Network requests necessarily expose technical connection information, including an IP address, to the service and its infrastructure.
- Website and support: essential session and security cookies, language preferences, and information you choose to provide in a signup or support inquiry. The public website loads fonts from Google; those requests expose connection information to Google. The doctor app bundles its fonts locally.
3. Why information is used
Information is used to authenticate people, enforce clinic permissions, deliver requested clinic and clinical workflows, maintain accurate history, communicate clinic updates, provide support, prevent abuse, and support backup and recovery. Patient data is not used by the doctor app for advertising or cross-app tracking.
Clinical actions and corrections can retain the responsible user, time, source and earlier versions. This supports accountability and continuity of care; changing a current value does not necessarily erase its clinical history.
4. Access, service providers and communications
Clinic users see information within their current organization, role and clinical permissions. Authorized service operations and infrastructure providers may process information needed to host, maintain, secure, back up or deliver the service. A clinic may make permitted reports or exports available to authorized recipients; those copies are then subject to the recipient’s handling.
When optional device notifications are enabled, Google Firebase Cloud Messaging processes installation and registration identifiers and technical delivery information. On Apple devices, Apple Push Notification service also participates in delivery. Push messages use a generic clinic alert and an opaque notification identifier, rather than patient names or clinical content. The app retrieves the actual Inbox content through authenticated access. Provider acceptance does not prove that a person saw a notification.
Where a clinic enables WhatsApp follow-up, patient contact details, message content and delivery or response information are processed through its configured WhatsApp service. The doctor Inbox and its device alerts are separate from WhatsApp.
An optional web administration tool can send an administrator’s general business description and reusable communication-template content to OpenAI to help draft a content pack. It is not a doctor-app clinical feature. Administrators must not put patient information into that tool.
Information may also be disclosed when necessary to comply with applicable legal obligations or protect the security and lawful operation of the service. Providers can process information in countries outside your own. Ask the service contact or your clinic for the applicable hosting and provider arrangements before supplying data subject to location restrictions.
5. Device permissions and local storage
The doctor app uses the device’s protected credential storage for its session credentials, installation identifier and preferences. Clinical file previews are held in memory for the current authorized session. Selecting an upload may create a temporary copy through the system file picker; the app requests cleanup of picker temporary files after reading it. The source file you selected remains under your control.
File or photo access is used when you choose clinical evidence to upload. Device notifications are optional and may be disabled in the app or operating-system settings. Disabling alerts does not remove your clinic Inbox or prevent ordinary use of the app. Notifications are not a reliable channel for urgent care.
Use a protected device and keep its operating system current. Signing out closes local clinical access and requests server revocation. Revoking a device or removing the app does not delete clinic records.
6. Protecting information
The service uses access controls, authenticated private clinical file access, credential expiry and revocation, audit history, and encrypted network transport. Push registration tokens are encrypted in application storage. Access is checked against current clinic and clinical authority; a device credential alone does not grant access to all clinic records.
No system can guarantee absolute security. Do not send passwords, access tokens, patient documents or detailed medical information in an ordinary support email. Report suspected unauthorized access promptly to your clinic and the service contact.
7. Retention and deletion
Account and operational information is kept for as long as needed to provide the service, maintain security and resolve applicable legal or contractual obligations. Credentials and push registrations have separate validity and revocation rules; expiration limits access and is not a promise that every historical record is immediately erased.
Clinical records, issued documents, amendments, appointment history and audit evidence may need to be retained by the clinic for continuity of care, accountability or legal duties. Backups may retain protected copies until the applicable backup rotation. The applicable retention period depends on the clinic, record type and legal obligations; contact your clinic or the service contact for the schedule that applies to your information.
You can request access, correction, a copy, account removal or deletion of personal information using the support page. We may need to verify your identity and authority and coordinate with the clinic. Where information must be retained, the response should explain the reason and the applicable retention arrangements. An account deletion request is different from temporary deactivation, signing out, device revocation or uninstalling the app.
8. Your choices and questions
You can change supported language and appearance preferences, manage device notifications and revoke your sessions or registered devices. Contact your clinic about patient contact preferences, clinical corrections and access to your record. The rights available to you depend on the applicable law; requests can be directed to info@medifollow360.com even if you no longer have app access.
The doctor app is intended for authorized healthcare staff. Clinics may hold records about children as part of their care and are responsible for the authority and safeguards required for those records. The app is not a service for children to create doctor accounts.
This notice may be updated when the service or its data practices change. The date above identifies the current notice. Questions about this notice or a privacy concern can be sent to the service contact below.