Privacy Policy

Effective date: 27 July 2026
Last updated: 27 July 2026

This Privacy Policy explains how the MedField mobile application (“MedField,” the “app,” “we,” “us,” or “our”) collects, uses, stores, and shares personal information.

Please read this policy before creating a MedField account or using the app.

1. Who operates MedField

MedField is developed and operated by Ali Abdulrazzaq, an independent software developer. For the purposes of applicable privacy laws, Ali Abdulrazzaq is responsible for deciding how and why the personal information described in this policy is processed.

Contact email: aliwathik932@gmail.com
Business address: Baghdad, Iraq

If ownership or operation of MedField is transferred to a registered company or another organisation, this section and the rest of this policy will be updated accordingly.

2. What MedField does

MedField is a professional scheduling application for doctors and medical representatives in Iraq.

Medical representatives can request appointments with doctors. Doctors can review, accept, reschedule, or decline those requests. Both parties can use the app to manage professional appointments and related information.

MedField:

• Is not intended for patients.
• Does not provide medical advice, diagnosis, treatment, or emergency services.
• Is not an electronic medical-record or patient-record system.
• Is not designed to collect or store patient health information.

Users must not enter or upload information that identifies a patient, including patient names, phone numbers, identification numbers, photographs, prescriptions, diagnoses, medical reports, test results, or treatment information.

3. Information we collect

3.1 Account information

When you create or use a MedField account, we collect:

• Your full name.
• Your phone number.
• Your account type: doctor or medical representative.
• Information about your account status.
• The date your account was created and updated.

3.2 Phone verification information

We use one-time passcodes to verify your phone number when you register, sign in, or perform certain security-sensitive actions.

This process may involve processing:

• Your phone number.
• The verification code.
• The date and time of the verification request.
• Delivery and verification status.
• Technical information needed to prevent misuse or repeated requests.

3.3 Professional profile information

The professional information collected depends on your account type.

For doctors, this may include:

• Medical specialty.
• Clinic name.
• Clinic location or work region.
• Other professional profile details you choose to provide.

For medical representatives, this may include:

• Employing company.
• Assigned work region.
• Other professional profile details you choose to provide.

Providing false or misleading professional information may result in account suspension or removal.

Phone verification confirms control of a phone number. It does not, by itself, confirm a medical licence, professional qualification, or employment relationship unless MedField separately performs such verification.

3.4 Profile picture

You may choose to upload a profile picture using your photo library, or system photo picker.

Uploading a profile picture is optional. If you upload one, the image is stored with your MedField profile and may be visible to other users as described in Section 6.

3.5 Appointment information

When you create, receive, or manage an appointment, we collect information such as:

• The participants in the appointment.
• Requested, proposed, or confirmed dates and times.
• Appointment status.
• Rescheduling and cancellation information.
• Notes added to the appointment.
• Appointment activity and status history.
• Ratings or feedback submitted after an appointment.
• Information needed to send reminders and updates.

Do not include patient-identifiable information in appointment notes.

3.6 Attachments

You may be able to attach documents or PDF files to an appointment request.

Attachments should contain only professional materials related to the appointment, such as product information, presentation materials, or visit documents.

Do not upload:

• Patient files or medical records.
• Prescriptions.
• Laboratory or imaging results.
• Patient photographs.
• Documents containing patient names or contact details.
• National identification documents belonging to patients.
• Any other confidential patient information.

Users are responsible for ensuring they have the right to upload and share each attachment.

3.7 Representative ratings

After a completed appointment, a doctor may submit a numerical rating for the medical representative involved in that appointment.

For each rating, MedField may collect:

• The rating score.
• The appointment connected to the rating.
• The doctor who submitted the rating.
• The representative who received the rating.
• The date and time the rating was submitted.
• Any written feedback, if this feature is available.

Ratings are used to calculate the representative’s average rating, help doctors evaluate representatives before accepting appointment requests, maintain service quality, and investigate possible misuse of the rating system.

Doctors may see a representative’s average rating and the number of ratings received. Individual ratings and the identity of the doctor who submitted each rating are not displayed to other users.

MedField administrators may access individual rating records when reasonably necessary to investigate abuse, manipulation, technical problems, or a complaint.

Users must not submit false, abusive, discriminatory, retaliatory, or misleading ratings. Ratings must relate only to the representative’s professional conduct during the relevant appointment.

3.8 Push-notification information

MedField uses Firebase Cloud Messaging to deliver appointment notifications and service updates.

For this purpose, MedField and its notification providers may process:

• A push-notification token.
• An application or device-installation identifier.
• The app’s package or bundle identifier.
• Notification delivery information.
• The content included in the notification.
• Technical information required to deliver the notification.

Where possible, MedField uses limited notification text and displays full appointment information only after you open the app.

On Apple devices, notifications may also be delivered through Apple Push Notification Service.

3.9 Technical and security information

When the app communicates with our servers, we may automatically record limited technical information, including:

• IP address.
• Date and time of the request.
• Requested server endpoint.
• Request status or error code.
• Authentication and security events.
• Information needed to detect misuse, fraud, spam, or unauthorised access.

This information is stored in server and security logs.

3.10 Support communications

When you contact us for support, report a problem, or make a privacy request, we collect the information you provide, such as:

• Your name.
• Your phone number or email address.
• Your message.
• Screenshots or files you send.
• Information needed to investigate and respond to your request.

You should remove patient information and unrelated sensitive information before sending support materials.

3.11 No advertising or third-party analytics

As of the effective date of this policy, MedField does not use:

• Advertising networks.
• Advertising identifiers.
• Google Analytics.
• Firebase Analytics.
• Firebase Crashlytics.
• Third-party behavioural-tracking tools.

We do not use personal information to create advertising profiles, and we do not track users across unrelated apps or websites.

If analytics, advertising, or crash-reporting tools are added in the future, this policy and the relevant app-store privacy disclosures will be updated before or when those tools are introduced.

4. How we use information

We use personal information to:

• Create and manage MedField accounts.
• Verify phone numbers and protect accounts.
• Create professional profiles.
• Connect medical representatives with doctors.
• Create, schedule, reschedule, cancel, and record appointments.
• Display relevant profile information to appointment participants.
• Deliver appointment notifications and reminders.
• Provide customer support.
• Investigate technical problems.
• Detect spam, fraudulent accounts, abuse, and unauthorised access.
• Enforce our terms, professional-use rules, and security requirements.
• Maintain the reliability and security of the app.
• Comply with legal obligations and lawful requests.
• Protect the rights, safety, and security of MedField, its users, and others.

We do not use information submitted to MedField to provide medical diagnoses, medical treatment, or patient care.

5. Legal grounds for processing

Where applicable law requires us to identify a legal ground for processing personal information, we may rely on:

• Providing the service: Processing necessary to create your account and provide MedField’s scheduling features.
• Legitimate interests: Protecting the app, preventing abuse, improving reliability, and operating a professional scheduling service.
• Consent: Processing optional information or device permissions where consent is required, such as an optional profile picture or notification permission.
• Legal obligations: Retaining or disclosing information where required by applicable law.
• Protection of rights and safety: Responding to security incidents, fraud, or threats to users and the service.

Where processing is based on consent, you may withdraw that consent. Withdrawal does not affect processing that occurred before consent was withdrawn.

6. Information visible to other users

MedField must display certain professional information to make appointment scheduling possible.

When a representative contacts a doctor

The doctor may see the representative’s:

• Full name.
• Profile picture.
• Employing company.
• Work region.
• Appointment request and proposed time.
• Notes and attachments included with the request.

When a doctor responds to a representative

The representative may see the doctor’s:

• Full name.
• Profile picture.
• Medical specialty.
• Clinic or professional details made available through the app.
• Accepted, proposed, or rescheduled appointment time.
• Appointment notes and attachments.

Appointment notes and attachments are visible to the users participating in that appointment and to authorised MedField personnel when access is reasonably necessary for support, security, moderation, or maintenance.

Your phone number is not displayed to other users unless:

• A feature clearly informs you that it will be shared; or
• You choose to include it in a note, attachment, profile field, or other content.

Do not use information obtained through MedField for unrelated marketing, harassment, unauthorised disclosure, or any purpose that violates applicable law or MedField’s rules.

7. Service providers and disclosures

We do not sell personal information. We do not share personal information with advertising networks or data brokers.

We use service providers that process limited information on our behalf to operate MedField.

Google Firebase Cloud Messaging

Google may receive:

• Push-notification tokens.
• Application or installation identifiers.
• IP addresses and technical service information.
• Notification content and delivery information.

This information is used to deliver and manage push notifications.

Apple Push Notification Service

For users on Apple devices, Apple may process:

• Device or application push tokens.
• Notification content.
• Technical delivery information.

This information is used to deliver push notifications to Apple devices.

OTPIQ

OTPIQ may receive:

• Your phone number.
• The one-time-passcode message.
• Delivery status.
• Technical request and delivery information.

This information is used to send and monitor phone-verification messages.

WhatsApp and Meta

When a verification message is delivered through WhatsApp, WhatsApp and Meta may process:

• Your phone number.
• The verification message.
• Message and delivery metadata.

Their handling of this information is also governed by their applicable terms and privacy policies.

Mobile-network operators

When an SMS fallback is used, relevant mobile-network operators and messaging providers may process:

• Your phone number.
• The verification message.
• Delivery information.

Hosting and storage providers

MedField’s application and database are hosted by:

Amazon web services
Hosting location or region: Europe

The hosting provider processes account, profile, appointment, attachment, log, and related application data as necessary to host and operate the service.

Attachments and profile pictures are stored by same hosting provider.
Storage location or region: Europe

Other disclosures

We may disclose information:

• When required by applicable law, a court order, or a lawful request from a competent authority.
• To investigate fraud, abuse, security incidents, or unauthorised access.
• To protect the rights and safety of users, MedField, or others.
• To professional advisers where reasonably necessary, subject to confidentiality obligations.
• As part of a merger, acquisition, restructuring, or transfer of MedField, provided the recipient continues to protect the information appropriately.

We do not disclose personal information to public authorities merely because it is requested. We assess whether the request is lawful and valid before responding, where legally permitted.

8. International processing

MedField is intended primarily for users in Iraq. Our hosting and service providers may process information in Europe, the United States, Iraq, and other countries in which they or their subprocessors operate.

This means your information may be transferred outside the country where you are located.

Where required by applicable law, we take reasonable measures to use providers that apply appropriate contractual, organisational, and technical safeguards to transferred information.

The privacy and data-protection laws of another country may differ from those of Iraq or your country of residence.

9. Data retention

We retain information only for as long as reasonably necessary for the purposes described in this policy.

Account and profile information

Account and professional-profile information is generally retained while your account remains active.

Appointment information

Appointment records are retained while your account is active so that users can access an accurate professional appointment history.

After an account is deleted, appointment records will be deleted

Attachments and profile pictures

Attachments and profile pictures are retained while they remain connected to an active account or appointment, unless they are removed earlier.

Deleted files may remain temporarily in backups until those backups are overwritten.

Security and server logs

Server, authentication, and security logs are retained for up to 90 days, unless a longer period is reasonably necessary to investigate a security incident, prevent abuse, or comply with law.

Support communications

Support requests may be retained for up to 12 months after the request is resolved, unless a longer period is required for an ongoing dispute, security investigation, or legal obligation.

Backups

Information may remain in encrypted or access-restricted backups for up to 30 days after it is removed from active systems.

Backups are used for disaster recovery and are not used for ordinary account activity.

Service-provider records

Some providers, such as messaging, hosting, or notification providers, may retain limited technical and transaction records according to their own retention requirements.

10. Account and data deletion

You may request deletion of your MedField account:

• By emailing aliwathik932@gmail.com

We may ask you to verify your phone number or account ownership before completing the request.

After verification, we will delete or anonymise your account information from active systems within 30 days, unless:

• The information must be retained by law.
• It is reasonably necessary to investigate fraud, abuse, or a security incident.
• It is needed to establish, exercise, or defend a legal claim.
• It forms part of a shared appointment record that must remain available to another participant.

we will remove or anonymise your identifying profile information where technically and legally possible.

Account deletion does not remove information that another user has already downloaded, copied, or stored outside MedField.

Some information may remain temporarily in backups until the backups are overwritten according to the retention period in Section 9.

Deleting the app from your device does not delete your MedField account.

11. Security

We use reasonable technical and organisational safeguards intended to protect personal information.

These measures include:

• Encrypting communication between the app and our servers using HTTPS.
• Restricting production access to authorised persons who require access for maintenance, security, account administration, or support.
• Using authentication controls to protect user accounts.
• Limiting administrative access using individual credentials.
• Expiring or renewing authentication credentials according to our security configuration.
• Using operating-system-protected storage for authentication credentials where supported by the device and implementation.
• Maintaining security and diagnostic logs.
• Applying software updates and security fixes where appropriate.

Users are responsible for maintaining control of their phone number and device and for preventing unauthorised access to their MedField account.

No internet-connected system can be guaranteed to be completely secure. You should contact us immediately if you believe your account or personal information has been accessed without authorisation.

12. Your rights and choices

Depending on the laws that apply to you, you may have the right to:

• Request access to personal information we hold about you.
• Request correction of inaccurate or incomplete information.
• Update profile information through the app.
• Request deletion of your account and personal information.
• Request a copy of certain information in a usable format.
• Object to or request restriction of certain processing.
• Withdraw consent where processing is based on consent.
• Make a complaint about how your information is handled.

You can update certain account and professional-profile details within the app. For other requests, contact us at aliwathik932@gmail.com

We aim to respond to verified privacy requests within 30 days. Additional time may be required where permitted by applicable law or where a request is complex.

We may ask for information needed to confirm your identity before providing access to, correcting, or deleting account information.

13. Notifications

You may allow or deny notification permission through your device settings.

Disabling notifications prevents appointment alerts from appearing on your device, but it does not prevent you from using the core scheduling features of MedField.

Important appointment changes may still be visible when you open the app.

14. Device permissions and access

MedField requests access only when needed for a feature you choose to use.

Notifications

Used to display appointment requests, responses, reminders, and schedule changes.

Notification permission is optional.

Photo library or system photo picker

Used only when you choose an existing image for your profile.

Depending on your device and operating system, MedField may use a system picker that allows you to select a specific image without granting access to your full photo library.

Document picker

Used when you choose to attach a document or PDF file to an appointment.

MedField should receive access only to the file you select, rather than unrestricted access to unrelated files, where supported by your device.

Denying an optional permission will prevent the related feature from working but will not prevent you from using unrelated parts of MedField.

15. Patient information and prohibited content

MedField is not authorised or designed to process patient health records.

You must not use MedField to collect, transmit, or store:

• Patient names.
• Patient phone numbers or addresses.
• Patient identification numbers.
• Patient photographs.
• Diagnoses or medical histories.
• Prescriptions.
• Laboratory, imaging, or test results.
• Treatment information.
• Medical-record numbers.
• Any information that could reasonably identify a patient.

If prohibited patient information is uploaded accidentally, remove it immediately and contact us.

We may remove prohibited content and may restrict or suspend accounts that repeatedly or intentionally upload patient information.

16. Children

MedField is a professional tool intended for licensed doctors and employed medical representatives.

It is not directed at anyone under 18, and we do not knowingly permit children to create accounts.

If you believe that a person under 18 has created an account or provided personal information, contact us so we can investigate and remove the information where appropriate.

17. Changes to this policy

We may update this Privacy Policy when MedField’s features, providers, or data-handling practices change.

The “Last updated” date at the top will show when the latest revision was published.

Where a change materially affects how personal information is collected, used, or shared, we will provide an appropriate notice through the app or another reasonable method. Where required by law, we will request consent before introducing the new processing.

We encourage users to review this policy periodically.

18. Contact us

For questions, privacy requests, complaints, or concerns about this policy, contact:

MedField Privacy Contact
Operator: Ali Abdulrazzaq
Email: aliwathik932@gmail.com
Address: baghdad, Iraq

Please include enough information for us to understand and respond to your request, but do not send patient health information or unrelated sensitive documents.