MedicRoute ("we", "us") helps health workers plan a move to work abroad. This includes nurses, midwives, doctors, pharmacists, medical laboratory scientists, physiotherapists, and healthcare assistants and support workers. This Privacy Policy explains what personal data we collect, why, who we share it with, how long we keep it, and your rights.
We aim to comply with the data protection laws that apply to our users, including the Nigeria Data Protection Act 2023, Kenya's Data Protection Act 2019, Ghana's Data Protection Act 2012, South Africa's Protection of Personal Information Act (POPIA), and the UK and EU General Data Protection Regulation (GDPR).
Contents
- Who we are
- What we collect
- Why we use it and our legal basis
- Who we share it with
- International transfers
- How long we keep it
- Security
- Your rights
- Cookies and device storage
- Children
- Changes to this policy
- Contact us
1. Who we are
MedicRoute is operated by Medic Path Africa (www.medicpathafrica.com), which is responsible (the "data controller") for the personal data described in this policy. Contact us about anything in this policy at medicroute.contact@gmail.com.
2. What we collect
| Type of data | Examples | Source |
|---|---|---|
| Account details | Name, email address, profile photo (if you sign in with Google) | You |
| Your plans and progress | Home country, profession you choose, destinations you look at, route and profession-guide steps you tick, cost estimates, practice scores, and your document checklist (statuses and expiry dates, including certificates such as BLS or ACLS you choose to track) | You |
| What you submit | Job posts, recruitment-agency applications (business contact and licence details), error reports, scam reports, contact messages | You |
| Payment records (only if paid plans are switched on) | Plan, amount, payment reference, status | You / payment partner |
| Technical data | Sign-in records and basic device and browser information needed to keep the service secure | Your device / Firebase |
We do not store copies of your certificates, passports or other documents. We never see card numbers, bank login details or PINs. We don't ask for your BVN or NIN.
Invites. If you join through a colleague's invite link, we record which account invited you. The person who invited you sees only a number, such as "2 colleagues have joined". They never see your name or email. Deleting your account deletes this record.
Your profession tells us which guides to show you. It is used only to tailor the app and is not shared with employers or anyone else.
No wallet or stored money. MedicRoute doesn't run a wallet, hold balances or take deposits, so we hold no financial account data about you. If we add payment features in the future, a licensed payment provider will process them. We'll update this policy before then to explain exactly what data is involved.
3. Why we use it and our legal basis
- To provide the Service: create and run your account and sync your plans across devices (contract / providing the service you asked for).
- To keep health workers safe: review job posts and recruitment agents, and investigate scam reports (legitimate interests).
- To respond to you: answer messages and privacy requests (contract / consent).
- To understand how MedicRoute is used: our administrators see totals, such as how many users chose each profession, home country or destination, and how many joined by invite. We may publish overall totals (for example "2,000 users from 9 countries") to advertisers, but never names, emails or anything that identifies you (legitimate interests).
- To protect and improve the Service: security, fraud prevention and fixing errors (legitimate interests).
- To meet legal obligations where required (legal obligation).
We never sell your personal data, and we don't share it with advertisers. Sponsored listings in the app are shown to everyone in a section. They are not targeted at you personally.
4. Who we share it with
- Google Firebase (Authentication, Firestore database and Hosting) stores and processes data on our behalf under Google's data processing terms.
- Payment partner, only if paid plans are enabled, to process your payment.
- Authorities, only where the law requires it.
Training providers, employers, recruiters, regulators and other websites linked from MedicRoute are independent. When you contact or apply to them, their own privacy policies apply.
5. International transfers
Firebase may store data in data centres outside your country (for example in the USA or the European Union). Google applies recognised safeguards, such as standard contractual clauses, for these transfers.
6. How long we keep it
- Account and plans: until you delete your account.
- Job posts, agency applications and scam reports: as long as needed to run the service and prevent fraud.
- Contact messages: up to 2 years.
- Payment records: as long as required for accounting and tax law.
7. Security
Data is encrypted in transit and at rest. Database security rules make sure that only you can read your saved plans. Only authorised administrators can review submissions, and administrator access requires a verified account.
No online service is completely secure. Please use a strong password and keep your login private. MedicRoute will never ask for your password, OTP or bank details by email, phone or WhatsApp. If you receive such a request, it isn't us, so please report it.
If a data breach is likely to put your rights at risk, we'll tell you and the relevant authority, such as the NDPC, as the law requires.
8. Your rights
Depending on where you live, you can:
- ask for a copy of your data;
- correct inaccurate data;
- delete your data (use Delete my account in the app for instant deletion);
- object to or restrict how we use it;
- withdraw consent at any time;
- ask for your data in a portable format.
Email medicroute.contact@gmail.com. We aim to respond within 30 days.
If you're unhappy with our response, you can complain to your data protection authority, for example the Nigeria Data Protection Commission (NDPC), Kenya's Office of the Data Protection Commissioner, Ghana's Data Protection Commission, South Africa's Information Regulator, or the UK Information Commissioner's Office (ICO).
9. Cookies and device storage
MedicRoute uses your browser's local storage and Firebase's sign-in storage to keep you logged in, remember preferences and work offline. We don't use advertising or tracking cookies.
10. Children
MedicRoute is for adults (18+). We don't knowingly collect data from children. If you believe a child has given us data, contact us and we'll delete it.
11. Changes to this policy
We may update this policy. We'll change the date at the top and, for important changes, tell you in the app.
12. Contact us
Email: medicroute.contact@gmail.com