1. Who we are

mednance is operated by Core Glows Establishment (مؤسسة كور غلوز), Commercial Registration 7050103741, Al Narjis, Riyadh, Kingdom of Saudi Arabia ("we"). For any question about your data, write to support@mednance.com.

mednance is a listing service: healthcare facilities post maintenance requests for medical equipment, and medical-equipment experts find them. We are not a party to any job, and no money passes through us between a facility and an expert.

2. What we collect

From everyone who signs in: your mobile number and email address, each verified with a one-time code; your account type (facility or expert) and your language.

From facilities: facility type, region, city and district; the facility name and the contact person's name. For each request: the service type, device, brand and model, a description of the fault, the city, and up to three photos.

From experts: a public nickname and your real name; your home region and city; the regions you cover; the services, devices, brands and models you work on; a short bio.

Your real-name field is private and is not displayed to other users. Authorised operators may access it to administer the service.

Records the service keeps as you use it: your requests and their history; each unlock (who unlocked which request, when, and the contact details shared); the count of unlocks and of facilities an expert has contacted; ratings, verification status and account restrictions where they apply.

Our authorised operator reviews verification and moderation decisions. We record the affected account or request, the action, its reason, the operator and the time, and any evidence reference used. These records are not public. We also record the version of the terms you accepted and when you accepted it.

Automatically: to stop abuse we use your IP address, phone and email in scrambled (hashed) form in short-lived counters. Our hosting provider also receives technical information such as your IP address and browser details, and a security check runs when you use the site to confirm requests come from the real website.

Do not include patient information in requests, descriptions or photos. If you submit it accidentally, contact support so we can remove it.

The phone number, verified email and required account fields are needed to create and operate an account. Photos and the expert bio are optional. Without required information we cannot complete the relevant service.

3. Why we use it

To sign you in and protect your account; to show requests to experts and connect a facility and an expert when an expert unlocks a request; to prevent abuse, fraud and spam; to run and improve the service and meet our legal obligations.

4. Who can see what

• Anyone, without signing in: open requests — service type, device type, brand, region, city and time left; and expert cards — nickname, regions covered, device types and brands, verification badge and number of unlocks. A request never shows who posted it.
• Information described as public can be viewed and copied by anyone, including outside Saudi Arabia. Search engines may index pages we make available for indexing.
• Signed-in experts: an open request's model and fault description as well.
• Signed-in users: an expert's full profile, including bio and models.
• After an expert unlocks a request: the expert sees the facility's contact person name, the facility account's phone number, city, district, facility type and the request photos. The facility sees the expert's nickname, phone number, city, services, and rating and verification badge as they were at the unlock.
• Contact details are available for up to 14 days after unlocking. If we take down a request, both parties lose access. Suspending an expert blocks that expert's access to facility contacts.
• If you tap the WhatsApp button on unlocked contact details, WhatsApp receives the number you are contacting.
• We do not publish the facility-name, account-email or expert real-name fields. Do not put identifying information in descriptions, profiles or photos.

5. Service providers we use

• Our database is in Saudi Arabia. Our servers in Qatar process the account, request and contact data needed to run the service. Our sign-in provider processes sign-in identifiers and technical data in the United States; our security services may process technical data in other countries.
• Our SMS provider sends verification codes and receives your number and the code. For some international numbers, codes are sent by WhatsApp, which processes them outside Saudi Arabia. Our email provider sends codes and account notices from Ireland; it receives your email address and the message and stores email data in the United States. Support emails are handled by our email service provider and may be processed outside Saudi Arabia.

We do not sell your data, and we use no advertising or analytics trackers.

6. How long we keep it

• Verification codes expire after 5 minutes (SMS) or 10 minutes (email) and are then deleted automatically; anti-abuse counters expire after 1–2 days. Automatic deletion can take somewhat longer.
• Requests leave the public list when they expire (72 hours). The request, its photos and its history stay in your account.
• Contact details are available for up to 14 days after unlocking. If we take down a request, both parties lose access. Suspending an expert blocks that expert's access to facility contacts.
• We keep your account, requests and unlock records while your account is open. If you ask us to delete your account, we delete or anonymise them within 30 days, unless the law requires us to keep them. Unfinished sign-ups are deleted within 30 days. Records of verification and moderation decisions are kept for 2 years. Backup copies may remain for up to seven days after deletion. Delivery providers keep their own records; our email provider keeps email records for 30 days.

7. Your rights

Email support@mednance.com to request access, a copy, correction, deletion or withdrawal of consent. If you cannot use your linked email, contact us to arrange another identity check. We act within 30 days. If an allowed extension is needed, we explain it before that deadline; it will not exceed another 30 days. Withdrawing consent closes your account; we then delete your data as described in section 6. You can also complain to the Saudi Data & AI Authority (SDAIA).

In your account you can already change your recovery email, and experts can edit their bio, services, devices and regions.

8. Cookies and browser storage

We set one cookie, kept for one year, that remembers your language. The site also keeps sign-in information, a short list of recent code requests and a sign-in step marker in your browser's storage so it works and limits repeated requests. Our sign-in and security tools store tokens and technical records in your browser and may set their own cookies. We use no advertising or analytics cookies.

9. Security

The site is served only over encrypted connections (HTTPS). Verification codes are stored in our database only in scrambled (hashed) form; the providers that deliver them receive the code itself. Database access rules keep private data (email, real names, facility name) away from the public and other users, and share phone numbers and contact names only after an unlock as described in section 4.

10. Age

mednance is for healthcare facilities and professionals. You must be 18 or older to use it.

11. Changes

We publish the updated terms and privacy policy here and update the date above. When a new approved version takes effect, we ask you to accept it again before posting, unlocking or closing requests.