Privacy policy

What we collect

When your clinic applies for access, we collect your clinic name, HCSA licence number, contact email, and licence document, so we can verify you’re a real GP clinic before granting access. Payment is handled entirely by HitPay -- we never see or store your card details.

While you use GP MediList, we log activity against your clinic’s account -- the searches you run, items added to your basket, and order actions you take (copying a drafted message, opening an email/WhatsApp/portal link) -- along with a timestamp. This is usage data about your clinic’s account, not about any specific staff member.

Why we collect it

To run the service (verifying clinics, processing payment, keeping your basket in sync across devices), to see which features are actually useful so we can improve them, and to understand overall demand for particular medications so we can prioritise keeping the most-used parts of the price list accurate and up to date.

Sharing with suppliers

We may share aggregated demand insights -- for example, which medications or active ingredients are searched for or ordered most across GP MediList -- with our supplier partners, to help them understand what GP clinics are looking for. We do not share which clinic searched for or ordered what, or any clinic’s contact details, with a supplier without that clinic’s consent.

Where your data is stored

Your data is stored with Supabase, hosted in a Singapore data centre, and protected by row-level access controls so a clinic can only ever see its own account data. Only GP MediList admins can access data across clinics, and only for running the service.

Your rights

You can ask us what data we hold about your clinic, request a correction, or ask us to delete your account, at any time -- email gpmedilist@gmail.com and we’ll get back to you.