MedReach CRM

Privacy notice

Last updated: 24 September 2026

MedReach CRM is a field CRM for clinic and hospital visit teams. It is operated from Parañaque City, Philippines. Contact: [email protected]. Web app: medreachcrm.com. iOS and Android apps use bundle ID com.medreachcrm.app.

This notice is for people who sign in (reps, managers, admins) and for clinicians and workplace contacts stored in a company’s directory. It is a product notice under the Data Privacy Act of 2012 (Republic Act 10173), not legal advice.

What we collect

• Account. Name, work email, role, password hash, and the time you agreed to this notice. Sessions last 14 days.
• Company records. People, institutions, affiliations, optional PRC numbers, visit notes, products discussed, call plans, samples, events, inquiries, coaching notes, messages, and custom field labels for that company only.
• Recipient signature. A signature image on a completed call, stored with the visit.
• Sign-in location. When a recipient signs a completed call, the app requests the device’s location while you are using the app so we can tag the visit with a street address, coordinates, and time. If GPS is unavailable, the rep must pick a reason and the call is flagged for a manager. We do not track location in the background, and we do not collect location at login.
• Photos. An optional visit photo or calling card the rep attaches (camera or photo library).
• Detail aids. Presentation files a company uploads. Native apps cache a copy on the device so slides work offline.

Why we collect it

To run the CRM your company asked us to run: log calls, keep a directory, plan coverage, and let managers review unsigned GPS or other exceptions. Lawful bases: legitimate interest in operating that CRM, and consent (you agree to this notice before using the app).

Where it is stored

Field data for a signed-in company is stored on our Cloudflare account (Pages, Workers, and D1). Company records are not shared with other clients on the same app. On a phone or tablet, the app may keep a local copy of visits and presentation files so work continues offline; those copies stay on that device until the app is removed or the files are cleared.

To turn GPS coordinates into a street name, the app may send latitude and longitude to our reverse-geocode API (OpenStreetMap Nominatim) and, if needed, to Photon (Komoot) or BigDataCloud. We do not sell personal data. We do not scrape third-party clinician databases. We do not use advertising SDKs.

Permissions on iOS and Android

• Location (precise, while using the app) — only to tag a signed call. You can refuse; the rep then records a reason and a manager is flagged.
• Camera and photos — only if a rep attaches a visit photo or calling card.
• Network — to sign in, sync, and look up a street address.

Retention and your rights

We keep company records while the company uses MedReach CRM, and for a reasonable period after if needed for a dispute or a legal duty. You may request access or deletion of personal data at [email protected]. Admins can disable accounts. Uninstalling the app removes the on-device cache; it does not delete the company’s server records.

Children

MedReach CRM is for work use by adults. It is not directed at children.

Changes

If this notice changes in a material way, we will update the date above and the in-app copy at /privacy.

Back to MedReach CRM