1. About this policy
Who is responsible for your data
Mazaya Medical Trading W.L.L. ("Mazaya", "we", "us" or "our") is responsible for the personal data described in this policy. This policy applies to our public website, our restricted team portal, the Mazaya ERP desktop application and related business communications.
We process personal data in accordance with applicable law, including Qatar Law No. 13 of 2016 concerning Personal Data Privacy Protection. The portal is a business operations system and is not intended to store patient medical records. Users must not upload patient records or other special-category medical data unless Mazaya has expressly approved a lawful and appropriately protected workflow.
2. Data we process
Information depends on how you interact with us
Public website visitors
- Technical request data that hosting and security providers may process, such as IP address, browser and device information, requested pages, timestamps, network events and error information.
- Your language preference, stored locally in your browser, and your healthcare-professional content confirmation, stored only for the browser session.
- Information you choose to send by email. Our website inquiry form opens your email application; it does not submit the form to a Mazaya website database.
- Information sent to a third-party platform when you choose to open an external social-media link or load an embedded YouTube video.
Portal and desktop users
- Account and identity data, including name, work email, role, department, account status, profile image, electronic signature and multi-factor authentication records.
- Employment and operational records, including leave requests, approvals, work activity, meetings, sales entries, opportunities, targets, KPI sign-offs, commissions and authorized penalty records.
- Customer, supplier and professional contact details entered for legitimate business purposes.
- Purchasing, tender, quotation, sales-order, delivery, inventory, logistics, finance and accounting records, including related documents, spreadsheets and generated reports.
- Audit, approval and security information, including actions taken, record history, authentication events, session activity and information used to prevent misuse.
- Technical performance information such as route, browser, device type, operating system, country, network speed and web performance measurements. Vercel Speed Insights reports these measurements without associating them with an identifiable visitor or IP address.
Where information comes from
We receive information directly from you, from authorized Mazaya administrators and colleagues, from customers or suppliers involved in a business process, from documents imported into the portal, and automatically from the systems used to provide and secure our services.
3. How we use data
Purposes of processing
We process personal data only for specified business, employment, contractual, security and legal purposes, including:
- Responding to inquiries and providing products, services, installation, training and support.
- Creating and securing accounts, confirming identity, enforcing role-based access and providing technical support.
- Managing employees, teams, leave, performance, targets, commissions and approved internal workflows.
- Operating sales, purchasing, tenders, finance, inventory, logistics and document-approval processes.
- Communicating with customers, suppliers, professional advisers and authorized recipients.
- Maintaining audit trails, preventing fraud or misuse, investigating incidents and protecting systems and users.
- Meeting legal, regulatory, accounting, audit, contractual and records-management obligations.
- Measuring and improving service reliability, accessibility and performance.
Where required, we rely on your consent. We may also process data to perform employment or contractual obligations, comply with law, and pursue legitimate and proportionate business or security interests. You may withdraw consent where processing depends on consent, although this does not affect earlier lawful processing.
The portal applies company-configured rules to calculate target progress, KPI allocation, commission estimates and penalty impact. These calculations support authorized human review and approval; they are not intended to replace required management decisions.
5. Retention and security
Keeping data only as long as needed
We retain personal data only for as long as reasonably necessary for the purpose for which it was collected and to satisfy applicable employment, commercial, accounting, audit, regulatory, dispute and security requirements. Closing an account does not automatically delete business records that Mazaya must lawfully preserve.
Retention decisions consider the type and sensitivity of the information, operational need, legal requirements, limitation periods, active disputes and the risk of keeping the data. When information is no longer required, we delete it, anonymize it or place it beyond normal use in accordance with our records-management process.
We use administrative and technical safeguards appropriate to the data, including encrypted connections, provider-managed encryption at rest, mandatory multi-factor authentication, role-based access, database row-level security, private file storage, session controls, audit records, input validation and monitoring. No internet-connected system can be guaranteed completely secure.
6. Your rights
Managing your personal data
Subject to applicable law, you may ask us to:
- Confirm whether we process your personal data and provide access to it.
- Correct or update inaccurate or incomplete personal data.
- Delete personal data where there is no lawful reason to retain it.
- Stop or object to particular processing where the law gives you that right.
- Withdraw consent where we rely on consent.
- Investigate and correct an improper disclosure or other privacy concern.
We may need to verify your identity and authority before acting on a request. Rights may be limited where retention or processing is required by law, necessary to protect another person, or needed for legal claims. You may also raise a complaint with Qatar's competent data protection authority, the National Cyber Security Agency's National Data Privacy Office.
7. Cookies and local storage
Technology used by our services
The public website uses browser local storage to remember your language preference and session storage to remember your healthcare-professional content response until you close the browser session. It does not use advertising cookies.
The portal uses essential cookies for secure authentication, account sessions, multi-factor authentication and the 30-minute inactivity control. Blocking these cookies will prevent the portal from working correctly.
An embedded YouTube video uses YouTube's privacy-enhanced domain and is loaded only when you choose to play it. YouTube may then receive technical information under its own privacy terms. Infrastructure providers may also use essential network and security mechanisms. If we add non-essential analytics, advertising or similar technologies later, we will update this policy and request consent where required.
8. Contact us
Privacy requests and questions
Send privacy requests with the subject line "Privacy Request" to mail@mazayamedical.net.
Mazaya Medical Trading W.L.L.Building 185, Street 250, Zone 44, D Ring Road
Doha, Qatar · P.O. Box 388
+974 4427 4468 · +974 4416 4639
We may update this policy when our systems, processing activities or legal obligations change. The current version and its effective date will remain available on this page, and material changes may also be communicated through the portal or by email where appropriate.