Vendor & Third-Party Risk Management Policy

1. Purpose and scope

DocGini relies on outside companies for some parts of the service. This Vendor & Third-Party Risk Management Policy ("Policy") explains how MEDCONS chooses, contracts and oversees them, so that your information stays protected and the service stays reliable. It applies to every third party that stores, processes or can access DocGini data, or whose failure would affect the service. It supports Section 19 of our Terms of Service.

2. The kinds of vendors we use

• Hosting and infrastructure: the servers, storage and networks that run DocGini.
• Messaging: email delivery and licensed SMS gateway providers.
• Payments: banks, payment processors and mobile wallets, where online payment is offered.
• Identity verification: official or licensed services used to check identity or professional registration.
• Software and support tools: services we use to build, monitor and support DocGini.

3. Before we choose a vendor

We assess each vendor in proportion to the risk it brings. The more sensitive the data, or the more the service depends on it, the closer we look. We consider:

• whether we need to share personal or health data at all, and the minimum we can share;
• the vendor's security practices, certifications and track record;
• where the data will be stored and processed;
• their reliability, support and ability to recover from failure;
• their licences and legal standing in Pakistan, where relevant;
• their financial stability and any conflicts of interest.

4. What we require in contracts

Vendors that handle DocGini data must agree in writing to:

• use the data only to provide their service to us, and never sell it or use it for their own purposes;
• keep it confidential and protect it with appropriate security;
• limit access to their staff who need it;
• tell us promptly about any security incident affecting our data;
• use sub-contractors only with safeguards at least as strong as their own;
• return or delete our data when the contract ends;
• comply with Pakistani law and cooperate with lawful requests and our reviews.

5. Ongoing oversight

• We keep a register of vendors, the data they handle and the risk each poses.
• Higher-risk vendors are reviewed at least once a year, and whenever there is a significant change or incident.
• Vendor access to our systems is limited, logged and removed when no longer needed.
• We avoid depending on a single vendor for critical services where practical, and plan for their failure in our Business Continuity & Disaster Recovery Plan.

6. Incidents involving a vendor

If a vendor suffers an incident affecting DocGini data, we handle it under our Data Security & Incident Response Policy, including notifying affected Users where required. We may suspend or end a relationship with a vendor that puts data or the service at unacceptable risk.

7. Ending a relationship

When we stop using a vendor, we remove their access, recover or confirm deletion of our data, and move the service to a replacement without losing records.

8. Links to other websites

DocGini may link to websites we do not control, such as a hospital's own site or a regulator's register. Those sites have their own terms and privacy practices, and we are not responsible for them.

9. Changes to this Policy

We review this Policy at least once a year. Material changes will be notified in the same way as changes to the Terms of Service.

Contact Us