Skip to main content
MEDS-LINKMEDS-LINK
Menu

Privacy Policy

Last updated: September 2026

The controller responsible for the processing of personal data in connection with MEDS-LINK services is:

MEDS-LINK LTD
Agias Zonis 30A, Fantaros Court, Office 302
3027 Limassol, Republic of Cyprus

Registration number: HE 379510
VAT number: CY10379510O
Email: [email protected]
Data protection contact: [email protected]

MEDS-LINK LTD is established in a Member State of the European Union and processes personal data in accordance with Regulation (EU) 2016/679 (General Data Protection Regulation — GDPR) and applicable Cypriot data protection legislation, including Law 125(I)/2018.

The competent Cypriot supervisory authority is the Office of the Commissioner for Personal Data Protection of the Republic of Cyprus.

As part of its international medical recruitment activities, MEDS-LINK may process personal data relating to healthcare professionals, candidates, representatives of healthcare institutions, prospects, clients and partners.

Personal data is processed in accordance with the GDPR principles of lawfulness, fairness and transparency, purpose limitation, data minimisation, accuracy, storage limitation, integrity and confidentiality, and accountability.

2. Personal Data We Collect

Depending on the services used, MEDS-LINK may collect:

  • first and last name;
  • email address;
  • telephone number;
  • medical specialty;
  • country of practice;
  • professional background information;
  • education, experience, skills and publications entered by the user;
  • profile photograph where the user chooses to provide one;
  • professional documents: CNOM certificate of provision of services, where applicable and uploaded by the doctor;
  • information required to manage the user's account and relationship with MEDS-LINK.

Professional information is entered directly into the profile using structured fields.

MEDS-LINK does not require users to upload a CV or diploma to their profile. Where applicable, doctors may however upload their certificate of provision of services issued by the CNOM (French National Medical Council), which is kept in their professional file.

Profiles may remain partially completed where the relevant information is optional.

Availability for Assignments

Where a healthcare professional indicates that they are available for assignments, MEDS-LINK may also process:

  • availability according to contract type;
  • preferred time slots;
  • desired working hours;
  • accepted geographical areas;
  • specialties offered;
  • indicative requested remuneration or fee, where applicable.

These details are optional and are used to identify professional opportunities corresponding to the criteria provided by the user.

News and Blog Subscriptions

For subscribers to MEDS-LINK news or blog communications, MEDS-LINK processes:

  • email address;
  • timestamp of consent;
  • subscription confirmation token.

These data are used solely to manage the subscription and send the requested communications.

3. Purposes of Processing

Personal data may be processed for purposes including:

  • creating and managing user accounts;
  • managing professional profiles;
  • connecting healthcare professionals with institutions;
  • managing applications and professional opportunities;
  • searching and matching profiles with opportunities;
  • managing availability for assignments;
  • sending service-related notifications;
  • sending communications requested by users;
  • managing news and blog subscriptions;
  • billing and management of paid services;
  • platform security and abuse prevention;
  • user support;
  • operation and improvement of the services;
  • compliance with applicable legal and regulatory obligations.

Depending on the purpose of the processing, MEDS-LINK relies on one or more of the legal bases provided for by the GDPR.

Performance of a Contract or Pre-contractual Measures

This may apply in particular to:

  • account creation and management;
  • provision of requested services;
  • introductions and recruitment-related services;
  • management of applications or assignments;
  • billing and performance of purchased services.

Consent is relied upon where appropriate, including for certain optional communications and subscriptions to MEDS-LINK news or blog updates.

Consent may be withdrawn at any time without affecting the lawfulness of processing carried out before withdrawal.

Legitimate Interests

MEDS-LINK may rely on its legitimate interests for purposes including:

  • platform security;
  • fraud and abuse prevention;
  • establishment, exercise or defence of legal claims;
  • improvement of service operation, where the interests or fundamental rights and freedoms of data subjects do not override those interests.

Certain processing activities are necessary for MEDS-LINK to comply with applicable legal, accounting, tax, regulatory or judicial obligations.

5. Retention Periods

MEDS-LINK retains personal data only for as long as necessary for the purposes for which it was collected, subject to applicable statutory retention requirements.

CategoryRetention period
Candidates not recruitedUp to 2 years after the last contact, unless deletion is requested or another lawful ground justifies retention
Recruited candidatesFor the duration of the relevant relationship and thereafter as required by applicable law
Clients / healthcare institutionsFor the contractual relationship and thereafter for applicable statutory periods
ProspectsUp to 3 years after the last contact, subject to the applicable legal basis
EVC guidanceUp to 3 years after the last contact
Profile and recruitment-file dataUp to 2 years after the last contact where recruitment is unsuccessful, subject to any other applicable legal basis
ContractsAt least 6 years where applicable Cypriot accounting or tax rules so require
Invoices and accounting recordsAt least 6 years where required by applicable legislation
News / blog subscribersUntil consent is withdrawn; unconfirmed subscriptions are deleted within 30 days

Where a user unsubscribes from communications, MEDS-LINK may retain the email address in a suppression list where necessary to ensure that the user's choice not to be contacted continues to be respected.

Technical Logs

Authentication, access, security-event, system-error and administrative audit logs are retained for 12 months, unless a longer period is necessary in connection with a security incident, dispute, investigation or legal requirement.

6. Recipients and Service Providers

Personal data is accessible only to authorised persons within MEDS-LINK and to technical service providers where necessary for the operation of the services.

MEDS-LINK currently uses services including:

  • Hostinger — hosting infrastructure;
  • Neon — database services;
  • Sentry — error and performance monitoring;
  • Upstash — rate limiting and security functions;
  • Resend — automated email delivery;
  • Hostinger — email services used for certain messages sent directly by the MEDS-LINK team;
  • Google — authentication where users choose to sign in using a Google account;
  • Cloudinary — image and profile-photo hosting and processing;
  • Anthropic / Claude — artificial-intelligence functionality where used by the relevant services;
  • Daily.co — video conferencing for certain recruitment interviews;
  • Cloudflare — website delivery, security and protection.

Service providers receive access only to the extent necessary to provide the relevant service and in accordance with their applicable role and contractual arrangements.

MEDS-LINK does not sell personal data.

7. International Data Transfers

Some service providers or recipients may be located, or may process personal data, outside the European Economic Area.

Where personal data is transferred internationally, MEDS-LINK uses the appropriate transfer mechanism under the GDPR according to the circumstances, including:

  • a European Commission adequacy decision where applicable;
  • appropriate safeguards under Article 46 GDPR, including the European Commission's Standard Contractual Clauses, where applicable;
  • and, only where the legal conditions are satisfied, a derogation under Article 49 GDPR.

Where required, MEDS-LINK assesses the circumstances of the transfer and the applicable safeguards, including the destination country and available technical and organisational measures.

Introductions to Organisations Outside the EEA

MEDS-LINK operates internationally.

Where a user requests professional opportunities in a country outside the European Economic Area, certain personal data may need to be communicated to the relevant healthcare institution or partner to provide the requested recruitment or introduction service.

Any such disclosure is limited to what is necessary for the relevant purpose and is carried out in accordance with the applicable international-transfer mechanism.

Information about safeguards applicable to a particular transfer may be requested at:

[email protected]

8. Your Rights

Subject to the conditions of the GDPR, data subjects may have the following rights:

  • access;
  • rectification;
  • erasure;
  • restriction of processing;
  • objection;
  • data portability where the legal requirements are met;
  • withdrawal of consent at any time where processing is based on consent.

Requests may be submitted to:

[email protected]

MEDS-LINK may request information strictly necessary to verify the identity of the person making the request where this is necessary to protect personal data against unauthorised disclosure.

Response Time

MEDS-LINK responds to data-subject requests within the period provided for by the GDPR, normally one month from receipt of the request.

Where permitted by the GDPR, this period may be extended due to the complexity or number of requests. The data subject will be informed of the extension and reasons for it within the initial period.

Complaints

Data subjects also have the right to lodge a complaint with a competent supervisory authority.

The competent authority in Cyprus is the:

Office of the Commissioner for Personal Data Protection — Republic of Cyprus.

9. Records of Processing Activities

MEDS-LINK maintains records of processing activities where required by Article 30 GDPR.

These records document, as applicable:

  • processing purposes;
  • categories of individuals and data;
  • recipients;
  • retention periods;
  • international transfers;
  • applicable technical and organisational security measures.

10. Security

MEDS-LINK implements appropriate technical and organisational measures designed to protect personal data against:

  • unauthorised access;
  • alteration;
  • unauthorised disclosure;
  • loss;
  • destruction;
  • unlawful or accidental use.

Measures are adapted to the nature of the relevant processing activities and identified risks.

11. Cookies and Similar Technologies

Strictly Necessary Elements

The platform uses elements required for its operation and security, including:

  • authjs.session-token — secure authentication-session management;
  • authjs.csrf-token — protection against CSRF attacks.
  • meds-link-consent — records the visitor's choice regarding the categories of cookies they allow.

Local Storage

  • meds-link-cookie-consent — keeps the consent preferences locally in the browser.

Technical Monitoring

Sentry may be used for error and performance monitoring in accordance with MEDS-LINK's implemented consent configuration.

Advertising

MEDS-LINK does not use advertising or advertising-tracking cookies under the site's currently declared configuration.

Cookie preferences may be changed using the Cookie Management link available on the website.

12. Changes to this Policy

MEDS-LINK may update this Privacy Policy to reflect changes including:

  • development of its services;
  • legal or regulatory changes;
  • changes to service providers;
  • new technical or security measures.

The date of the latest update appears at the top of this Policy.

Where required, users will be informed of material changes.

13. Contact

For questions relating to personal data or the exercise of your rights:

[email protected]