Privacy
Privacy Policy
What we collect, why we collect it, who it goes to and how it is protected — in plain language.
Last updated: 22 September 2026
This policy covers the MedhaKit website (medhakit.com), the management software and the website service. It deals separately with two kinds of information: what you give us directly, and what your institution enters into the software. The responsibility for each is not the same.
What we collect
Nothing beyond what the forms themselves ask for.
From the demo form
- Institution name and type
- EIIN, if you give one
- District, thana and address
- Institution phone and email
- Contact person's name, phone and email
At registration
- Everything listed above
- The admin's email and password
- Passwords are stored encrypted and can never be read back
What the institution enters itself
- Student, teacher and staff records
- Attendance, results, fees and other records
- This data is owned and controlled by the institution — we only hold it
Technical information
- Cookies needed to keep you signed in
- Server logs, for security and fault-finding
1.Why we collect it
Demo and contact details are used only to get in touch with you and to show you what suits your institution. Account details are needed to run the software, raise invoices and provide support. Anything your institution enters into the software is used solely to run that institution — we do not analyse it, sell it or use it for advertising.
2.Who is responsible for what
Your institution, not us, is the controller of student and guardian data. What gets recorded, who can see it and how long it is kept are the institution's decisions. We act on the institution's instructions and make no independent use of that data.
3.Who we share with
We do not sell data and we do not pass it to advertisers. Where it has to be shared to run the service, that means: (1) the SMS gateway — but since you connect your own BulkSMSBD account, messages and charges go directly through that account; (2) the relevant payment channel (bKash, Nagad or a bank); (3) hosting and domain providers; (4) the appropriate authorities where we are legally required to.
4.Cookies
This site uses no advertising trackers and no third-party analytics cookies. The cookies it does use are functional: keeping you signed in, and remembering whether you are reading in Bangla or English. If analytics is added in future, this section will be updated to say so.
5.How long we keep it
Contact and demo details are kept for as long as the conversation with you is live, or as long as the law requires. Institution accounts and records are kept for the life of the subscription. How long data and backups are retained after a subscription ends is set out in writing in your service agreement.
6.Security
The database is held encrypted and an automatic cloud backup is taken daily. All traffic runs over HTTPS/SSL. Each institution's data is separate — no institution can see another's. Inside an institution, who sees what is controlled by role, and that control belongs to the institution.
7.Children's and student data
A large share of the students recorded in the software are minors. That information is not collected from children directly — the institution enters it under its own authority and responsibility, and obtaining any necessary guardian consent falls to the institution. We store and process it only on the institution's instructions.
8.Your rights
You can ask what information we hold about your institution, have anything incorrect corrected, request a copy, or ask for it to be deleted. Send the request to the email or phone number below. Where we are required to retain something for legal or accounting reasons, we will tell you.
9.Changes to this policy
This policy may be updated when needed. When it is, the date above changes. Active institutions are notified separately of any significant change.
Questions
For any privacy question or request, reach us on any of the channels below. We usually reply within 24 hours.