Privacy Policy — Manara ESS

Last updated: 9 August 2026

This Privacy Policy explains how International Medical Company (IMC), operator of Kulud Pharmacy ("we", "us"), processes information in the Manara HR Platform Employee Self-Service application and website (the "App"), used by employees of IMC · Kulud Pharmacy. IMC is the data controller for the information described below. The App is a private, work-related tool: access requires an employee login, and it is not directed to the general public or to children.

1. Information we process

Information you provide or that identifies you

Identity & account: your name and employee ID/number, and job, department and branch information used to sign you in and route your requests.
Contact details: work email and/or phone number where used to reach you about requests and notifications.
Requests you submit: leave requests, general HR requests (GRF), and the details you enter in them.
Files you upload: documents or images you attach to a leave or general request (e.g. medical or supporting documents).
Messages: messages you send and receive in the in-app Manara Messenger.

Information shown to you from the HR system

The status of your requests, your leave balances and leave-policy entitlements, and your own attendance record as recorded by HR. Managers can additionally see approvals and requests for their own team members.
Where enabled for your account, your own pay information: payslips, and any company loan in your name (its amount, instalment schedule and what is still to repay). This is shown only after you confirm your identity again — see section 5 — and only ever your own.
A personal timeline ("My Journey") and a home summary, both assembled from the records already listed above. They combine information we already hold; they do not collect anything new.
Open internal vacancies. These are the same roles published on our public careers site, and we do not record which of them you looked at.

Information collected automatically

Authentication token: a secure sign-in token stored on your device so you stay logged in.
Trusted devices: if you choose "Keep me signed in", we record that device (a random device identifier, a one-time-use sign-in credential stored in hashed form, the device type and the date last used) so you do not have to sign in every day. You can see and remove your trusted devices at any time under Profile, and signing out removes the one you are using.
App lock: if you set a PIN, it is stored only as a secure hash — never in a readable form.
Face ID / fingerprint: if you turn this on, your device creates a security key for this app and we store only the public half of it. Your fingerprint or face data never leaves your device and is never sent to us.
Notification token: if you enable notifications, a device/notification token so we can deliver alerts about your requests and messages. You can turn this off in your device settings, and choose which categories you want under Notifications → Alert settings.
Technical logs: standard server records such as IP address, date/time, and device or browser type, used to operate and secure the service.

Information you create in the App

Certificates you issue: when you generate an employment certificate, we record that it was issued, its reference and a verification code, together with a snapshot of the details printed on it (your name, employee number, position, department, entity and joining date). See section 3 for who can see this.
Recognition: if you send or receive peer recognition, we store who sent it, who received it, the badge and any message you wrote.

Information we deliberately do not collect

Wellbeing tools: anything you enter into the Wellbeing screen — height, weight and your water count — is stored only on your own device and is never sent to us. HR cannot see it. You can erase it at any time from that screen.

2. How we use this information

To provide the self-service features — submitting and tracking leave and HR requests, viewing your own records, and manager approvals.
To send you notifications about your requests and messages.
To secure the service, prevent misuse, and keep records required by the employment relationship and applicable law.

We process this information as part of your employment relationship and our legitimate interest in operating HR services.

3. How information is shared

We do not sell your information, and we do not use it for advertising. The App contains no third-party advertising or analytics tracking SDKs.

Information is accessible to authorized HR and management staff on a need-to-know basis, and is processed by service providers that host and operate the system on our behalf (for example our web hosting provider), under our instructions. We may disclose information where required to comply with a legal obligation.

Certificate verification

An employment certificate you generate carries a QR code and a verification code. Anyone you give that certificate to can use the code on our public verification page to confirm it is genuine. That page shows only what is printed on the certificate itself — your name, employee number, position, entity, the reference and the issue date — so that the person checking can match it against the document in their hand. It never shows your salary, Qatar ID, contact details or any other record. The code is only known to whoever you give the certificate to.

Assistance features that use an external provider

The App includes an optional "Ask HR" assistant. Where this feature is switched on, your typed question is sent to a third-party language-model provider outside Qatar in order to produce an answer, together with a small set of facts drawn from your own record.

Those facts are de-identified before they are sent. The provider receives, for example, your job title, department, joining date, length of service, leave balances and the number of requests you have open. It does not receive your name, employee number, email address, Qatar ID, bank details or any salary figure, and it is not given access to the HR system. The provider processes the request to generate a reply and is not permitted to use it to train its models. Your question and the answer are logged in our own system so HR can review how the assistant is performing.

If you would prefer not to use this feature, simply do not use the "Ask HR" screen — every other part of the App works without it, and you can always raise a normal HR request instead.

4. Data retention

We keep information for as long as needed to provide the service and to meet HR record-keeping, employment, and legal requirements, after which it is deleted or anonymized.

5. Security

All traffic between the App and our servers is encrypted in transit using HTTPS/TLS. Access is restricted by employee login and role-based permissions.

Passwords, app-lock PINs and sign-in credentials are stored only in hashed form. A "keep me signed in" credential is single-use and replaced every time it is used, so a copied one stops working; it is cancelled automatically if you change your password, sign out, or your account is deactivated. Salary and loan information requires you to confirm your identity again before it is shown.

So the App still opens without a signal, your device keeps a copy of the app's own screens and images. Your personal information is never stored in that offline copy — every request for your own data goes to our servers each time, so nothing of yours is left behind on a device once you sign out.

6. Your choices and rights

Access & correction: you can request access to, or correction of, your personal information.
Notifications: you can disable notifications at any time in your device settings.
Deletion: you can request deletion of your account and associated personal data, subject to records we are legally required to retain. See "Data deletion" below.

7. Data deletion requests

To request deletion of your Manara ESS account and personal data, contact International Medical Company (IMC) at the address below with your name and employee ID. We will action verified requests except where retention is required by law or the employment relationship.

8. Children

The App is intended for employees only and is not directed to children.

9. Changes to this policy

We may update this policy from time to time. Material changes will be reflected by updating the "Last updated" date above.

Contact

International Medical Company (IMC)
Operator of Kulud Pharmacy · Doha, Qatar
Email: hr@imc.com.qa
You may also contact your HR department directly.

Manara ESS — Privacy Policy