This Privacy Policy explains how Tharsol (Pvt.) Ltd. ("Tharsol", "we", "us") collects, uses, shares, stores and protects information through the MREP mobile application (Android package com.tharsol.mrep) and the MREP web portal and services connected to it.
MREP is a business application for pharmaceutical field forces. It is provided to companies ("Client Companies") that issue MREP accounts to their own employees. Accounts cannot be created by the public from within the app. For information about you that is processed in MREP, your employer decides why it is collected; Tharsol processes it on your employer's behalf and as described in this policy.
"Personal information" means information that identifies you, or could reasonably be used to identify you.
By signing in to and using MREP you acknowledge this policy. Where the app needs a device permission (for example location or camera), Android asks for your permission first, and you can withdraw it at any time.
Information we collect about you
Account and work profile. Company code, user ID and password (used only to sign you in), your name, employee code, designation, team, territory code and reporting managers. Most of this is provided by your employer.
Location. Precise (GPS) and approximate location when you mark attendance or start and end your day, log or close a doctor or chemist call or event, add or verify a doctor's practice place or a chemist, run a health camp, or record mileage. While you are using the app, your current location is also attached to the requests the app sends to the server, so that reported field work can be verified. When you log a call we also record the mobile network cell tower details (cell ID, area code and network codes) to confirm location when GPS is weak. MREP does not collect location in the background: location is collected only while the app is open and in use, and MREP does not request the Android background-location permission.
Photos and documents. Photos you take or select in the app, such as photos of doctors' practice places, doctors, chemists and pharmacists, your attendance photo, activities and health camps, expense receipts and vehicle meter readings, and documents you attach to HR requests. The camera is opened only when you choose to take a photo or when a face verification screen is shown.
Face data (face verification). If your employer enables face verification, MREP asks you to register your face by capturing a short set of face photos, which are uploaded to your employer's MREP server and used to create your face reference. When you sign in or mark attendance, the app captures your face with the camera and compares it, on your device, with your face reference to confirm that you are the account holder. Face data is used only to verify your identity. It is not used for advertising, not sold, and not shared with any third party. Face detection is performed on the device using Google ML Kit; your face images are not sent to Google.
HR information (when your employer uses MREP's HR features). CNIC number and a copy of your CNIC, date of birth, gender, contact number, email address, postal address, joining date and joining report; leave requests with dates, reasons and attachments (which may include medical certificates); resignation details; and expense claims with amounts, distances travelled and supporting photos.
Device and app information. Device identifier (Android ID), device manufacturer and model, Android version, app version, app language, IP address and network type. To protect the integrity of field reporting, the app also checks whether the device is rooted, whether developer options or mock locations are enabled, and whether apps that can fake GPS location are installed. If such an app is found, MREP asks you to remove it and reports only the name of that location-faking app; we do not upload the list of apps installed on your device. MREP cannot be used on rooted devices or while a location-faking app is installed.
Diagnostics and app usage. Crash reports, error logs, performance data and in-app usage events, collected through Firebase Crashlytics and Firebase Analytics, used to fix problems and improve the app.
Notification token. A push-notification token from Firebase Cloud Messaging (or Huawei Push Kit on Huawei devices), used to send you work notifications such as approvals and messages.
Bluetooth. Used only to connect to a Bluetooth printer that you choose, in order to print documents. MREP does not collect or store information about nearby Bluetooth devices.
Communications. Feedback, support requests and other messages you send us.
Information about other people that you enter in MREP
As part of your work you may record information about other people. You should only enter information you are authorised to collect, and where your employer requires it, with the person's consent.
Healthcare professionals (doctors): name, specialty, qualification, PMDC registration number, CNIC number, phone number, email, practice place address and GPS location, photos, visit and call records and, for activities your employer approves and pays, the account title, bank account number and cheque name.
Chemists, pharmacies and pharmacists: name, contact details, address and location, photos and, where required by your employer, identity details.
How we use information
To provide MREP: signing in, attendance, planning and reporting calls and events, orders, sales and stock reporting, expenses, HR requests, health camps, approvals, training content and notifications.
To verify field activity and prevent fraud, using location, cell tower details, device integrity checks, location-faking detection and face verification.
To synchronise your work data with your employer's systems and make it available to your managers and authorised administrators.
To keep MREP secure, diagnose crashes and improve performance and features.
To comply with legal obligations and respond to lawful requests.
MREP does not show advertising, does not use your data for advertising or marketing, and we do not sell personal information.
How information is shared
Your employer. Information you record in MREP is available to your employer (the Client Company) and to its authorised staff, such as your managers and administrators, for business reporting, approvals and payments.
Service providers that process data for us under contract, only for the purposes above: Google Firebase (Crashlytics, Analytics and Cloud Messaging), Huawei AppGallery Connect and Push Kit on Huawei devices, Google Maps Platform for maps and distances, and the hosting providers of the MREP servers. Their use of data is also governed by their own policies, for example Firebase privacy and Google Privacy Policy.
Legal requirements. Where required by law, regulation, court order or a lawful request from a government authority, or to protect the rights, property or safety of Tharsol, our clients or others.
Business transfers. If Tharsol is involved in a merger, acquisition or sale of assets, information may be transferred under an obligation to keep it confidential and to handle it as described in this policy.
We do not sell, rent or trade personal information, and we do not share it with advertisers.
Storage, transfer and security
Data sent between MREP and its servers is encrypted in transit (HTTPS). Access on the server is limited by role, so users see only the data their position allows.
To work without signal, MREP keeps your working data in the app's private storage on your device. This data is excluded from device backups and is removed when the app is uninstalled or its data is cleared.
Information may be stored or processed in Pakistan and, through the service providers listed above, in other countries.
We use physical, technical and organisational measures to protect information. No method of transmission or storage is completely secure, but we work to protect your information and to respond promptly to any incident.
Retention and deletion
We keep personal information for as long as your MREP account is active and for as long as your employer needs it for its business records, or as required by law.
When your employer closes your account, your personal information is deleted or anonymised within 90 days, except records your employer or the law requires us to keep (for example approved activities, payments and sales records). Face data is deleted when your account is closed or your face registration is reset.
Requesting deletion. MREP accounts are issued by your employer, so you can ask your employer's MREP administrator to delete your account and data, or email us at info@tharsol.com with your company code and user ID. We will verify the request with your employer and complete it within 30 days.
Data stored on your device is removed when you uninstall the app or clear its data.
Your choices and rights
You can allow or deny MREP's permissions (location, camera, notifications, Bluetooth and phone) and change them at any time in your device settings. Some features need them: for example attendance and call reporting need location, and face verification and photos need the camera.
You can ask to access, correct or delete your personal information through your employer, or by emailing us at info@tharsol.com. There is no charge for this.
You can stop all collection by signing out and uninstalling the app.
Children
MREP is a workplace application and is not intended for anyone under 18. We do not knowingly collect personal information from children.
Changes to this policy
We may update this policy when MREP or the law changes. The effective date below shows when it was last updated. Significant changes will be announced in the app or on this page.
Contact us
Questions, requests or complaints about privacy can be sent to us at Tharsol, G-09, Mall of Faisalabad, 2028 Chak road, Faisalabad, Punjab, Pakistan, or by email to info@tharsol.com. We take complaints seriously and will respond promptly.