What you share, where it goes and how to ask for help. This notice explains the website’s information handling, including business inquiries, recruitment and optional CVs.
1. Who this notice covers
Shan Communications operates this website. This notice explains the handling of information from website visitors, people making business inquiries, job applicants and authorized users of the website submissions dashboard. Our published office is in Rawalpindi, Pakistan; inquiries and recruitment may involve people in Pakistan, the United States and other locations.
This is a website privacy notice, not a patient privacy notice or an employee handbook. Information handled on behalf of a client is also subject to the relevant service agreement, client instructions and applicable law. A different website or client system may have its own notice. Visiting this site does not create a healthcare provider–patient relationship.
2. Information collected
The information depends on which part of the website you use. Please provide only what is relevant to your inquiry or application.
- Business inquiries: your name, email address, optional phone number, selected service or topic, and the project details you write in the message.
- Job applications: your name, email, phone or WhatsApp number, preferred role, experience range, availability and experience summary. A CV file or CV link is optional. Documents may contain additional information that you choose to include.
- Submission and review records: a reference number, submission time, processing status, delivery and synchronization results, and notes added by authorized staff reviewing the request.
- Technical records: the page referring the submission, browser information and a protected hash derived from the submitting IP address. Hosting access and error logs may separately contain IP addresses and request details. These records should not be treated as completely anonymous.
- Dashboard accounts: staff names, email addresses, access permissions, password hashes, session information, internal messages and selected administrative activity. Passwords are checked against stored hashes rather than displayed to other users.
3. Required fields, optional CVs and sensitive information
Required form fields are marked on the form. They are needed to identify the request, route it to the correct team and reply. Leaving an optional field blank, including the CV upload and CV link, does not prevent a job application from being submitted. You can describe your experience in the application instead.
If you attach a CV, the supported formats are PDF, DOC, DOCX, JPG, JPEG and PNG, with a maximum file size of 10 MB. Remove unnecessary identity numbers, bank details and other sensitive information. Include another person’s reference details only when you are entitled to share them. If you provide a cloud-document link, check its sharing permissions; the document remains subject to that provider’s settings and policies.
Do not submit patient records, medical histories, payment-card details, bank account credentials, passwords, CNIC or Social Security numbers, passport copies or other government identity documents through these general forms. If a later engagement requires restricted information, the responsible team must first agree an appropriate channel and handling arrangements.
4. Why the information is used
Business information is used to understand your needs, answer questions, discuss a potential project and keep track of the conversation. Recruitment information is used to review your application, consider you for suitable roles related to it and contact you during recruitment. Submission records also help investigate failed delivery, incorrect details, duplicate entries, complaints and suspected misuse.
Staff account and session information supports access management and authentication. Internal messages support authorized team coordination, while selected activity records support administrative accountability and investigation of problems.
The form checkbox concerns using your information to handle the inquiry or application. It is not a blanket permission for unrelated marketing, automated calls, disclosure of patient information or an unlimited recruitment database. Any additional activity must have an appropriate basis under the rules that apply to it; a website submission alone does not supply every permission a sales or healthcare campaign may need.
5. Where submissions go and who can receive them
Submissions are saved in the website’s hosted database and made available through the staff dashboard. Business notifications are directed to our business-inquiry mailbox; application notifications are directed to HR. When a CV is uploaded, a private hosting copy is stored and a copy is attached to the recruitment email.
The Google Sheets integration, when enabled, also copies contact or application details, the message, workflow status, and any CV link or filename into a business spreadsheet. That synchronization does not upload the CV file itself, the private storage path, IP hash or browser information. Authorized exports and email handling can create additional copies outside the dashboard.
Recipients can include personnel handling your request and service providers supporting hosting, email and Google Sheets. Information may also need to be shared with professional advisers or competent authorities for a specific dispute, legal obligation or security matter. Client-project data must be handled within that project’s agreed access and disclosure rules.
The public submission form is not configured to distribute submissions to advertising networks. This statement describes this website’s submission process; it is not a representation about every separate client campaign or third-party service.
6. Cookies, tracking signals and external links
The public website application does not currently include advertising pixels or cross-site analytics trackers. The staff dashboard uses an essential session cookie to keep an authorized user signed in and to support session security. Its session expires after inactivity. Blocking or clearing that cookie may sign you out or prevent dashboard access.
Because this public website does not implement cross-site behavioral tracking, it does not change its behavior in response to a browser Do Not Track signal. No third-party behavioral-tracking scripts are included in the current public application. If tracking features are introduced, this notice and any legally required choices must be updated to reflect them.
Links to Google Maps, WhatsApp, social networks and external documents take you to services with their own information practices. Following a link may reveal information to that provider, including your IP address and browser details. Review its privacy notice and your account or document-sharing settings before supplying information there.
7. Pakistan, the United States and international processing
Your inquiry or application may be handled by personnel or service providers in a country different from your own, including Pakistan or the United States. Email, hosting and document providers may process information in additional locations. This website does not promise that every copy will remain in a particular country.
Privacy and employment requirements depend on the people involved, the activity, the relevant jurisdiction and the organization’s legal obligations. Where a client requires restricted data locations or a particular international-transfer arrangement, those requirements must be assessed and agreed before information is placed in the project’s systems. Do not use a general inquiry form as a substitute for that agreement.
8. Retention, withdrawal and deletion
Retention depends on the purpose of the record, whether the inquiry or recruitment process remains active, relevant contractual or legal recordkeeping needs, and any unresolved complaint or dispute. This notice does not promise a fixed deletion date for every category of information. There is no automatic site-wide retention purge currently implemented.
Moving a submission to dashboard Trash is a recoverable administrative action, not permanent erasure. It does not automatically remove the database record, uploaded CV, sent emails, spreadsheet entries or authorized exports. A deletion request therefore needs a review of the relevant copies rather than only a change in the dashboard.
You may ask HR to withdraw an application or ask support to review a correction or deletion request. We may need to retain limited records where the law or a legitimate unresolved matter requires it. A cloud CV that you own remains under your provider’s controls; deleting the hosting copy does not delete your original document. Any response to an erasure request should distinguish records removed, records retained and copies outside our control.
9. How information is protected
HTTPS protects a connection when you use the website’s HTTPS address. Staff dashboard access requires authentication and server-side permissions. CV downloads are restricted to authorized accounts, uploaded files are kept outside the public website folder, and forms apply file checks and abuse controls.
These measures reduce risk but do not make every system or transmission risk-free. File-type checks are not a guarantee that a document is free of malware. Email attachments and spreadsheet copies depend on those services’ account permissions and security settings. This notice does not claim end-to-end encrypted email, encryption of every stored copy or an independently certified security program.
10. Your privacy choices and requests
Contact support using the details below to request access to, correction of or deletion of information you submitted, or to raise a privacy concern. State the email address used, the approximate submission date, any reference number and what you want changed. For an application withdrawal, you can contact HR directly. Do not send an identity document or additional sensitive information unless a necessary, proportionate verification method has first been agreed.
We may need to verify your identity and an authorized representative’s authority before providing or changing records. If Shan Communications handles the information for a client, the request may need to be coordinated with the client responsible for that record. Verification is intended to avoid disclosing another person’s information.
Statutory rights vary. For example, eligible California residents may have rights to know, access, correct, delete or restrict certain processing, and to opt out of sale or sharing, where the California Consumer Privacy Act applies to the business and activity. Other jurisdictions may provide different rights, exceptions or appeal routes. We do not assume that every privacy statute applies to every visitor or every record.
Requests are subject to the applicable legal deadlines, verification rules and permitted exceptions. Where a request cannot be fully fulfilled, the response should explain the reason and any applicable complaint or appeal route. Nothing in this notice limits a mandatory legal right or permits unlawful discrimination for exercising one.
11. Children and information sent by mistake
The website is intended for business contacts and people seeking work; it is not directed to children under 13. Please do not use the forms to send a child’s personal information. No claim is made that the website verifies every visitor’s age.
If you believe a child’s information or restricted information has been submitted by mistake, contact support promptly with enough information to locate the record. Describe the issue without sending another copy of the sensitive document. The appropriate next steps depend on the information, its recipients and the applicable requirements.
12. Changes to this notice
The date at the top identifies the current version. Changes will be published on this page. A material change requiring a separate notice or consent under applicable law must be handled through that additional process; merely editing this page does not provide permission for an otherwise unlawful new use.
For questions about a specific submission, use the contacts below rather than sending the same information through several forms. Business inquiries, recruitment requests and general privacy questions have different destinations so they reach the appropriate team.