Last updated: 28 August 2026
Applies to: the Enana mobile application for iOS and Android (me.enana.app)

1. Who this policy is for

Enana is a private application for Enana staff. It is not a consumer product and is not intended for the general public. You use it because you are an employee or contractor of Enana and have been issued an account by an Enana administrator. Accounts cannot be self-registered.

Throughout this policy, “we” and “Enana” mean Enana, the company that issued your account and decides how your data is used. “You” means the staff member using the app.

Questions, requests or complaints: info@enana-iraq.com

2. The short version

• The app collects work data — where you were during a working shift, the pharmacy visits you record, the photos and voice notes you capture, and who you are.
• Location is recorded only between the moment you tap “Start Day” and the moment you tap “End Day”. Outside a shift, the app does not record your location.
• We do not sell your data, we do not advertise, and we do not track you across other companies’ apps or websites.
• The data exists so your manager can verify field coverage and so the company can plan stock, targets and territory. That is its only purpose.

3. What the app collects, and why

• Precise location (during a shift) — to verify that recorded pharmacy visits happened where and when they were reported, and to attach a location to a bonus request or a newly pinned client.
• Photos you take — proof of visit and proof of bonus delivery. Your name and the capture time are written onto the image itself.
• Voice notes you record — so you can dictate a visit or call report instead of typing it. The recording is converted to text and both are kept.
• Text you write — visit reports, call notes, client details, and the transcripts produced from your voice notes.
• Your identity — your account ID and name, so work is attributed to the right person.
• Client contact details you enter — pharmacy and doctor names and phone numbers, so the company can maintain its customer records.
• Device information — a device identifier and a push-notification token, so we can send you notifications and so you can be signed out of a lost device.
• Crash diagnostics — when the app crashes, technical details plus your account ID are sent so we can fix the fault.

We do not collect: your contacts, your calendar, your health or fitness data, your photos other than the ones you deliberately capture in the app, your financial information, or any advertising identifier.

4. Location, specifically

This is the part that deserves plain language, because the app can record location while it is in the background.

• Background location recording starts only when you tap “Start Day” and stops when you tap “End Day”. It is not running at any other time.
• While a shift is running, the app records your position periodically so that visit coverage can be verified. It reduces or pauses recording while you are stationary, to save battery.
• On Android, a permanent notification is shown while a shift is running, so it is always visible to you that recording is active.
• You can end a shift at any time. You can also switch location permission off entirely in your device settings, though visit verification will then not work.

5. Who else receives this data

We use a small number of service providers to run the app. They process data on our instructions and for no purpose of their own.

• Supabase — all application data (accounts, visits, locations, photos, voice notes, transcripts). Database, file storage and authentication.
• OpenAI — the audio of your voice notes. Speech-to-text transcription.
• Sentry (EU region) — crash diagnostics and your account ID. Crash and error reporting.
• Expo / EAS — your push token and app-update requests. Push notifications and over-the-air app updates.
• Apple / Google — your push token, to deliver push notifications to your device.

We do not sell personal data, share it with data brokers, or use it for advertising.

6. How long we keep it

Work records — visits, photos, voice notes, transcripts and shift location history — are business records and are retained for as long as the company needs them for operational and audit purposes. Crash diagnostics are retained on a rolling short-term basis by our error reporting provider. When you leave the company your access is revoked; work records created during your employment remain company records.

7. Security

Access is controlled by username and password, optionally protected by Face ID or a fingerprint on your device. Sign-in tokens are held in the device’s secure keychain. Data is transmitted over encrypted connections. Access to the underlying database is restricted by role, and administrative actions are logged.

8. Your rights

You can ask us to show you what the app holds about you, to correct anything inaccurate, or to explain why something was collected. Depending on where you live you may have further rights over your personal data. To exercise any of these, contact us at info@enana-iraq.com. Some records may need to be retained where the company has a legal or legitimate business reason to keep them.

9. Children

Enana is a workplace application. It is not directed at children and must not be used by anyone under 16.

10. Changes

If we change what the app collects, we will update this policy and change the date at the top. Material changes affecting staff will also be communicated internally.