Privacy Policy

Medhandy is committed to protecting privacy in a healthcare setting. Because the platform processes sensitive health information, this policy is designed for a health-tech environment rather than a generic software product.

This policy should be read together with the Terms of Use, the Acceptance Policy, hospital-specific rules, and any data processing agreements that apply to a facility or enterprise customer.

Medhandy is intended to operate in accordance with the Nigeria Data Protection Act 2023, the National Health Act, and accepted healthcare privacy and security practices.

Where a hospital, clinic, or enterprise customer has stricter internal rules, those rules should also be followed, provided they do not conflict with law.

• Personal data: Information that identifies or can identify a person.
• Health data: Clinical and medical information such as diagnoses, prescriptions, laboratory reports, and treatment history.
• Institution data: Hospital, clinic, laboratory, pharmacy, or HMO account information and configurations.
• Platform data: Technical logs, usage records, audit trails, and security metadata generated when the system is used.
• Authorized user: A person or organization with permission to access Medhandy under an account and role assigned by the platform owner or a healthcare institution.

We may collect the following categories of information:

• Personal information: Name, phone number, email address, gender, date of birth, address, and identification details where needed.
• Health information: Medical history, diagnoses, allergies, prescriptions, immunizations, laboratory reports, radiology reports, referral notes, admissions, clinical notes, and treatment history.
• Technical information: Device details, browser data, IP address, cookies, login timestamps, session data, and activity logs.
• Institution information: Hospital name, license information, staff accounts, departments, and workflow settings.
• Operational information: Appointments, ward occupancy, bed assignments, discharge events, payments, billing records, and audit events.

We aim to collect only what is needed to deliver the service, support care, and maintain accountable system operation.

• Provide healthcare technology services and manage patient records.
• Support referrals, continuity of care, admissions, discharge, and care coordination.
• Authenticate users and restrict access based on role and authorization.
• Prevent fraud, abuse, unauthorized access, and security incidents.
• Generate reports, analytics, and audit trails for clinical and operational review.
• Improve platform performance, reliability, and user experience.
• Meet legal, contractual, and regulatory obligations.

Depending on the context, Medhandy may process data on one or more of the following bases:

• User or patient consent where required by law or policy.
• Healthcare delivery and continuity of care.
• Legal obligations and regulatory requirements.
• Public health or safety needs.
• Legitimate business interests such as security, service delivery, and support.

We may share information only as needed to deliver care, operate the platform, or comply with law. We do not sell patient information.

• Authorized hospitals, clinics, laboratories, pharmacies, and HMOs involved in care or claims handling.
• Treating physicians, nurses, and other authorized clinical staff.
• Government agencies or regulators where disclosure is required by law.
• Service providers such as hosting, messaging, support, monitoring, and payment vendors under contractual safeguards.

All access should follow role-based permissions and, where applicable, hospital consent rules and disclosure policies.

We use safeguards intended to protect sensitive healthcare data, including:

• Encryption in transit and, where implemented, encryption at rest.
• Role-based access control and least-privilege access patterns.
• Audit logs and monitoring for suspicious activity.
• Secure infrastructure, configuration management, and controlled deployment practices.
• Authentication controls, including token-based sessions and optional multi-factor processes where supported.
• Regular security testing and incident review.

We may use cookies or similar technologies for:

• Authentication and session management.
• Security and fraud prevention.
• Product analytics and performance improvement.

Users can usually control cookie behavior through browser settings, but disabling essential cookies may affect login and core workflow functionality.

We retain data for as long as needed to provide the service, support care, maintain audit trails, satisfy legal obligations, resolve disputes, and preserve records required by a hospital or healthcare law.

Medical records may be retained longer than ordinary account data because healthcare records often have special legal and operational retention requirements.

If information is processed or stored outside Nigeria, we should explain where that occurs and what safeguards are in place, such as contractual protections, access restrictions, or approved infrastructure providers.

Cross-border processing should not reduce the level of protection expected for sensitive healthcare data.

Records for minors or vulnerable patients should be handled in accordance with local law, guardian consent requirements, and the responsible hospital's safeguarding policy.

• Access records subject to authorization and legal limits.
• Request corrections to inaccurate data where supported.
• Download or export records where the deployment allows it.
• Withdraw consent where consent is the processing basis and where withdrawal is legally possible.
• Request deletion subject to mandatory retention obligations.
• Lodge privacy complaints or request review of access concerns.

If a breach occurs, Medhandy should detect, contain, investigate, remediate, and where required notify affected parties and regulators. Incidents should be reviewed to reduce recurrence and improve controls.

• Privacy email: support@medhandy.net
• Support email: support@medhandy.net

We may update this policy to reflect product changes, legal changes, or operational changes. Significant updates should be communicated through the app, email, or another appropriate notice channel.