1.Who we are
HealthcareOS makes software that healthcare facilities use to run their work: patient records, queues, pharmacy, inventory, wards, laboratory, billing and insurance claims.
This policy covers the HealthcareOS website and the HealthcareOS app. “HealthcareOS”, “we” and “us” mean the company that provides them; “you” means anyone who visits the website or uses the app.
2.Our role, and your facility’s
Patient records belong to the facility. When a hospital, clinic, pharmacy or laboratory uses HealthcareOS, it decides what patient information to record and why. For that information the facility is the data controller and HealthcareOS is its data processor: we handle it only on the facility’s instructions, and only to provide the service.
If you are a patient and want to see, correct or ask about your record, please contact the facility that treated you. We will help them answer you.
Everything else is ours to look after. For staff accounts, website visitors and people who contact us, HealthcareOS is the data controller, and this policy applies in full.
3.What we collect
Depending on how you use HealthcareOS, we handle:
- Account details — your name, email address, phone number, role, the facilities you belong to and your sign-in credentials.
- Patient records — what facilities enter about their patients: identity and contact details, NHIS membership, vitals, diagnoses, consultation notes, prescriptions, laboratory requests and results, ward admissions, invoices and claims. This is health data, which the law treats as especially sensitive.
- Activity records — who added, changed or deleted an entry, and when, so each facility keeps a trustworthy history.
- Technical data — your IP address, browser and device type, and logs of requests to our servers, which we need to keep the service running and secure.
- Messages — what you send us when you write to us or ask for help.
We don’t buy personal data from anyone, and we don’t collect more than the service needs.
4.How we use it
We use personal data to:
- Provide the service — signing you in, showing each person what their role allows and keeping each facility’s records apart.
- Send what the service needs to send, such as the one-time codes that confirm a password reset, and messages about your account.
- Keep HealthcareOS secure and reliable — preventing misuse, investigating problems and fixing errors.
- Support facilities — helping with setup, answering questions and acting on their instructions.
- Improve HealthcareOS — if you agree to analytics cookies, by measuring which screens are used.
- Meet our legal obligations.
We rely on our contract with your facility, our legitimate interest in running a secure and reliable service, our legal obligations and, for analytics cookies, your consent. For patient records, the facility is responsible for having a lawful basis, such as providing care.
We never sell personal data, never use patient records for advertising, and never share them with anyone the facility hasn’t authorised, except where the law requires it.
7.How we protect it
We protect personal data with technical and organisational measures suited to health information, including:
- Encrypted connections between your browser and our servers.
- Roles and permissions that decide who can view, add, edit or delete, module by module.
- A separate workspace for each facility, so staff see only the facilities they belong to.
- A record of who did what, and when, against every entry on a patient’s timeline.
- One-time codes that confirm a password reset before anything changes.
Our own staff access a facility’s records only when they need to — to support the facility or keep the service running — and are bound by confidentiality.
Our servers may be in a different country from you or your facility. Wherever data is stored, we require the protection this policy describes and the safeguards the law requires.
No system is perfectly secure. If a breach affects personal data, we will tell the facilities affected and the authorities, as the law requires and without undue delay.
8.How long we keep it
We keep patient records for as long as the facility uses HealthcareOS, or as its instructions and the medical record-keeping laws that apply to it require.
When a facility leaves, we help it take a copy of its records, then delete or anonymise them, unless the law requires us to keep them longer.
We keep account details while the account is open, and technical logs only as long as we need them for security and troubleshooting.
9.Your rights
Data protection law — in Ghana, the Data Protection Act, 2012 (Act 843) — gives you the right to:
- Ask what personal data we hold about you, and get a copy.
- Have inaccurate data corrected.
- Ask us to delete data, or to stop or limit how we use it, where the law allows.
- Object to processing based on our legitimate interests.
- Complain to a data protection authority — in Ghana, the Data Protection Commission.
To use these rights, write to hello@healthcareos.com. For patient records, contact your facility first; we will support them in answering you. We may need to confirm who you are before we act, and we will reply within the time the law allows.
10.Children
HealthcareOS accounts are for facility staff, not children. Facilities may record the care of patients of any age, including children; they do so as data controllers, under the law that applies to them.
11.Changes to this policy
We may update this policy as HealthcareOS or the law changes. We will change the date at the top of this page and, if a change matters, tell facility administrators before it takes effect.
12.Contact us
Questions about this policy, or about how we handle personal data? Write to hello@healthcareos.com.