Privacy
Privacy policy, in plain words.
This is a placeholder. It sketches what the policy needs to cover so the real draft can be written against it — it is not legal advice and it is not yet our policy.
Draft placeholder — replace this page with reviewed legal copy before launch.
Who we are
TODO: the operating entity behind MediLounge HMS, its registered address, and how to reach the person responsible for data questions.
What we collect
TODO: marketing-site data (demo request form contents, cookie preferences), and workspace data hospitals enter on behalf of their own patients and staff — clarifying that the hospital is the data controller for its patient records and MediLounge is a processor.
Why we hold it
TODO: the purposes — running the service, billing, support, and contacting demo requesters — each tied to a lawful basis under the regimes that apply (e.g. GDPR, Nigeria's NDPR/NDPA).
Who can see it
TODO: subprocessors (hosting, email, payment providers), the countries data is processed in, and the fact that tenant data is isolated per hospital and never shared between tenants.
How long we keep it
TODO: retention periods per data category, including what happens to a hospital's records after cancellation and the deletion timeline.
Your rights
TODO: access, correction, deletion and portability, and the exact channel for exercising them — plus how a patient of a hospital on MediLounge should route such a request (to the hospital first).
Cookies
TODO: the session cookie, the currency preference cookie, and any analytics — currently the site sets no analytics cookies at all.
Contact
TODO: the contact address and email for privacy questions, and the supervisory authority to complain to.