Privacy Policy

01Who this policy applies to

The Website is public. The Platform is used by healthcare organizations, such as dental clinics, medical clinics, hospitals, and multi-branch healthcare organizations, and by their staff. Which parts of this policy matter to you depends on who you are.

“Personal information” in this policy means information that identifies, or relates to, an identifiable person.

For information that we collect about website visitors, and for the account details of the people who use the Platform, MedNexa decides how the information is used, as this policy describes. For patient and other health information that an organization enters, the organization decides what to enter and why, and MedNexa handles that information on the organization’s behalf to provide the Platform.

If you are a patient of a healthcare organization that uses MedNexa, that organization, not MedNexa, is your healthcare provider and is responsible for its records about you. See Your rights and choices.

02Website visitors and demo requests

You can browse the Website without giving us any personal information. If you submit the contact or demo request form, we collect:

• your full name;
• your organization’s name;
• your email address;
• your phone number, if you choose to give one;
• your organization type;
• the number of branches, if you choose to select a range; and
• any message you choose to write.

We use this information to respond to your request, arrange and give a demo, understand your organization’s needs, and follow up with you about MedNexa. Please do not include patient or other health information in your message. The form is not meant for it.

To help keep the form secure and to limit automated or repeated submissions, we may use technical information, such as your IP address, on a temporary basis. Our hosting infrastructure may also keep standard technical logs.

We do not sell your personal information and we do not use it for third-party advertising. For cookies and analytics on the Website, see Cookies and analytics.

03Account and user information

This section applies to people who have a MedNexa account, such as administrators, doctors and other clinicians, reception, billing, and other staff. We process:

• your name, work email address, and phone number;
• your role, department, and the branches you are assigned to, and the permissions attached to your role;
• staff details your organization chooses to record, such as joining date, licence number, specialization, and duty roster entries;
• your sign-in credentials and account status, including whether a temporary password still needs to be replaced; and
• information about how you use the Platform, such as the branch you are currently working in.

In most cases your organization’s administrator creates your account and provides these details. We use them to create and manage your account, verify your identity when you sign in, apply the roles and permissions your organization has set, keep the Platform secure, and provide support. Your organization’s administrators can see the account information of the users in their organization.

04Organization and branch information

To set up and run an organization on the Platform, we process information about the organization and its branches, such as:

• the organization’s name, contact email, phone number, address, and logo;
• each branch’s name, code, address, contact details, and status; and
• which users belong to the organization and to which branches, and how roles and permissions are configured.

We use this information to keep each organization’s records separate from every other organization’s, to show each user the information for the branches they are allowed to work in, and to provide and support the Platform. This information is mostly business information, but it can include personal information of the people named as contacts.

05Patient and health information

Healthcare organizations enter information about their patients into the Platform. We refer to everything an organization enters or generates through its use of the Platform as “Customer Data”. Patient and health information in Customer Data can include:

• Patient details: name, phone number, email address, date of birth, gender, address, blood group, emergency contact, medical notes, and visit status or history.
• Appointment information: appointment date and time, the clinician’s name, the type of appointment, its status, and notes.
• Billing information about a patient’s care, described in Billing and payment-related information.

What this means in practice:

• The organization decides what patient information to enter, why, and who in the organization can see it. MedNexa does not collect this information from patients directly, and we do not review it for accuracy or clinical correctness.
• MedNexa is not the patient’s healthcare provider. The organization and its clinicians are responsible for the care they provide and for what they record.
• We handle this information only on the organization’s behalf, to provide, maintain, secure, and support the Platform, and where the law requires. We do not sell it, and we do not use it to market or advertise to patients.
• Only authorized users of that organization can see it, according to the roles and branch permissions the organization sets. See Organization and branch access controls.

Health information is sensitive. Organizations are responsible for entering it lawfully and only as needed. See Customer responsibilities for patient information.

06Billing and payment-related information

Records organizations keep for their patients. The Platform lets an organization record invoices and payments. That can include the patient’s name and phone number on an invoice, the services billed with quantities and prices, discounts and taxes, the amount paid, the payment method staff recorded, payment dates, and notes. The Platform is a record-keeping tool for the organization. We do not currently process card or other payments for organizations through it, and it is not designed to store payment card numbers. Organizations should not enter full card numbers or security codes.

Fees for MedNexa itself. For organizations that subscribe to MedNexa, we may collect billing contact details and the information needed to invoice them, as set out in their agreement with us.

07Device, log, and security information

When you use the Website or the Platform, we may collect technical information such as your browser and device type, IP address, the pages or screens you view, the date and time of activity, and security-related events, such as sign-in activity. We use it to operate the service, keep it secure, detect and prevent misuse or fraud, troubleshoot problems, and meet legal obligations. Our hosting and infrastructure providers may also keep standard technical logs.

08Cookies and analytics

Website. The public Website does not currently set cookies of its own, and it does not use analytics or advertising tools.

Platform. When you sign in, we use cookies that are necessary to keep you signed in securely and to remember the branch you are working in. You can control cookies in your browser settings, but blocking these cookies may stop you from signing in.

If we begin using other cookies or analytics tools, we will describe them here and update this policy.

09How we use information

We use personal information to:

• provide, operate, and maintain the Website and the Platform;
• create and manage accounts and authenticate users;
• apply each organization’s roles, branch permissions, and separation from other organizations;
• respond to demo requests, questions, and support requests;
• keep the service secure, prevent misuse, and troubleshoot problems;
• send you service and security notices and other messages related to your account or request;
• understand how the Website and the Platform are used, and improve them; and
• meet legal obligations and protect our rights.

We do not use patient information for our own marketing or advertising.

10How we share information

We share personal information only in these ways:

• With your organization. An organization’s administrators can see the account information of its users, and patient information stays within the organization’s authorized users.
• With service providers that help us run the Website and the Platform, as described below.
• Where the law requires it, or to protect the rights, safety, or security of people, MedNexa, or the Platform.
• In a business change, such as a merger, acquisition, or sale of assets, subject to appropriate protections for the information.
• With your consent, or at your direction.

We do not sell personal information.

11Service providers and infrastructure

We use third-party providers for services such as cloud hosting, database storage, and authentication infrastructure. They process information on our behalf so that we can operate the Website and the Platform, and they are expected to protect it and to use it only for those services. Information may be stored and processed in locations where we or our providers operate. Where the law requires it, we take steps intended to protect information that is transferred between locations.

12Security measures

We use safeguards designed to protect information in the Platform, including:

• Role-based access. What each person can see and do depends on the role their organization gives them.
• Organization isolation. Each organization’s records are kept separate from those of every other organization.
• Branch-level permissions. Staff can be limited to the branches they work in.
• Secure authentication. Each person has their own account, sign-in is required to use the Platform, and temporary passwords must be replaced at first sign-in.

Security is a shared responsibility. Organizations and users must protect their credentials, set roles and branch access appropriately, and remove access for people who no longer need it. If you think your account has been compromised, or you find a security problem, tell us right away at [email protected].

No method of storage or transmission is completely secure, and we cannot guarantee absolute security. Nothing in this policy is a statement that MedNexa meets any particular legal, regulatory, or certification standard.

13Organization and branch access controls

Access to information in the Platform is controlled by the organization that owns it:

• Each organization’s administrators decide who has an account, which role each person has, and which branches each person can access.
• Users see the information their role and branch assignments allow, and users cannot see other organizations’ information.
• The organization, not MedNexa, decides which of its own staff may see patient information, and is responsible for keeping those settings accurate and for removing access when someone leaves or changes role.

14Data retention

We keep information for as long as we need it for the purposes in this policy, and then delete or anonymize it, unless the law requires us to keep it.

• Demo and contact requests are kept for as long as needed to respond to you and follow up, and for reasonable business records.
• Account and organization information is kept while the account or organization is active and as needed afterwards, for example to resolve disputes or meet legal obligations.
• Customer Data, including patient information, is kept for as long as the organization keeps it in the Platform and its agreement with us is in place. What happens to it after the agreement ends is set out in our Terms & Conditions and the organization’s agreement.
• Technical and security logs are kept for as long as needed to keep the service secure and to troubleshoot problems.

Organizations decide what patient information they keep in MedNexa and may have their own record-keeping obligations.

15Data deletion requests

• Website visitors: email us at [email protected] and we will delete the information from your contact or demo request, unless we need to keep it to meet a legal obligation.
• Users of the Platform: ask your organization’s administrator, or contact us. Some account information must be kept while your organization is using the Platform.
• Organizations: an authorized administrator can ask us to delete the organization’s data by emailing [email protected], subject to the organization’s agreement with us and its own record-keeping obligations.
• Patients: the healthcare organization that holds your records controls them. Please contact that organization. If you write to us instead, we will point you to it and, where we can, help it respond.

We may need to verify your identity before acting on a request, and we may keep information that the law requires us to keep.

16Your rights and choices

Depending on where you live and the law that applies, you may have rights over your personal information, such as the right to access it, correct it, delete it, restrict or object to certain uses of it, withdraw consent you have given, or complain to a regulator. To make a request about information that MedNexa holds for its own purposes, such as a demo request or your account details, contact us at [email protected]. We will respond as applicable law requires.

If your information is Customer Data held by a healthcare organization (for example, you are a patient), please contact that organization directly, because it controls that information. We support organizations in responding to requests as our agreement with them provides.

17Customer responsibilities for patient information

Healthcare organizations that use MedNexa are responsible for the Customer Data they enter and for how they use it. This includes:

• having a lawful basis, and giving any notices or getting any consents that are required, to collect and use patient and staff information;
• entering only the information they need, keeping it accurate and up to date, and not entering payment card numbers or other information the Platform is not meant to hold;
• setting roles and branch permissions appropriately, creating and removing accounts, and making sure only authorized people can see patient information;
• responding to requests from patients and other individuals about their information;
• complying with the laws that apply to them, including laws about health information, privacy, and record-keeping; and
• the care they provide. MedNexa does not review, verify, or take responsibility for clinical decisions or records.

18Children's privacy

The Website and the demo request form are not directed to children, and we do not knowingly collect personal information from children through them. If you believe a child has given us personal information, contact us at [email protected] and we will take appropriate steps.

Healthcare organizations may keep records about patients of any age in the Platform. Those organizations are responsible for handling such records lawfully.

19Third-party links and services

The Website or the Platform may link to, or work with, services that are run by other parties. We do not control those services and this policy does not cover them. Please read their own privacy notices before you give them any information.

20Changes to this policy

We may update this policy from time to time. When we do, we will post the updated version on this page. If a change is significant, we will take reasonable steps to let you know. Continuing to use the Website or the Platform after an update means you accept the updated policy.

21Contact us

For privacy questions, deletion requests, or security concerns, contact MedNexa at [email protected].