Privacy policy

Who we are

MediTrac Nigeria is operated by DEVALTER. This policy covers two different things, and the distinction matters. The first is the information this website collects from visitors. The second is patient and staff information held inside a hospital deployment of the MediTrac application.

What this website collects

This website does not use advertising trackers and does not build a profile of you.

The only personal information it collects is what you type into the demonstration booking form: your name, role, hospital, email address, telephone number, preferred appointment time and any note you add.

That form is delivered by Web3Forms, a third-party form service, which passes the submission to our email address. Their handling of that message is governed by their own privacy terms. We use the information solely to contact you about the demonstration you asked for, and we do not sell it or pass it to anyone else.

Patient data inside a hospital deployment

Where a hospital runs MediTrac, the hospital is the controller of its patient records and MediTrac is the processor acting on its instructions. We do not use patient data for our own purposes, and we do not sell, share or mine it.

On an on-premise deployment, patient records and images are held on the hospital’s own servers, inside the hospital’s own network. They do not leave the building unless the hospital chooses to enable a feature that sends them elsewhere, such as offsite backup or remote reporting.

On a cloud deployment, records are held in hosted infrastructure on the hospital’s behalf, encrypted in transit and at rest, with access restricted to the hospital’s own authorised users.

The specific terms for any particular hospital, including retention periods, sub-processors, breach notification timelines and deletion on exit, are set out in the data processing agreement signed with that hospital. That agreement governs, and it is available to review before signature.

Access, audit and staff

Access within the application is granted by role, so staff see what their work requires rather than everything. Changes to records are written to an audit trail recording the user and the time, and sensitive fields are redacted within those logs.

Your rights

Under the Nigeria Data Protection Act you may ask what personal data is held about you, ask for it to be corrected, ask for it to be deleted where the law allows, and object to certain uses of it.

If you are a patient at a hospital that uses MediTrac, that hospital holds your record and is the right first point of contact, because the decisions about it are theirs. We will support them in responding.

If your request concerns information you gave to this website, write to us directly and we will act on it.

Security

Traffic to hosted deployments is encrypted in transit. Access requires authentication, with multi-factor authentication available and enforceable by the hospital. We patch the software we maintain and notify hospitals of updates that carry a security impact.

No system is beyond reach, and we would rather say so plainly than claim otherwise. Our commitment is to detection, honest disclosure and a documented breach response plan rather than to a promise nobody can keep.

Changes to this policy

If this policy changes materially we will update this page. The date below reflects the most recent revision.