Privacy Policy
Last updated: 10 July 2026 · Effective: 10 July 2026
1. Who We Are
MedOps ("we", "us", "our") is a healthcare management platform operated by MedOps Technologies Ltd, registered in the Federal Republic of Nigeria (RC 1234567). We process personal data and Protected Health Information (PHI) on behalf of hospitals, clinics, and healthcare organisations ("Customers") that subscribe to our platform. Questions: privacy@medops.io.
2. Data We Collect
We collect: (a) Account data — name, email, phone, job title, organisation details provided at registration. (b) Clinical data — patient records, appointment history, billing records, clinical notes uploaded by your organisation. (c) Usage data — pages visited, features used, session duration, error logs. (d) Device data — IP address, browser type, operating system, and timezone. (e) Communications — support tickets and emails you send us. We do not collect data beyond what is necessary for the services described herein.
3. Legal Basis for Processing
We process personal data under the following lawful bases: Contract — processing necessary to deliver the platform services you have subscribed to. Legitimate interests — security monitoring, fraud prevention, and product improvement. Legal obligation — compliance with HIPAA, GDPR, NDPA, and applicable Nigerian law. Consent — where we have obtained your explicit opt-in, including for marketing communications and AI model improvement. You may withdraw consent at any time without affecting prior processing.
4. How We Use Your Data
Account and clinical data is used solely to: deliver and operate the MedOps platform, authenticate users and enforce access controls, generate reports and audit logs for your organisation, provide customer support, comply with legal obligations, and (where opted-in) improve AI features using anonymised aggregates. We do not sell personal data. We do not use your clinical data to train AI models without your explicit written consent.
5. Data Sharing & Third-Party Processors
We share data only with sub-processors required to operate the platform: Supabase Inc. (database hosting and authentication — servers in the EU/US), Cloudflare Inc. (R2 object storage and CDN — global edge), Paystack (payment processing for Nigerian users), Stripe Inc. (payment processing for international users), Resend (transactional email delivery). All sub-processors are bound by data processing agreements. A full list of sub-processors is available on request at privacy@medops.io.
6. International Data Transfers
Your data may be processed in the United States, European Union, or other jurisdictions where our sub-processors operate. For transfers from the EU/EEA, we rely on Standard Contractual Clauses (SCCs) approved by the European Commission. For Nigerian data, transfers are subject to the NDPA 2023 cross-border transfer provisions. Enterprise customers may request data residency pinned to Nigeria, EU, or US regions.
7. Data Retention
Account data is retained for the duration of your subscription plus 90 days to allow re-activation. Clinical data is retained for the duration of your subscription plus 30 days post-termination for export. After this window, data is permanently and irreversibly deleted from all storage layers including backups. Audit logs are retained for 7 years as required by HIPAA. You may request early deletion for GDPR/NDPA right-to-erasure purposes subject to our legal retention obligations.
8. Your Data Subject Rights
Depending on your jurisdiction, you have the right to: Access — request a copy of personal data we hold about you. Rectification — correct inaccurate or incomplete data. Erasure — request deletion (subject to legal retention periods). Portability — receive your data in a structured, machine-readable format. Restriction — limit how we process your data in certain circumstances. Objection — object to processing based on legitimate interests. Withdraw consent — at any time, where consent is the lawful basis. To exercise any right, contact privacy@medops.io. We will respond within 30 days.
9. Cookies & Tracking
MedOps uses only strictly necessary cookies for authentication session management (HTTP-only, secure, SameSite=Strict). We do not use advertising cookies, third-party analytics trackers, or fingerprinting technologies. No data is shared with ad networks. If we add optional analytics cookies in the future, we will update this policy and request your consent.
10. Security
We protect your data with: AES-256 encryption at rest (Supabase managed encryption + Cloudflare R2). TLS 1.3 encryption in transit on all endpoints. Row-Level Security (RLS) enforced at the database layer — users can only access data within their organisation. Role-Based Access Control with least-privilege enforcement. Penetration testing every 6 months by an independent third party. 24-hour critical vulnerability patching SLA. Security incidents are reported to affected customers within 72 hours of discovery.
11. Children's Data
MedOps is a B2B platform for licensed healthcare facilities and is not directed at individuals under 18. We do not knowingly collect personal data directly from minors. Patient records for minors are processed by your organisation as the Data Controller under your clinical and legal obligations. If you believe we have inadvertently collected data from a child, contact privacy@medops.io immediately.
12. Changes to This Policy
We may update this Privacy Policy to reflect changes in our practices or legal requirements. We will notify you by email and in-app banner at least 14 days before material changes take effect. The "Last updated" date at the top of this page reflects the most recent revision. Archived versions are available on request.
13. Contact & Complaints
Data protection enquiries: privacy@medops.io. HIPAA / BAA requests: compliance@medops.io. Nigerian NDPA complaints may also be directed to the Nigeria Data Protection Commission (NDPC) at ndpc.gov.ng. EU/EEA users may lodge complaints with their local supervisory authority. We are always happy to resolve concerns directly before formal escalation.