The short version: patient records belong to the healthcare facility that created them. We store and process them only to run Dawa EMR. We never sell data, never use patient data for advertising, and protect everything with per-facility isolation, role-based access, audit logs, and encryption in transit.
1. Who this covers
This policy is issued by med-yx (Medical Enterprise & Distribution), Republic of South Sudan, the operator of Dawa EMR. It covers three groups of people:
- Website visitors — people browsing this site or requesting a demo.
- Facility staff — the doctors, nurses, and administrators with Dawa EMR accounts.
- Patients — whose medical records are entered into Dawa EMR by their facility.
2. Patient records — the most important part
- The facility is in charge of its patients' records; we process them on the facility's behalf and on its instructions, solely to provide the service. We do not decide what patient data is collected — the treating facility does.
- Strict isolation: each facility's data is separated from every other facility's. Staff at one facility can never see another facility's patients.
- Role-based access: staff see only what their role requires — a receptionist does not see clinical notes; a pharmacist sees prescriptions, not full histories.
- Audit trail: every access and change is logged (who, what, when) and the log cannot be edited.
- Never sold, never marketed: patient data is never sold, shared with advertisers, or used to train anything. It is disclosed outside the facility only if the law requires it.
- Retention: clinical records are never hard-deleted while the facility uses the service; on termination they are exported to the facility and then disposed of in line with applicable medical-records law.
3. Facility staff accounts
For each staff account we store: name, username, role, department, and optionally email and phone — provided by the facility's administrator. We use this to run the account, enforce permissions, and keep the audit trail. Passwords are stored only as secure one-way hashes; nobody, including us, can read them.
4. Website visitors and demo requests
- The Request a Demo form collects the details you type (name, facility, role, contact, message). We use them only to respond to your request and keep them only as long as needed for that.
- This website sets no advertising or tracking cookies. The Dawa EMR application uses one session cookie whose only job is keeping you logged in.
5. How data is protected
- All traffic between your device and Dawa EMR is encrypted (HTTPS/TLS).
- Data is hosted on secure, professionally managed cloud infrastructure with automatic backups.
- Access is protected by individual accounts, role-based permissions, rate limiting, and forced password changes for new accounts.
- Backups are taken automatically so records survive device loss or failure at the facility.
6. Where data is stored
Dawa EMR is hosted on cloud infrastructure which may be located outside South Sudan. Wherever it is stored, the protections in this policy apply, and the facility's ownership of its records is unaffected.
7. Your rights
- Patients: requests to see or correct your medical record should go to your healthcare facility — they hold your record and can act on it in Dawa EMR. We support facilities in honouring such requests.
- Staff and website visitors: you may ask us what personal information we hold about you, ask for corrections, or ask for deletion (where the law does not require us to keep it) at dawaemr@med-yx.com.
8. If something goes wrong
If we become aware of a breach affecting a facility's data, we will inform that facility's administrator without undue delay, explain what happened, and what we are doing about it.
9. Changes
We will update this policy as the service and the law evolve. Material changes are notified to facility administrators. The "last updated" date at the top always tells you the current version.
10. Contact
Privacy questions or requests: dawaemr@med-yx.com.