Privacy Policy

Medtrix Limited ("Medtrix", "we", "us", or "our") operates a healthcare platform that stores, manages, and transmits protected health information (PHI), electronic health records (EHR), and personally identifiable information (PII). We understand the sensitivity of health data and are committed to protecting it in accordance with HIPAA (Health Insurance Portability and Accountability Act), the Nigeria Data Protection Regulation (NDPR), and other applicable data protection frameworks. This Privacy Policy describes how we collect, use, disclose, retain, and protect your information when you use our website (medtrix.io), mobile applications, USSD services, APIs, and all related services (collectively, the "Platform"). By using the Platform, you consent to the practices described in this Privacy Policy. If you do not agree, you must discontinue use of the Platform immediately.

We collect information in several categories: A. Information You Provide Directly • Account registration data: Full name, email address, phone number, date of birth, gender, password • Medical records: Diagnoses, treatment histories, medications, allergies, immunization records, lab results, radiology reports, surgical histories, vital signs • Consultation data: Doctor-patient consultation notes, prescriptions, referrals, follow-up instructions • Insurance information: Provider name, policy number, coverage details • Financial information: Bank account details (for doctor payouts), transaction records for consultation payments • Professional credentials: Medical license numbers, specialization certifications, facility affiliations (for healthcare providers) • Children's health records: Information about dependents added to your account B. Information Collected Automatically • Device information: IP address, browser type, operating system, device identifiers • Usage data: Pages visited, features used, session duration, click patterns • USSD session data: Session ID, dialed codes, menu selections, timestamps • Location data: Approximate location based on IP address (we do not use GPS tracking) • Cookies and similar technologies: Session cookies, authentication tokens, analytics identifiers C. Information from Third Parties • Healthcare facilities: When a facility adds you as a patient or staff member • Payment processors: Transaction confirmations from Paystack • Communication providers: Call metadata from Twilio (duration, timestamps — not call content)

We use your information strictly for the following purposes: Healthcare Service Delivery • Store, organize, and display your electronic health records • Facilitate doctor-patient consultations via voice call • Process prescriptions and medical referrals • Enable healthcare facility management and staff coordination • Deliver health services via USSD for users without internet access Account Management & Communication • Create and maintain your account • Authenticate your identity and authorize access to health records • Send appointment reminders, consultation confirmations, and medical updates • Respond to support requests and inquiries Payment Processing • Process consultation payments from patients to doctors • Facilitate doctor payout settlements • Generate transaction records and receipts Platform Improvement • Analyze aggregated, de-identified usage patterns to improve features • Monitor platform performance and detect technical issues • Conduct security auditing and threat detection Legal & Regulatory Compliance • Comply with healthcare regulations and legal obligations • Respond to valid legal requests from authorities • Maintain audit logs as required by HIPAA We will NEVER sell, rent, or trade your personal health information to advertisers, data brokers, or any third parties for marketing purposes.

We process your data based on the following legal grounds: • Consent: You provide explicit consent when creating an account and uploading health records • Contract Performance: Processing necessary to deliver the services you requested (consultations, record management) • Legal Obligation: Compliance with healthcare regulations, tax laws, and legal orders • Legitimate Interest: Platform security, fraud prevention, and service improvement (using de-identified data only) • Vital Interest: Emergency health situations where processing is necessary to protect life

Your health data is shared only in these specific circumstances: With Healthcare Providers • When you book a consultation, the assigned doctor receives relevant medical history needed for your care • Facility administrators can access records of patients registered at their facility • Sharing is role-based — nurses, lab technicians, and pharmacists see only what is relevant to their function With Service Providers (Data Processors) • Supabase: Database hosting (SOC 2 Type II certified, data encrypted at rest and in transit) • Google Cloud Platform: Application hosting (ISO 27001, SOC 2, HIPAA BAA compliant) • Paystack: Payment processing (PCI DSS Level 1 compliant) • Twilio: Voice consultation services (HIPAA compliant) • Elastic Email: Transactional email delivery All service providers are bound by data processing agreements that require them to protect your data to standards equivalent to or exceeding our own. With Legal Authorities • When required by valid court orders, subpoenas, or legal processes • To report suspected child abuse or neglect as required by law • To prevent imminent harm or threat to life With Your Explicit Consent • When you authorize sharing with a specific doctor, facility, or family member • You can revoke sharing permissions at any time from your account settings We will NEVER share your data with: • Insurance companies (unless you explicitly authorize it) • Employers • Advertising networks • Data brokers or aggregators

We implement comprehensive security measures to protect your health information: Encryption • AES-256 encryption for data at rest • TLS 1.3 encryption for all data in transit • Encrypted database connections using SSL/TLS Access Controls • Role-based access control (RBAC) — users only see data relevant to their role • Multi-factor authentication available for all accounts • Session management with automatic timeouts • 64-character cryptographic authentication tokens Infrastructure Security • Hosted on Google Cloud Platform with SOC 2, ISO 27001, and HIPAA compliance • Database hosted on Supabase with row-level security policies • Automated vulnerability scanning and dependency monitoring • Regular security patches and updates Monitoring & Auditing • Comprehensive audit logging of all data access events • Real-time intrusion detection and alerting • Regular penetration testing and security assessments • Incident response procedures with defined escalation paths Personnel Security • Security training for all team members with access to systems • Background checks for personnel with access to health data • Principle of least privilege for system access

We retain your data according to the following policies: • Active account data: Retained for as long as your account is active • Medical records: Retained for a minimum of 7 years after last activity, or as required by applicable healthcare regulations (some jurisdictions require up to 10 years for adult records and until age 21 for pediatric records) • Consultation records: Retained for 7 years after the consultation date • Financial/transaction records: Retained for 7 years for tax and audit compliance • Audit logs: Retained for 6 years as required by HIPAA • USSD session data: Retained for 1 year for service improvement • Account deletion requests: Data is de-identified within 30 days; fully purged within 90 days (except where legal retention requirements apply) When data is no longer required, it is securely deleted using industry-standard data destruction methods.

You have the following rights regarding your health information: Right to Access • View and download all your health records, consultation history, and personal data at any time through your dashboard Right to Rectification • Request correction of inaccurate or incomplete personal or medical information Right to Deletion • Request deletion of your account and associated data (subject to legal retention requirements for medical records) Right to Data Portability • Request a copy of your data in a structured, machine-readable format Right to Restrict Processing • Request that we limit how we process your data in specific circumstances Right to Withdraw Consent • Withdraw consent for data processing at any time (this does not affect the lawfulness of prior processing) Right to Object • Object to processing based on legitimate interests Right to Revoke Access • Remove sharing permissions granted to specific doctors or facilities Breach Notification • You will be notified within 72 hours if a data breach affects your personal health information To exercise any of these rights, contact us at privacy@medtrix.com or through your account settings.

When using Medtrix via USSD (phone keypad menus without internet): • USSD sessions are encrypted between your device and our servers via the telecoms provider's secure channel • Session data (menu selections, timestamps) is logged for service delivery and improvement • No health record content is stored on your mobile device — all data remains on our secure servers • USSD sessions automatically timeout after inactivity for your protection • USSD access requires phone number verification to prevent unauthorized access

Medtrix allows parents and legal guardians to manage health records for their children (dependents under 18). • Only verified parents/guardians can add and manage children's records • Children's health data receives the same protection as adult data • We do not knowingly collect data directly from children under 13 without parental consent • When a dependent turns 18, they may request independent control of their health records If you believe a child's data has been collected without proper consent, contact us immediately at privacy@medtrix.com.

Medtrix operates globally and may process data in jurisdictions outside your country of residence: • Our primary infrastructure is hosted in the United States (Google Cloud Platform) • Database services are provided by Supabase with data centers in secure, certified facilities • All cross-border transfers are protected by encryption and contractual safeguards • We comply with applicable data transfer regulations including NDPR requirements for Nigerian users and GDPR principles for European users • Regardless of where your data is processed, we apply the same security standards described in this Policy

We use the following technologies: Essential Cookies • Authentication session cookies (required for login) • Security tokens (CSRF protection) Analytics • We use aggregated, anonymized analytics to understand platform usage • We do NOT use third-party advertising trackers • We do NOT build advertising profiles from your data Live Chat • Tawk.to live chat widget places cookies for chat session management • Chat transcripts are stored securely and used only for support purposes You can manage cookie preferences through your browser settings. Disabling essential cookies may prevent you from using the Platform.

We may update this Privacy Policy to reflect changes in our practices, technology, legal requirements, or other factors. When we make material changes: • We will post the updated policy on this page with a revised "Last Updated" date • We will notify registered users via email for significant changes • Continued use of the Platform after changes constitutes acceptance of the updated policy We encourage you to review this Privacy Policy periodically.