Privacy Policy

Chwezi Core Systems ("we", "us", or "our"), based at Sserumaga Road, Bukoto, Kampala, Uganda, operates the Medic8 healthcare management platform ("the Service"). This Privacy Policy explains how we collect, use, store, and protect your information when you use our Service.

By accessing or using Medic8, you agree to the practices described in this policy. If you do not agree, please do not use the Service.

1. Information We Collect

We collect the following categories of information:

Personal Information

When you register for an account or contact us, we may collect your name, email address, phone number, job title, and the name of your health facility.

Health Data

As a healthcare management platform, Medic8 processes patient health records, clinical notes, laboratory results, pharmacy dispensing records, and related medical information entered by authorised facility staff. This data is owned by the health facility and processed by us on their behalf.

Financial Data

We process billing records, payment information, insurance details, and transaction histories related to the operation of your health facility.

Usage Data

We automatically collect information about how you interact with the Service, including IP addresses, browser type, device information, pages visited, and timestamps.

2. How We Use Your Information

We use the information we collect to:

• Deliver and maintain the Service — process health records, generate reports, manage billing, and support day-to-day facility operations.
• Improve the Service — analyse usage patterns to enhance features, fix issues, and develop new functionality.
• Communicate with you — send service updates, security alerts, and respond to your enquiries.
• Ensure security — detect fraud, prevent unauthorised access, and maintain the integrity of the platform.
• Meet legal obligations — comply with applicable laws, regulations, and lawful requests from authorities.

3. Data Storage and Security

Medic8 is a cloud-based Software-as-a-Service platform. Your data is stored on secure servers with the following protections:

• Encryption — data is encrypted in transit (TLS 1.2+) and at rest.
• Access controls — role-based access ensures that users can only view and modify data they are authorised to access.
• Regular backups — automated backups protect against data loss.
• Monitoring — continuous monitoring and logging to detect and respond to security incidents.

While we implement industry-standard security measures, no method of electronic storage or transmission is completely secure. We cannot guarantee absolute security but are committed to protecting your data to the best of our ability.

4. Data Sharing

We do not sell your personal or health data to third parties. We may share information only in the following circumstances:

• Service providers — trusted third-party processors who assist us in operating the Service (such as cloud hosting providers), bound by strict data protection agreements.
• Legal requirements — when required by law, regulation, or valid legal process.
• Facility administrators — health facility data is accessible to authorised administrators within that facility.
• With your consent — when you have given explicit permission for a specific purpose.

5. Your Rights

You have the following rights regarding your personal data:

• Access — request a copy of the personal data we hold about you.
• Correction — request correction of inaccurate or incomplete data.
• Deletion — request deletion of your personal data, subject to legal and contractual retention requirements.
• Data portability — request your data in a structured, commonly used format.
• Objection — object to certain types of processing of your personal data.
• Withdrawal of consent — withdraw consent at any time where processing is based on consent.

To exercise any of these rights, contact us at info@chwezicore.com. We will respond within 30 days.

For patient health records, please contact your health facility directly, as they are the data controller for clinical information entered into the system.

6. Cookies and Tracking

Medic8 uses cookies and similar technologies for the following purposes:

• Essential cookies — required for the Service to function (authentication, session management).
• Analytics cookies — help us understand how users interact with the Service so we can improve it.

You can control cookie preferences through your browser settings. Disabling essential cookies may affect the functionality of the Service.

7. Children's Privacy

Medic8 is designed for use by healthcare professionals and facility administrators. We do not knowingly collect personal information directly from children under the age of 18. Where patient records include data about minors, this data is entered and managed by authorised healthcare staff as part of clinical care, and the health facility remains the data controller for such records.

8. International Data Transfers

Chwezi Core Systems is based in Uganda. If you access the Service from outside Uganda, your information may be transferred to and processed in Uganda or other jurisdictions where our servers or service providers are located.

For visitors from the European Union / European Economic Area: We recognise the rights afforded under the General Data Protection Regulation (GDPR). Where we process personal data of EU/EEA residents, we do so on the basis of legitimate interest, contractual necessity, or your explicit consent. We implement appropriate safeguards for international data transfers, including standard contractual clauses where applicable. You may exercise your GDPR rights by contacting us at the address below.

For visitors from other jurisdictions: We comply with applicable local data protection laws. If your jurisdiction requires specific protections for data transfers, please contact us and we will work with you to ensure compliance.

9. Changes to This Policy

We may update this Privacy Policy from time to time. When we make significant changes, we will notify you by email or through the Service. The updated policy will be effective from the date posted at the top of this page. We encourage you to review this policy periodically.

10. Contact Information

If you have questions or concerns about this Privacy Policy or our data practices, contact us at: