Legal
Privacy Policy
Last updated 10 November 2026
This policy explains what Clinic SaaS collects when you visit this site or run a clinic on the platform, why, and what happens to it. There are two audiences here: clinics, who have accounts with us, and patients, whose health information a clinic records through the platform.
1.What we collect from clinics
- Signup details — clinic name, owner name, email, phone, the subdomain you chose, the plan you picked and, if you gave one, a billing address.
- Staff accounts — the doctors, reception, lab and accounts staff you add, their roles and permissions, and sign-in activity.
- Billing records — subscription invoices, payment attempts and their references. Card and mobile-money details are handled by the payment provider; we do not store them.
- Technical data — server logs (IP address, browser, pages requested, timestamps) and error reports, used to keep the platform running.
2.Patients' information in a clinic
A clinic records its patients’ details through the platform: name, mobile number, age or date of birth, appointments, visit notes, vitals, diagnoses, prescriptions, lab results and uploaded reports, and invoices.
The clinic decides what is recorded and why; we hold it on the clinic’s behalf and use it only to run the service for that clinic. We never sell it, never use it for advertising, and never combine one clinic’s patients with another’s. A patient with a question about their own records should ask the clinic first; we will help the clinic answer.
Patients who book online sign in with their mobile number and a one-time code. We send that code, and the clinic’s appointment messages, by SMS. Messages never contain results, diagnoses or medicines.
3.Why we use it
- To provide the service: bookings, consultations, prescriptions, lab and billing.
- To bill the clinic for its subscription and send invoices and receipts.
- To send the messages a clinic has switched on: confirmations, reminders and report notices.
- To keep the platform secure, investigate faults and prevent abuse.
- To meet our legal obligations.
5.Where data lives and how long we keep it
Every clinic has its own database; its patients’ records are never stored in the same tables as another clinic’s. Backups are encrypted and kept for a limited period.
While a clinic is subscribed, its data is kept for as long as the clinic keeps it. When a subscription ends, the clinic can export its data during the grace period; after that the clinic’s database is deleted, keeping only the billing records the law requires us to keep.
7.Your rights
Clinics can view, correct and export their data from the portal, and ask us to delete their account. Patients can ask their clinic for a copy of their records or for corrections; the clinic can do this from the portal.
8.Security
Connections are encrypted. Passwords and one-time codes are hashed; gateway and SMS credentials a clinic enters are stored encrypted. Lab reports are kept in private storage and only shown to signed-in staff with permission and to the patient themselves. Staff only see what their role allows, and access to clinical records is logged.
9.Changes and contact
We will post changes here and, for material ones, tell clinics by email. Questions: support@mostofa.me or the contact page.