Privacy Policy

Medly is a product of Vertex Labs Ltd. In this policy, “Medly”, “we” and “us” mean Vertex Labs Ltd.

This policy covers:

• this website, medly.africa, including the founding cohort application form;
• the Medly web app that clinic and hospital staff use; and
• the Medly patient app for Android and iPhone.

Medly is available to clinics in Nigeria and Kenya. We follow the data protection law of the country where the clinic is:

• Nigeria: the Nigeria Data Protection Act 2023, the regulations and directives of the Nigeria Data Protection Commission, and the National Health Act 2014.
• Kenya: the Data Protection Act 2019 and its regulations, overseen by the Office of the Data Protection Commissioner, and the Digital Health Act 2023.

When a clinic or hospital uses Medly, the clinic is the data controller for its patients’ records. It decides what is recorded and who can see it. Medly is a data processor: we store and process those records only on the clinic’s instructions, under a written data processing agreement.

Medly is the data controller for information we collect for our own purposes: applications through this website, staff and patient app accounts, patient identity verification, and the aggregated insights described below.

If you are a patient and want to see, correct or delete your medical records, contact your clinic first. We will help them respond.

From this website

• What you enter in the application form: your name, role, clinic name and type of practice, country, state and city, the plan you’re interested in, the clinic’s licence number and CAC or business registration number, email address, phone number, preferred web address and anything you write to us. We use the licence and registration numbers to check the clinic with its regulator, and the type of practice to know which regulator to check with and which kinds of clinics use Medly. We keep applications in our own systems so we can follow up, and hold a preferred address for 30 days.
• Basic technical information our servers record for security, such as your IP address, browser type and the pages you request.

From clinic and hospital staff

• Name, role, email, phone number and the clinic you work for.
• A record of what you do in Medly, such as which patient records you open or change, for the clinic’s audit log.

Patient records, entered by your clinic

• Identity and contact details, such as name, date of birth, sex, phone number and hospital number.
• Health information, such as visits, diagnoses, vital signs, prescriptions, lab results and appointments.

From the patient app

• Your email address and name, used to sign you in and to address you.
• Which clinics your records are linked to, and whether you share records between them.
• Medicines you add yourself, the reminder times you set, and doses you mark as taken or skipped. Clinics you are linked to can see the medicines you add.
• Allergies you add, and what happens when you are exposed. Each clinic you are linked to receives them and keeps what it was told, even if you later remove one, unlink the clinic or delete your account.
• Appointments you ask for and the reasons you give.
• The type of phone and app version you use, and a device token so we can send you notifications.

• To provide Medly to clinics and their patients: keeping records, booking appointments, delivering results and sending reminders. Lawful basis: our contract with the clinic and, for health information, its use in providing health care.
• To connect your records across clinics: a clinic’s record is linked to your app only when you show the clinic a one-time code from the app. Once you have linked more than one clinic, they see your allergies, diagnoses, medicines and lab results from each other. Doctors’ notes are not shared. Sharing is on from the start, and you can turn it off in the app at any time, under You. Lawful basis: its use in providing your health care, by health professionals who must keep it confidential.
• To respond to your application and arrange calls. Lawful basis: steps you asked us to take before entering a contract.
• To keep Medly secure, investigate misuse and keep audit logs. Lawful basis: our legitimate interests and legal obligations.
• To improve Medly, for example by finding which screens are slow. We use the minimum information needed.
• To create aggregated insights, only where a clinic has opted in. See the next section.
• To meet legal obligations, such as responding to lawful requests from authorities in Nigeria or Kenya.

We do not use personal information for advertising, and we do not make automated decisions that have legal or similarly significant effects on you.

Aggregated insights are statistics that combine information about many patients, for example how often malaria tests came back positive across clinics in Lagos in a given month. We may sell or license these insights to organisations such as public health bodies, researchers, insurers and pharmaceutical companies.

We only do this under these rules:

• Opt-in only. We only use data from clinics that have agreed to it in writing. A clinic can withdraw at any time, and its data is left out of insights we create after that.
• Never individual records. We do not sell, rent or share patient records, or any data about a single patient, even with names removed.
• No small groups. We do not publish or sell any figure based on fewer than 20 patients, so no one can be picked out.
• No identifying details. Names, phone numbers, hospital numbers, exact dates of birth, addresses and similar details are removed before any analysis.
• No re-identification. We do not try to identify anyone from insights, and every buyer must agree in writing not to try either.

Insights that meet these rules cannot identify you, so they are not personal data under Nigerian or Kenyan data protection law.

We share personal information only with:

• Your clinic, for patient app data that is part of your care, such as appointments and self-reported medicines.
• Your other linked clinics, which see your allergies, diagnoses, medicines and lab results from each other so they can treat you safely. Doctors’ notes are not shared. Sharing is on from the start, and you can turn it off in the patient app at any time.
• An identity verification provider, licensed by Nigeria’s National Identity Management Commission, only to check a NIN you give us.
• Service providers that help us run Medly, such as cloud hosting, email and push notification providers. They may only use the information to provide their service to us, under written contracts. Our service providers page lists each one, what it does and where.
• Authorities, when the law of Nigeria or Kenya requires it.
• A new owner, if Vertex Labs Ltd is sold or merged. This policy, or one at least as protective, would continue to apply.

We never sell personal information.

Medly’s data is stored with our cloud hosting provider. For clinics in Kenya, we also keep a complete, up-to-date copy of the clinic’s records in a data centre in Kenya, as Kenyan law requires for health care records.

When personal data is stored or processed outside the country it comes from, we use the safeguards that country’s law requires: contract terms accepted by the Nigeria Data Protection Commission, or the standard clauses issued by Kenya’s Data Protection Commissioner.

• Data is encrypted between devices and our servers, and encrypted where it is stored.
• Staff see only what their role needs, and every time someone opens or changes a patient record is logged.
• Our own team accesses clinic data only when needed to support that clinic, and those accesses are logged too.
• If a breach affects your personal information, we tell the clinic within 24 hours of finding out. The clinic, or we where we are responsible, report it to the Nigeria Data Protection Commission or Kenya’s Data Protection Commissioner within 72 hours, and tell you where the law requires.

• Applications that do not lead to an agreement are deleted after 24 months.
• Patient records are kept for as long as the clinic instructs and the medical records law of its country requires. When a clinic leaves Medly, we give it a complete copy and then delete ours.
• Patient app accounts are deleted when you ask us to. Records a clinic already holds, including home readings you sent it, stay with that clinic; deleting your account only stops new information from reaching it.
• Security logs are kept for up to 12 months.

Under Nigerian and Kenyan data protection law you have the right to:

• be told how your personal information is used, as this policy does;
• get a copy of your personal information;
• have inaccurate information corrected;
• have information deleted, or its use restricted, in certain circumstances;
• object to how we use it, and withdraw consent where we rely on consent;
• receive your information in a format you can take elsewhere; and
• complain to your data protection regulator: the Nigeria Data Protection Commission in Nigeria, or the Office of the Data Protection Commissioner in Kenya.

To use these rights, email hospitals@medly.africa. For medical records, we pass your request to your clinic, which controls those records, and help it respond. We give you a copy of your information within 7 days, and make corrections or deletions within 14 days.

Clinics may keep records for patients under 18. Patient app accounts for children are managed by a parent or guardian, whose consent we rely on. We do not knowingly let children under 18 create their own accounts.

This website does not use advertising or tracking cookies. The Medly web app uses cookies only to keep staff signed in securely. If that changes, we will update this policy and ask for consent where the law requires it.

If we make a meaningful change, we will update the date at the top of this page and tell clinics and app users before it takes effect. We will never start using data in a way this policy rules out without asking first.

Questions or requests: hospitals@medly.africa