Privacy Policy

What we collect

To operate a document request, we collect: a patient's name and, if provided, phone number and email; the documents a patient uploads in response to a request; and account details for clinic staff (name, email, role). Every action on a request — creation, upload, download, deletion — is logged with a timestamp for audit purposes.

This is "special personal data"

Ghana's Data Protection Act, 2012 classifies health-related information as special personal data, alongside categories like race, religion, and criminal record — it requires explicit consent or another valid legal basis before it can be processed. That's why the patient upload page requires an explicit consent step before any file can be uploaded, rather than treating a click on the link as consent by itself.

Why we collect it

Solely to let a clinic request and receive documents from a patient, and to keep an audit trail of who sent and accessed what. We do not use this data for advertising, and we do not sell it.

Where it's stored, and who processes it

MedSwyft acts as a data processor on behalf of each clinic (the data controller — see below). We use a small number of sub-processors to run the service:

As of this writing, Ghana's 2012 Act has no data localization requirement — data may lawfully be processed outside Ghana. A draft 2025 Data Protection Bill under public consultation would introduce a preference for keeping personal data in Ghana where feasible, with stricter rules for a narrower set of highly sensitive categories. We're watching this and will update this policy — and evaluate Ghana-based hosting — if the law changes.

If you run a clinic: your obligations as data controller

Using MedSwyft doesn't change who's legally responsible for your patients' data — that's your clinic, as the data controller, under Ghana's Data Protection Act. In particular:

• Your clinic is required to register with Ghana's Data Protection Commission as a data controller within 20 days of starting to process personal data, and renew that registration every 2 years. Operating unregistered can mean a fine, up to 2 years' imprisonment, or a Commission stop-order barring further processing. Register at app.dataprotection.org.gh — the Commission can also be reached at info@dpc.gov.gh.
• You're responsible for having a lawful basis (typically patient consent) for each document request you create.
• We're happy to provide a data processing agreement or answer a compliance question — reach us at info@medswyft.com.

How long we keep it

Uploaded documents are kept for 1 year after upload, then automatically and permanently deleted. Ghana's Data Protection Act doesn't set a fixed retention limit — it requires retention to match the actual purpose data was collected for. That purpose here is supporting a patient's ongoing care, not just a one-off hand-off, which is why the window is a year rather than days. Account and audit-log records are kept only as long as needed to operate the service and meet legal obligations.

Your rights

Under the Data Protection Act, 2012, you can ask to see what data we hold about you, ask us to correct it, or ask us to delete it where we're not required to keep it. Contact your clinic directly, or reach us at info@medswyft.com.

Security

Documents are stored encrypted, access is scoped so a clinic only ever sees its own patients' data, and every patient upload link is a unique, expiring, single-purpose token rather than a password. If a security incident affecting your data ever occurs, we will notify affected clinics without undue delay.

Complaints

You can lodge a complaint with Ghana's Data Protection Commission at dataprotection.org.gh or +233 25 630 1533.