Privacy & Policy

1.1 Personal Information

We may collect:

• Name and contact details
• Company information
• Professional role and credentials
• Communication preferences
• Billing and payment information

1.2 Technical Information

• IP addresses
• Browser type
• Device information
• Website usage data
• Cookies and tracking technologies

1.3 Service-Specific Data

For our services like Humigy, we collect:

• Customer interaction data
• Business process information
• Performance metrics
• User preferences and settings

5.1 Website visitors and clinic account holders

If you gave us your own details (for example on our website, or when signing up your clinic), you can ask us to:

• Give you access to your personal information
• Correct it
• Delete it
• Stop sending you marketing communications
• Tell you how your information is used

Write to us using the contact details in section 12.

5.2 Patients

A patient's records are held by the patient's clinic, so the clinic is the first place to ask. A patient can ask the clinic to show them their information, correct it, delete it (the clinic may have to keep some records by law), stop using it for anything that depends on their consent, or deal with a request on their behalf through someone they name.

• How to ask: tell the clinic (the doctor or front desk). The clinic can find the record in Humigy, correct it or mark it deleted, and show the patient what it holds.
• If a patient writes to Humigy instead, we will pass the request to their clinic and help the clinic answer it. We do not act on a patient's records without the clinic's instruction.
• Complaints: if the clinic has not answered, write to the Humigy grievance contact, support@humigy.com. We reply within 7 days.

10.1 Who is responsible

• The clinic decides what patient information to record and why. In law, the clinic is the "data fiduciary" for it.
• Humigy handles that information only to run the service for the clinic, on the clinic's behalf. In law, Humigy is the "data processor".
• For the clinic's own account details (such as sign-up and billing), Humigy is responsible itself.

10.2 On the phone

• iPhone: records are stored in files protected by Apple's highest file protection, so they are unreadable while the phone is locked, and they are excluded from iCloud and computer backups. This is Apple's file protection, not a separate encryption layer added by Humigy.
• Android: records are stored in a database encrypted with SQLCipher. The key is generated on the phone and protected by the Android Keystore. Android backup is switched off for the app.
• To share a prescription PDF, the app makes a temporary copy on the phone and removes it afterwards (on iPhone when the preview closes and at each launch, on Android the next time it is used).
• Signing out removes the clinic's records from the phone. They stay in the clinic's account on Humigy's servers and come back when the person signs in again; if some work has not been sent yet, the app warns before signing out. The records are also removed if the clinic removes the phone's access, and when the app is uninstalled.

10.3 Sending to Humigy's servers

When a doctor or staff member is signed in and the phone is online, the app sends what they save to the clinic's account on Humigy's servers, the same account the clinic uses on the Humigy web app. This includes:

• Patient details: name, gender, date of birth or age, phone number, email and address
• Appointments and notes
• Prescriptions: vitals, observations, diagnosis, tests and medicines
• Photos or scans of documents the doctor chooses to add to a patient's record
• Searches for diagnosis codes (the words typed in the search)

The apps send this only to Humigy's servers, over an encrypted (HTTPS) connection. Work saved while the phone is offline waits on the phone until it can be sent, and the app shows what has not been sent yet.

10.4 Copies for patients

A patient's prescription leaves the phone only when the doctor sends it. There are two ways:

• Send to patient: Humigy's servers send the patient a link by WhatsApp, SMS or email, as the doctor chooses. The link stops working after the number of days the doctor sets (7 by default, from 1 to 30). The doctor can also require a one-time code; this is off by default. These messages pass through the WhatsApp, SMS or email provider that delivers them.
• Share from my phone: the doctor shares the PDF through an app on their own phone, such as WhatsApp or email. The app first asks the doctor to confirm that the patient has agreed. Once shared this way the PDF is outside Humigy: it has no expiry and Humigy cannot take it back. The file name includes the patient's name.

10.5 What stays on the phone, and what is not used

• Suggestions run on the phone: diagnosis, test and medicine suggestions are produced on the device, and what the doctor enters for them is not sent to an AI service. Suggestions support the doctor, who makes every clinical decision.
• Translation runs on the phone: on iPhone and Android, a patient note can be translated on the device, and the note is not sent anywhere. Language packs are downloaded to the phone and no patient information is sent in doing so.
• No advertising or tracking: the apps show no ads and contain no third-party analytics, crash-reporting or advertising tools. On Android, an automated test (NoThirdPartyTelemetryTest) checks that no library's telemetry component is included.

10.6 How long records are kept

A clinic's records belong to the clinic. Humigy keeps them for as long as the clinic has an account.

When a clinic ends its account, or a person asks us to close their login, the account is closed. We then keep the clinic's records, locked, for 3 years by default, for legal and audit reasons. During that time they are used only to answer a legal or audit request. After that period the personal information is permanently erased. Humigy sets this period for each clinic: it can be longer where the law requires it, and it is never shorter than the minimum the law requires.

To close an account, see humigy.com/delete-account.

Records stay on a phone until one of the situations in section 10.2 happens.