Privacy policy

This policy explains what personal data Afrimedicare collects, why, who sees it, how long we keep it and what your rights are. It covers the public website and the portals (hospital portal and management system, patient portal and agent portal).

1. Who is responsible

Afrimedicare, Fish Market, Sinkor, Montserrado, Liberia, is the controller of the personal data described here. Contact for anything about your data: support@afrimedicare.com.

For the hospital management system (wards, pharmacy, staff, billing, payroll), the hospital that uses it is the controller of its own records; Afrimedicare hosts and processes that data on the hospital's instructions.

2. What we collect

Website visitors: what you type into a contact, partner, supplier or job form (name, email, phone, country, message, CV), your language choice, and, only if you accept analytics cookies, anonymous usage statistics.

Patients: name, date of birth, gender, nationality, contact details, emergency contact, the referring hospital, and your medical information: diagnosis, history, allergies, blood type, reports, scans and other documents, the treatment requested, quotes, appointments, travel, hotel and transfer bookings, invoices and payments, and your messages with your coordinator.

Referring hospitals and their staff: hospital details, the names, emails, phone numbers and job titles of portal users, the cases they refer, and the records they keep in the management system (patients, admissions, pharmacy, staff, leave, attendance, payroll, bills).

Marketing agents: name, contact details, education, qualifications, work experience and CV, the hospitals introduced, and commissions.

Everyone with an account: email, password (stored hashed), sign-in times and IP address, language, two-factor settings, and the version of the terms accepted.

3. Why we use it and on what basis

• To coordinate treatment: obtain a quote, arrange travel and follow-up, and keep patient, hospital and coordinator in touch. Basis: the agreement with you, and for health data your explicit consent, given when you (or your referring hospital on your behalf) ask us to arrange treatment.
• To run the portals and the management system: provide the service hospitals signed up for. Basis: our agreement with the hospital.
• To pay commissions and keep accounts: basis: our agreement with agents and our legal duties.
• To keep the service safe: sign-in checks, rate limits, logs, email confirmation. Basis: our legitimate interest in security.
• To answer you: inquiries, applications, support. Basis: your request.
• Analytics: only with your consent, given on the cookie banner.

We do not sell personal data and we do not use health data for advertising.

4. Who sees your data

• Treating hospitals abroad: receive the patient's medical file to review it, quote and treat. They are responsible for the data under their own law once treatment starts.
• Travel and stay providers: airlines, hotels and transfer companies receive the details needed for a booking (name, dates, flight numbers), never medical data.
• Referring hospital: sees the cases it referred and its own management records.
• Marketing agents: see which hospitals they introduced, case status and commission amounts, never medical details.
• Our coordinators and administrators: the cases they handle.
• Service providers: our hosting provider, our email delivery provider and our internal notification tools, which process data on our instructions. Website texts (not patient data) are machine-translated by a translation service.
• Authorities: when the law requires it.

5. Transfers abroad

Treatment abroad means medical data leaves your country and goes to the treating hospital in the country of treatment, and our systems may be hosted in another country. We send only what the treating hospital needs, over encrypted connections, and we ask treating hospitals to protect the data under their own medical confidentiality rules.

6. How long we keep it

• Cases and medical files: for the duration of the case and the follow-up, then for as long as medical and accounting law requires, after which they are deleted or anonymised.
• Accounts: while the account exists, and a short time after it is closed for security and accounting.
• Management system records: as long as the hospital uses the system; the hospital can export and ask for deletion when it leaves.
• Inquiries and applications: up to 12 months, unless they lead to a case, a partnership or a job.
• Logs: a few months.

7. Security

Connections are encrypted (HTTPS). Passwords are stored hashed. Documents are stored outside the public web folder and served only to people entitled to see them. Accounts are confirmed by email, sign-in attempts are rate-limited, and two-factor authentication is available. Access inside our team is limited to the cases a person handles. If a breach affects you, we will tell you and, where required, the authorities.

8. Your rights

You can ask us to:

• tell you what data we hold about you and give you a copy;
• correct data that is wrong;
• delete data, where we no longer need it or you withdraw consent (medical and accounting records may have to be kept for a legal period);
• limit or object to a use of your data;
• withdraw consent for health data processing at any time, which stops further coordination of your case;
• receive your data in a portable format.

Write to support@afrimedicare.com. We answer within one month. You can also complain to the data protection authority of your country.

Patients can see and update most of their details themselves under My details in the patient portal.

9. Cookies

You can change your choice at any time with the Cookie settings link in the footer, or by clearing cookies in your browser.

10. Children

Patients under 18 are referred by a parent or guardian, who gives the consents above on their behalf and holds the patient portal account.

11. Changes

We may update this policy; the version date is shown at the top. Portal users are asked to accept important changes at their next sign-in.

12. Contact

Afrimedicare, Fish Market, Sinkor, Montserrado, Liberia. Email: support@afrimedicare.com.