In short: the hospital is in charge of the personal data it puts into NVDRA Hospital. NVDRA Technologies processes that data only to provide the Service on the hospital’s instructions, keeps it confidential and secure, uses vetted service providers, helps with requests and incidents, and returns or deletes the data when the hospital leaves.
Scope and roles
These Data Processing Terms form part of the Terms of Service between NVDRA Technologies (“we”) and each hospital that uses NVDRA Hospital. They apply to personal data that the hospital or its Users put into NVDRA Hospital (“Hospital Data”).
- The hospital decides why and how Hospital Data is processed (it is the “controller”).
- NVDRA Technologies processes Hospital Data on the hospital’s behalf (it is the “processor”).
- Data we use for our own purposes (NVDRA accounts, billing, security logs), and data people keep in their personal use of NVDRA Hospital, is covered by our Privacy Policy, not by these terms.
Details of the processing
| Subject matter | Providing NVDRA Hospital and the connected NVDRA applications chosen by the hospital. |
|---|---|
| Duration | While the hospital’s account is open, plus the return and deletion period below. |
| People concerned | The hospital’s patients and their emergency contacts, parents and relatives who see a file, and the hospital’s staff and doctors. |
| Types of data | Patient identity and contact details, health information (vitals, complaints, diagnoses, prescriptions, test results, admissions), bills and payments, and staff names, roles and doctors’ profiles. |
| Operations | Collecting, recording, storing, organising, displaying, transmitting (including by email and push notification), backing up, exporting and deleting. |
Processing only on the hospital’s instructions
We process Hospital Data only to provide, secure and support the Service, as set out in the Terms, these Data Processing Terms and the settings the hospital chooses, or as required by law. If the law requires us to process it in another way, we will tell the hospital first unless the law forbids it. If we think an instruction breaks the law, we will say so.
We do not sell Hospital Data, use it for advertising, or combine it with other data to build profiles of people.
The hospital’s duties
- Have a lawful basis, and consent where needed, for the data it enters.
- Tell its people clearly how it uses NVDRA Hospital (it may link to our Privacy Policy).
- Enter only the data it needs, keep it accurate, and set roles so that each person sees only what they need.
- Keep its own sign-in details and devices secure, and remove access promptly when someone leaves.
Confidentiality and our staff
Only NVDRA staff who need access to provide support, maintain the Service or keep it secure may access Hospital Data. They are bound by confidentiality and their access is recorded. Signing in as a User from the NVDRA Admin Panel is limited to senior administrators, needs a recorded reason, shows a visible banner, ends by itself and is kept in the audit log.
Security measures
- Encrypted connections (HTTPS) for all access, and one-way hashing of passwords.
- Role-based access within each hospital, and separation of each hospital’s data from others’.
- Private files stored outside the public web folder; signed and verified connections between NVDRA applications.
- Regular backups, security updates and monitoring, and audit logs of sensitive actions.
Service providers (sub-processors)
The hospital authorises us to use service providers to help provide the Service, currently in these categories: hosting and backup; email delivery; and browser and phone push notification services. We give each provider only the data it needs, require it to protect the data, and remain responsible for its work. We will update the list in the Privacy Policy before adding a new category of provider, and a hospital that objects on reasonable grounds may close its account and receive a refund of the unused part of its paid year.
Helping with requests
If someone contacts us directly about Hospital Data, we will refer them to the hospital and, where appropriate, tell it. The hospital can answer most requests itself in NVDRA Hospital. Where it cannot, we will help within a reasonable time.
Security incidents
If we become aware of a breach of security leading to accidental or unlawful loss, alteration, disclosure of or access to Hospital Data, we will notify the hospital without undue delay, and in any case within 72 hours of confirming it, with what we know about what happened, the data affected and what we are doing about it. We will help the hospital inform the people affected and any authority where required.
Return and deletion of data
- While its account is open, the hospital can export its records and delete records and files.
- When the hospital closes its account, the data stays available for export for 30 days. We then delete it from the live system within a further 60 days. Backups are overwritten within 90 days.
- We may keep data longer only where the law requires us to, and only for that purpose. On request we will confirm deletion in writing.
Requests from authorities
If a court or authority asks us for Hospital Data, we will check that the request is lawful, disclose only what is required, and tell the hospital before disclosing, unless the law forbids it.
Information and audits
We will give the hospital the information reasonably needed to show that we meet these terms, for example by answering a security questionnaire once a year. Any on-site audit must be agreed in advance, be reasonable in scope, and respect the confidentiality of other organisations’ data.
Contact
NVDRA Technologies
Email: support@nvdra.com