In short: the facility owns and controls its records. We process them only to provide GomoClinic, on the
facility's instructions, keep them confidential and secure, and return or delete them when the service ends.
This agreement forms part of every facility's service agreement for GomoClinic. Where the two differ on data protection, this agreement applies.
1. Roles
- The facility is the data controller. It decides what personal data is collected and for what purpose, and is responsible to patients and staff for that.
- Gomo Technologies Co. Ltd is the data processor. It hosts and operates GomoClinic and processes the facility's data only to provide the service.
2. Scope of processing
| Purpose | Providing, securing, supporting and maintaining GomoClinic for the facility. |
|---|---|
| Data subjects | Patients and their next of kin, staff, system users, suppliers and other contacts the facility records. |
| Categories of data | Identity and contact details, health and care records (special personal data), financial and insurance data, employment and payroll data. |
| Duration | For as long as the service agreement is in force, plus the return or deletion period below. |
3. Our commitments as processor
- We process facility data only on the facility's documented instructions. Using the system as designed counts as such an instruction.
- We never sell facility data, use it for advertising, or use it for our own purposes.
- Everyone at Gomo Technologies Co. Ltd who can access facility data is bound by confidentiality.
- We apply the safeguards described in Data Protection & Security and keep them up to date.
- We help the facility respond to requests from patients and staff exercising their rights, for example by making records findable, printable and correctable.
- We notify the facility without undue delay after becoming aware of a personal data breach affecting its data, and support its response (see Incident & Breach Response).
- We tell the facility before engaging any new sub-processor, such as a hosting or email provider, and hold them to equivalent obligations.
- Where data is stored or processed outside Uganda, we do so only with safeguards that meet the Data Protection and Privacy Act, 2019, and as set out in the service agreement.
- We make available the information needed to show compliance with this agreement, and cooperate with reasonable audits.
4. The facility's commitments
- Have a lawful basis for the data it records, and give patients and staff the information the law requires.
- Register with the Personal Data Protection Office where the law requires it.
- Manage its users: grant the minimum permissions needed, and deactivate accounts promptly.
- Keep its own copies of printed or exported data secure.
5. End of service
When the service ends, the facility can export its data. We then delete it from the live system, and from backups as they expire, unless the law requires us to keep it. We confirm deletion in writing on request.
6. Contact
Data protection questions from facilities: [email protected].