- Your health facility decides what information is collected about you and why. GomoClinic is the system it uses to keep those records.
- Health information is only seen by staff whose role needs it, and every change to a record is logged.
- We never sell personal data or use it for advertising.
- You can ask your facility to see, correct or explain the information held about you.
1. Who we are and who is responsible
GomoClinic is a hospital and health facility management system provided by Gomo Technologies Co. Ltd ("we", "us"). Hospitals, clinics, pharmacies, laboratories and maternity homes ("facilities") use it to run patient care, billing, staff and finance.
For patient and staff records, the facility is the data controller: it decides what is collected and why, and it is responsible to you for how your information is used. We are the data processor: we run the system on the facility's instructions and protect the data in it. Our obligations to facilities are set out in the Data Processing Agreement. For information about people who contact us directly, such as facility administrators, we are the controller.
2. What information is held
| About | Examples |
|---|---|
| Patients | Name, date of birth, sex, contact details, next of kin, national ID (stored encrypted), photo; visits, vital signs, diagnoses, allergies, prescriptions, laboratory and imaging results, admissions, procedures, maternity and immunisation records; bills, payments and insurance or scheme membership. |
| Staff | Name, contact details, role, department, qualifications and licences, leave, appraisals, payroll and bank details for salary payment. |
| System users | Login email, password (stored only as a one-way hash), roles, and activity records such as sign-ins and changes made. |
| Suppliers and partners | Business contact details, invoices and payments. |
Health information is special personal data under Uganda's Data Protection and Privacy Act, 2019, and is handled with the extra care that requires.
3. Why it is used
- To provide care: registering patients, recording consultations, ordering tests, dispensing medicines and following up treatment.
- To keep patients safe: allergy and alert banners, critical-result warnings, drug-interaction checks and clinical audit.
- To bill and get paid: charges, receipts, insurance claims and accounting.
- To run the facility: staffing, payroll, stores, equipment maintenance and quality improvement.
- To meet legal duties: statutory health reporting, tax and employment records, and responding to lawful requests.
Information is not used for advertising, is never sold, and is not used to make automated decisions about anyone's care.
4. Who can see it
- Facility staff, on a need-to-know basis. Each user is given a role, and each role is given explicit permissions per module and per branch. A pharmacist, for example, does not see payroll.
- Other providers, when you are referred. Referral letters and results are shared with the receiving facility as part of your care.
- Insurers and schemes you belong to, to the extent needed to process claims.
- Authorities, where the law requires it (for example notifiable disease reporting or a court order).
- Our engineers, only when needed to keep the system running or fix a fault, under a duty of confidentiality.
5. How it is protected
Access control, encryption in transit, password hashing, an audit trail of every change, and protections against common web attacks are described in full in Data Protection & Security.
6. How long it is kept
Medical records must be kept long enough to support ongoing care and to meet legal and professional requirements. Each facility sets its retention periods; see Data Retention & Disposal.
7. Your rights
Under the Data Protection and Privacy Act, 2019 you have the right to:
- be told what personal information is held about you and how it is used;
- get a copy of your information;
- have inaccurate or incomplete information corrected;
- object to processing that is not necessary for your care or a legal duty;
- complain to the Personal Data Protection Office if you are not satisfied.
To make a request, contact the facility that treated you, since it controls your records. Facilities can find, print and correct records in GomoClinic. If you cannot reach the facility, or you have a concern about how we run the system, email [email protected].
8. Children
Records of children are created by facilities as part of their care, for example newborn, immunisation and paediatric records. Requests about a child's record are made by a parent or guardian through the facility.
9. Changes to this policy
When this policy changes, the effective date at the top is updated. Significant changes are communicated to facilities before they take effect.
10. Contact
Gomo Technologies Co. Ltd, Kampala, Uganda. Email: [email protected].