Privacy Policy

Last updated: 5th October 2026 • Applies to the HealthTrack clinic management system

This is a draft template, not a finished legal document. It should be reviewed by qualified legal counsel and updated with your organization's specific details, retention periods, and applicable data protection law (for example Zambia's Data Protection Act) before publishing or relying on it.

1. Who this applies to

This policy covers information processed by HealthTrack on behalf of Marybegg Health Services ("we", "us"), including patient health records, appointment and referral data, and account information for clinicians and staff who use the system.

2. Information we collect

Patient identification details: name, date of birth, gender, National Registration Card (NRC) number, mine number, contact information.
Clinical information: readings, medications, allergies, medical conditions, appointment history, and referral records.
Staff account information: name, email, role, and site, used to control access to the system.
System activity: an audit log of who accessed or changed a record, and when, for accountability and security.

3. How we use this information

To provide and coordinate clinical care, including scheduling, medication tracking, and referrals between sites.
To maintain accurate medical records and a defensible audit trail of changes.
To generate operational and clinical reports for the clinic and occupational health teams.
To meet legal, regulatory, and occupational health obligations.

4. Who can access this information

Access is restricted by role. Only authenticated staff with an appropriate role (for example, admin or registered nurse for editing patient records) can view or modify patient data. All access and changes are logged.

5. Data retention

Patient records are retained for as long as required for clinical care and to meet applicable legal and regulatory retention requirements.

6. Data security

Access to the system requires authentication. Passwords are stored using industry-standard hashing, not in plain text. Administrative actions such as password resets and record edits are logged for accountability.

7. Your rights

Employees and patients may request access to, correction of, or information about how their data is used, subject to applicable law and the clinic's internal procedures. Requests should be directed to elijah.nchito@marybegg.com / IT Department.

8. Changes to this policy

This policy may be updated from time to time. Material changes will be communicated to staff through the usual internal channels.

9. Contact

Questions about this policy can be directed to elijah.nchito@marybegg.com.