English Privacy Policy
This template applies to Healthcare Organization. The organization should review it against its healthcare, retention, and data-protection obligations before production use.
1. Purpose and controller
Healthcare Organization controls information processed through this system for patient-safety, quality improvement, investigation, corrective action, organizational learning, and authorized reporting.
2. Information processed
- User identity, employee number, work contact details, role, department, manager, language, and access history.
- Incident facts, date, location, category, narrative, immediate actions, affected department, involved employees, workflow decisions, risk scores, comments, and audit history.
- A limited patient reference when enabled. Users should not enter unnecessary patient names or clinical details.
- Attachments, email-delivery logs, technical logs, IP address, browser information, and security events.
3. Use and access
Information is used to route and investigate incidents, calculate and professionally assess risk, notify responsible parties, track CAPA, confirm reporter satisfaction, measure performance, and meet lawful obligations. Access is limited by role, department, assignment, confidentiality, and least-privilege rules.
4. Sharing
Data is not sold. It may be disclosed to authorized personnel, approved hosting/email/backup providers, professional advisers, regulators, or authorities where operationally necessary or legally required.
5. Security
- HTTPS, authenticated sessions, CSRF protection, role permissions, private attachment delivery, encrypted patient references, audit logs, and protected developer licensing.
- Production administrators must maintain strong passwords, backups, supported software, restricted server access, and tested recovery procedures.
6. Retention and rights
Incident records are retained according to the organization’s approved healthcare, legal, accreditation, quality, and litigation-hold requirements. Depending on applicable law, verified persons may request access, correction, restriction, or another permitted action. Medical safety records may need to be preserved even when direct identifiers are corrected, restricted, or anonymized.
7. Contact
Questions or verified requests: eng.mdafalla@gmail.com