Data Protection Dual-Jurisdiction Commitment
We comply with the data protection laws applicable to our processing operations in both the United Kingdom (UK GDPR and Data Protection Act 2018) and Nigeria (Nigeria Data Protection Act 2023). When we operate our hospital management platform for healthcare providers, the healthcare organisation acts as Controller, and we act as their Processor.
Who we are
Damisie Limited is a company registered in England and Wales under company number 16920754.
For the information covered by this policy that we use for our own business purposes, Damisie Limited is the data controller: we decide why and how it is used. You can contact our privacy team at info@damisie.com.
Patient information and our role
Our hospital management system supports healthcare administration and clinical workflows, including electronic patient records, appointments and online booking, patient forms and documents, communications, billing and payment administration, reporting, telehealth and integrations. Available functions depend on the customer's agreement, configuration and enabled integrations. The healthcare organisation determines the purposes of processing its patient information and is the controller. We act as its processor under documented instructions and a separate data processing agreement.
Patient information may include names, contact and identification details, dates of birth, appointment and referral information, medical history, clinical notes, prescriptions, test results, forms, correspondence, billing records and access logs. Where enabled, patient portals and integrations support the healthcare organisation's workflows. Available integrations vary by country and customer configuration. For UK healthcare organisations, these may include access to NHS records where the relevant integration is available and the required permissions and access conditions are satisfied.
We do not independently decide a patient's care or authorise access to their medical records. The healthcare organisation is responsible for the clinical use of the system and for the lawful grounds, notices and authorisations required under applicable law.
The healthcare organisation's privacy notice explains its reasons and legal grounds for using patient information, including health information. Please contact that organisation about your patient record or to exercise your rights in relation to it. If you contact us, we will help direct your request and assist the organisation as required by our agreement and the law.
Information we collect and where it comes from
We collect identity and business contact information, including names, job titles, organisations, email addresses, postal addresses and telephone numbers. We also handle enquiry and correspondence records, demo requests, feedback, survey responses, account identifiers and communication preferences. Where relevant to a business relationship, we process invoices, payment and transaction records. Payment details are handled through the applicable agreed payment arrangements; this public website does not itself provide a subscription checkout.
Technical and usage information includes IP addresses, browser and device characteristics, access times, pages and features used, referral information, and error or security logs. Marketing information includes communication choices and interests inferred from interactions with our website and business. Optional tracking operates under our Cookie Policy and your choices.
Information comes from you, your organisation and the providers supporting our website and business systems. We may also receive professional contact details from referral partners, public business records and healthcare directories, or lawful business contact providers.
Why we use information and our legal grounds
We process personal information in accordance with the data protection laws applicable to the relevant processing. These include the UK General Data Protection Regulation and the Data Protection Act 2018, as amended, and, where applicable, the Nigeria Data Protection Act 2023 and applicable regulations and directives issued by the Nigeria Data Protection Commission.
The following grounds concern processing for which we act as controller; they do not replace a healthcare organisation's grounds for processing its patient records.
| Purpose | Legal ground |
|---|---|
| Respond to enquiries, arrange demonstrations, register business contacts and manage relationships. | Legitimate interests in explaining our services and managing prospective and existing relationships. If you contract personally with us, steps at your request before a contract or performance of that contract may apply. |
| Administer customer contacts, authorised accounts, invoices, support and recovery of sums owed. | Legitimate interests in administering services and recovering debts owed to us. Contract applies where you personally are the contracting party; legal obligation applies to required accounting records. |
| Operate and protect our website and business, including troubleshooting, testing, maintenance, reporting and security. | Legitimate interests in protecting our systems, users and business; legal obligation where a specific security or regulatory duty requires the processing. |
| Send marketing communications. | Consent; for UK recipients, legitimate interests where applicable law permits, as explained in section 5. |
| Analyse website use, improve our website and services, tailor content, and measure advertising effectiveness. | Consent for optional device tracking and related personalisation under our Cookie Policy. Legitimate interests in improving our website and business for other necessary, proportionate analysis that does not require consent. |
| Meet legal duties and establish or defend claims. | Legal obligation for applicable statutory duties; legitimate interests in protecting legal rights for claims and disputes. |
| Request feedback or surveys, assess customer experience, and recommend relevant services. | Legitimate interests in understanding customer needs and improving our services. Marketing and any optional tracking remain subject to applicable consent rules and your choices. |
When we rely on legitimate interests, we consider whether our purposes are necessary and proportionate and how they affect your rights. You can ask us for more information or object. If information is needed to answer your enquiry or administer a service, not providing it may prevent us from doing so; we will explain any mandatory fields when collecting it.
Marketing and your choices
You can unsubscribe through the link in any marketing email or contact info@damisie.com. We will stop using your information for direct marketing if you object. We may retain a limited suppression record so that we respect your choice. Service notices and responses to your enquiries are separate from marketing.
For marketing to UK recipients, we seek consent for email or text marketing to individual subscribers, including sole traders and some partnerships, unless a lawful exception applies. For relevant marketing to UK corporate subscribers, we may rely on legitimate interests where permitted, with a clear opt-out.
For marketing to individuals in Nigeria, we obtain prior consent. We obtain separate opt-in consent before sharing your personal information with another organisation for that organisation's own marketing.
Who receives information
We share relevant information only where needed for the purposes described above. Recipients may include providers of website hosting, cloud infrastructure, business email, customer relationship management, customer support, payments, and consented analytics or marketing services; professional advisers such as lawyers and accountants; and public authorities where disclosure is required or lawfully justified.
Providers acting as our processors must follow our instructions and appropriate contractual safeguards. Some recipients, such as professional advisers or payment providers, may act as separate controllers for their own activities. In a proposed investment, merger or business sale, necessary information may be disclosed under confidentiality and other appropriate protections.
Patient information is shared with authorised recipients and sub-processors only in accordance with the healthcare organisation's instructions, our data processing agreement and applicable law.
| Processor | Processing Location |
|---|---|
| Twilio | UK / EEA |
| Pharmarun | Nigeria |
| SignatureRx | UK / EEA |
| VulcanTwo | UK / EEA |
| Corti | UK / EEA |
| NHS Terminology Server | UK / EEA |
| Orbforhealth | UK / EEA |
Where information is processed
Website information and patient information processed through our hospital management system are hosted in the United Kingdom using Amazon Web Services (AWS). Our support personnel access this information from the United Kingdom.
Where information is collected in Nigeria and transmitted to our UK-hosted systems, this involves a transfer of personal information from Nigeria to the United Kingdom. We comply with the applicable Nigerian requirements for these transfers and, where we act as a processor, assist the healthcare organisation in meeting its obligations under our data processing agreement.
Healthcare organisations and their authorised users may access information through the system from the country in which they operate, including Nigeria. This is separate from the location of our hosting and support operations.
Where an arrangement involves a restricted transfer under UK data protection law, we use an applicable lawful transfer mechanism, together with the required assessments and safeguards. Where Nigerian transfer requirements apply, we establish and document the applicable transfer basis and protections.
You can contact our privacy team at info@damisie.com for information about the transfer arrangements relevant to your personal information and, where applicable, copies of the safeguards, subject to appropriate redactions.
How long we keep information
We keep personal information for the purpose for which it was collected, including applicable accounting requirements, dispute periods and legal holds. Operational customer records are generally retained during the customer relationship; core customer and transaction records follow the six-year statutory periods below.
For visitors or prospects without a contract, retention depends on the enquiry or other purpose, rather than an assumed subscription term. We review continued necessity and delete or genuinely anonymise records that are no longer needed.
| Record | Retention period or rule |
|---|---|
| Enquiries and prospective contacts | For as long as reasonably needed to respond, follow up and manage an active prospective relationship. We review relevance and remove records when that purpose ends, subject to any justified legal hold. |
| Operational customer contacts and accounts | During the customer contract, with longer retention only where required for a continuing legal, accounting or dispute purpose. |
| Support records and security logs | Customer-related records ordinarily during the contract; website-only records for as long as needed for support, security or investigation, with continued necessity reviewed. |
| Marketing preferences and suppression records | While the business relationship or marketing purpose remains relevant, unless you object or withdraw consent. A minimal suppression record is retained as needed to respect your choice. |
| Cookies and associated tracking records | Cookie lifetimes are set out in our Cookie Policy. Identifiable website analytics and campaign records are kept only as long as needed for their stated purpose; genuine anonymous statistics may be retained longer. |
| Patient information processed for healthcare customers | We retain patient information in accordance with the healthcare organisation's documented instructions and our agreement. The healthcare organisation determines the applicable clinical and statutory retention requirements. On termination, we return or delete information in accordance with the agreement and those instructions, subject to any legal obligation requiring retention. Backup copies are removed through the applicable backup deletion cycle and remain protected pending deletion. |
| Core customer and financial records | Basic customer identity, contact and financial records: six years after the customer relationship ends. Transaction records and associated identity information: six years after the end of the transaction year. Records falling within both categories are kept until the later applicable expiry, unless a longer lawful hold is needed. |
Security
We use technical and organisational safeguards appropriate to the information and risks, and restrict access to those who need it for their work.
Our safeguards include access controls to prevent unauthorised access, encryption of personal information in transit and at rest, confidentiality obligations and data protection training for staff, regular backups and recovery procedures, and incident response procedures to identify, investigate and address suspected security incidents and personal data breaches.
We review these safeguards regularly to ensure they remain appropriate to the information we handle and the associated risks. No online service can guarantee absolute security. Where a breach requires notification, we notify the appropriate party or regulator as the law and our contractual role require.
Your rights
Depending on the circumstances, you may request access to your information, correction, erasure, restriction of processing or portability. You may object to processing based on legitimate interests and have an unconditional right to object to direct marketing. You may withdraw consent at any time without affecting processing that was lawful before withdrawal. Rights have legal conditions and exceptions. These rights apply under the relevant UK or Nigerian data protection law.
Where applicable, you also have rights concerning decisions based solely on automated processing that have legal or similarly significant effects.
Contact info@damisie.com to make a request. We may seek proportionate information to verify your identity. We respond within the period required by the law applicable to your request. Where a lawful extension or other adjustment applies, we will explain this and any required reasons. Requests are normally free, although the law permits a reasonable fee or refusal in limited circumstances.
We may use professional interests and website interactions to select relevant business content or marketing, subject to applicable consent and objection rights. We do not use information collected through the public website to make solely automated decisions that produce legal or similarly significant effects on you. Clinical functions in the separate system remain subject to the healthcare organisation's instructions and applicable notices.
Complaints
You can raise a data protection complaint using the privacy contact email at info@damisie.com. Please explain your concern and how we can contact you. We acknowledge complaints promptly, investigate appropriately, keep you informed and communicate the outcome without undue delay and within applicable legal time limits.
You may also complain to the relevant supervisory authority:
Information Commissioner's Office (ICO)
UK supervisory authority: ico.org.uk/make-a-complaint
You do not need our permission to contact either authority, and contacting us does not limit your right to complain to an authority with jurisdiction.
Other websites and policy changes
Third-party websites and services have their own privacy notices. Review those notices when following a link or using an external service.
We update this policy when our practices or legal requirements change, show the effective date above, and provide additional notice of material changes where appropriate. A policy change does not itself provide consent for a new use of information.