Privacy Notice

4.1 Customer-controlled data

When a laboratory or healthcare organisation enters patient information, laboratory results, employee information, billing records or similar data into MedeCue, the customer normally determines:

• Which information is collected;
• Why the information is collected;
• Who may access it;
• How long it should be retained;
• Which communications should be sent; and
• How the information should be used.

In this situation, the customer generally acts as the data controller, data fiduciary, business or equivalent responsible organisation under applicable privacy law.

MedeCue generally acts as a data processor, data processor on behalf of the data fiduciary, service provider, contractor or equivalent processing organisation.

We process this data according to:

• The customer’s documented instructions;
• The applicable subscription agreement;
• Any Data Processing Agreement;
• Customer-configured settings; and
• Applicable law.

Individuals seeking to exercise rights concerning customer-controlled patient, employee or laboratory data should ordinarily contact the relevant laboratory or healthcare organisation first.

4.2 Data controlled directly by MedeCue

MedeCue may act as the data controller or data fiduciary for information concerning:

• Customer account administrators;
• Subscription and billing contacts;
• Website visitors;
• Demo and sales enquiries;
• Support contacts;
• Security and access logs;
• Marketing contacts;
• Vendor and business-partner contacts; and
• Individuals communicating directly with MedeCue.

5.1 Customer and business information

This may include:

• Laboratory, organisation or business name;
• Registration and licensing information;
• Business address;
• Branch and collection-centre information;
• Contact-person name;
• Job title and department;
• Business telephone number;
• Email address;
• Tax information;
• Subscription details;
• Billing and payment information;
• Contract details; and
• Authorised representative information.

5.2 User account information

This may include:

• Name;
• Username;
• Email address;
• Telephone number;
• Employee identifier;
• Role and designation;
• Assigned branch;
• User permissions;
• Password or authentication credentials in protected form;
• Multi-factor authentication information;
• Account status;
• Sign-in history;
• Session information; and
• User activity and audit logs.

5.3 Patient and clinical information

Where entered by an authorised customer, MedeCue may process:

• Patient name;
• Patient identifier or medical record number;
• Date of birth or age;
• Sex or gender information where required;
• Address and contact details;
• Referring doctor information;
• Corporate or insurance information;
• Visit and registration information;
• Test orders;
• Specimen and sample information;
• Laboratory analyser data;
• Test results;
• Reference ranges;
• Clinical observations;
• Comments and remarks;
• Diagnostic or clinical reports;
• Report approval information;
• Billing and payment information;
• Report-delivery preferences;
• Communication records; and
• Other information entered by the customer.

Patient and clinical data may be considered health data, sensitive personal information or special-category personal data under applicable law.

5.4 Employee and human-resource information

If a customer uses MedeCue HR features, the Services may process:

• Employee name and identifier;
• Contact information;
• Designation and department;
• Branch assignment;
• Shift information;
• Attendance records;
• Leave information;
• Payroll-related information;
• Earnings and deductions;
• Overtime information;
• User roles and access permissions; and
• Employment-related documents uploaded by the customer.

5.5 Biometric and facial-attendance information

Where the customer enables a facial-attendance or biometric feature, MedeCue may process facial images, facial templates, biometric identifiers or associated check-in and check-out information.

The customer is responsible for ensuring that:

• The feature is lawful in the relevant jurisdiction;
• Required consent or another lawful basis exists;
• Appropriate notices are provided;
• Collection is proportionate and necessary;
• Retention periods are configured appropriately; and
• Individuals are provided with any legally required alternative attendance method.

MedeCue will not use biometric information for advertising or unrelated identification purposes.

7.1 Providing the Services

We use information to:

• Create and administer accounts;
• Process patient registrations;
• Manage test orders and samples;
• Receive analyser results;
• Generate laboratory reports;
• Support billing and payment workflows;
• Manage stock, accounts, HR and reporting modules;
• Deliver reports and notifications;
• Provide dashboards and analytics;
• Maintain audit trails; and
• Provide other customer-configured functions.

7.2 Performing contracts

We process information to:

• Provide subscriptions;
• Manage customer onboarding;
• Configure the Services;
• Provide implementation and training;
• Process invoices and payments;
• Provide customer support;
• Manage renewals;
• Enforce contractual terms; and
• Communicate about the customer relationship.

7.3 Security and fraud prevention

We use information to:

• Authenticate users;
• Detect unauthorised access;
• Investigate suspicious activity;
• Prevent fraud and abuse;
• Maintain backups;
• Monitor service security;
• Protect system availability;
• Respond to incidents; and
• Enforce access restrictions.

7.4 Legal and regulatory compliance

We may process information to:

• Comply with legal obligations;
• Respond to lawful government requests;
• Maintain financial and tax records;
• Establish, exercise or defend legal claims;
• Investigate complaints;
• Meet data-protection obligations; and
• Support customers in meeting applicable regulatory requirements.

7.5 Product administration and improvement

We may use technical, support and usage information to:

• Diagnose errors;
• Improve system performance;
• Develop new functionality;
• Evaluate feature adoption;
• Maintain compatibility;
• Improve usability;
• Conduct quality assurance;
• Test security controls; and
• Generate aggregated or de-identified statistics.

Patient or clinical data will not be used to train a general-purpose artificial-intelligence model unless this is expressly agreed in writing with the customer and a valid legal basis has been established.

7.6 Communications and marketing

We may use business-contact information to:

• Respond to enquiries;
• Arrange demonstrations;
• Provide service announcements;
• Send product updates;
• Invite customers to training;
• Communicate about relevant MedeCue services; and
• Conduct lawful business-to-business marketing.

Recipients may opt out of promotional communications at any time. Service, billing, security and transactional messages may still be sent where necessary.

12.1 Customer-authorised users

Information may be available to laboratory administrators, authorised staff, doctors, technicians, accountants, HR personnel or other users according to roles and permissions configured by the customer.

12.2 Service providers and subprocessors

We may use service providers for:

• Cloud hosting;
• Data storage;
• Backup and disaster recovery;
• Email delivery;
• SMS or WhatsApp communication;
• Payment processing;
• Authentication;
• Security monitoring;
• Analytics;
• Error tracking;
• Customer support;
• Remote support;
• Document generation;
• AI processing where enabled; and
• Other infrastructure services.

Providers may process information only for authorised purposes and subject to contractual confidentiality, security and data-protection requirements.

A current subprocessor list may be made available to customers on request or through a designated MedeCue page.

12.3 Integrations selected by customers

Data may be shared with third-party systems selected or enabled by the customer, including:

• Laboratory analysers;
• Hospital information systems;
• Accounting systems;
• Payment providers;
• Messaging providers;
• Government portals;
• Insurance or corporate systems; and
• Other customer-authorised APIs.

The customer is responsible for evaluating and authorising third-party integrations.

12.4 Professional advisers

We may disclose information to auditors, lawyers, accountants, insurers and professional advisers where reasonably necessary.

12.5 Government and legal authorities

We may disclose information where required to:

• Comply with law;
• Respond to a valid legal process;
• Protect rights or safety;
• Investigate fraud or security incidents; or
• Establish or defend legal claims.

Where legally permitted, we will attempt to notify the affected customer before disclosing customer-controlled data.

12.6 Business transactions

Information may be transferred as part of a merger, acquisition, financing, restructuring or sale of all or part of the business, subject to appropriate confidentiality and privacy protections.

15.1 Customer-controlled data

Patient, clinical, employee and operational data is retained according to:

• Customer instructions;
• The Customer Agreement;
• The Data Processing Agreement;
• Configured retention settings; and
• Applicable legal requirements.

Following termination, customers will normally be provided a limited period to export their data, as described in the applicable agreement.

Data will then be deleted or anonymised, subject to legal retention requirements and normal backup-deletion cycles.

15.2 Account and contract records

Account, billing, contract and transaction records may be retained for the duration of the commercial relationship and for the period required for accounting, taxation, dispute resolution and legal compliance.

15.3 Security and audit logs

Security, audit and access logs may be retained for a period appropriate to security monitoring, incident investigation, compliance and customer requirements.

15.4 Marketing information

Marketing information is retained until consent is withdrawn, an objection is received or the information is no longer needed for legitimate business communications.

18.1 India

Where applicable under Indian data-protection law, individuals may have rights to:

• Obtain information about processing;
• Request correction of inaccurate or incomplete personal data;
• Request erasure where legally permitted;
• Withdraw consent;
• Submit a grievance;
• Nominate another individual to exercise rights in the event of death or incapacity; and
• Use other remedies available under applicable law.

18.2 European Economic Area and United Kingdom

Individuals may have rights to:

• Access personal data;
• Correct inaccurate personal data;
• Request deletion;
• Restrict processing;
• Object to processing;
• Receive portable data;
• Withdraw consent;
• Object to direct marketing;
• Request safeguards relating to significant automated decisions; and
• Submit a complaint to the relevant supervisory authority.

18.3 California and similar United States laws

Where applicable, individuals may have rights to:

• Know which categories of personal information are collected;
• Request access to specific information;
• Request deletion;
• Request correction;
• Opt out of sale or sharing;
• Limit certain uses of sensitive personal information;
• Receive information about disclosures; and
• Exercise rights without unlawful discrimination.

MedeCue does not sell patient or clinical data.

18.4 Exercising rights

For data entered by a laboratory or healthcare organisation, individuals should ordinarily contact that organisation directly.

MedeCue may forward a request to the relevant customer or assist the customer in responding.

For data controlled directly by MedeCue, requests may be sent to:

We may need to verify the requester’s identity and authority before completing a request.