Privacy Notice
What we collect, why we collect it, who can see it, how long we keep it, and what you can ask us to do about it.
This is a draft, not an approved notice
Radius Health's operating entity, registration and data-protection contact have not yet been confirmed, and this text has not been reviewed by a Ugandan legal or data-protection adviser. It sets out how the platform is built to handle your information, and it will be replaced by an approved notice before launch.
If you need a binding answer about your data today, please contact us rather than relying on this page.
Who is responsible for your information
The legal entity operating Radius Health, and the person accountable for data protection within it, are being confirmed. Both will be named here. Until they are, treat this page as a description of intent rather than a notice from a named controller.
Uganda's Data Protection and Privacy Act treats health information as sensitive personal data. That is a higher standard than ordinary personal information, and it is the standard this platform is built to.
What we collect
Who you are
Your name, date of birth, sex where clinically relevant, telephone number, email address and, where you give it, your location. For a child or dependant, the same details plus your relationship to them.
Why you came to us
The symptoms, history, medicines and concerns you describe when booking and during a consultation, and any documents, photographs or test results you upload.
Your care
Consultation notes written by your clinician, prescriptions, test requests, referrals, follow-up plans and the record of which clinician saw you and when.
Remote examination data
Where a TytoCare examination is used and you consent to it, the readings and recordings it captures — such as heart and lung sounds, or images of the ear, throat or skin.
Payments
The amount, the method, the date and a reference. Card and mobile-money credentials are handled by the payment provider and are not stored by Radius Health.
How you use the site
Technical information such as your device type, browser and pages visited. Analytics of this kind are only collected if you accept optional cookies.
Why we use it, and on what basis
| What we do | Why we are allowed to |
|---|---|
| Provide the consultation you booked, and keep a record of it | Your consent, and the contract between you and Radius Health. Clinicians are also required by professional standards to keep records. |
| Issue a prescription, test request or referral | Your consent, and the clinician's professional and legal obligations. |
| Take payment and issue a receipt | The contract between you and Radius Health, and tax and accounting law. |
| Send you appointment reminders and results notifications | Your consent, which you can withdraw without affecting your care. |
| Send you marketing or newsletters | Your consent, asked for separately. Refusing has no effect on your care. |
| Improve the platform using analytics | Your consent, given through the cookie banner. You can decline. |
| Share information where the law requires it | A legal obligation — for example a court order or a notifiable disease report. |
Who can see your information
Your health information is visible to you, and to the clinicians involved in your care. Beyond that, it is shared only in the situations below.
- A pharmacy, where you ask us to send a prescription to be fulfilled — limited to what the pharmacist needs to dispense safely.
- A laboratory or imaging provider, where a test has been requested for you.
- Another clinician or facility, where you are referred and you consent to the referral.
- Service providers who operate parts of the platform under contract — the patient portal, the payment provider, hosting and email delivery. They may process your data only on our instructions.
- Authorities, where the law requires disclosure, or where there is a serious and immediate risk to someone's life.
Your employer, insurer or school does not get your clinical records
Where an organisation sponsors your access, it receives only what its contract and the law permit — typically whether a service was used, never what you discussed or what you were diagnosed with. Individual clinical information is not made available to an employer, insurer or school automatically, and we will not release it to them on request alone.
The things we ask separately
Consenting to care is not consenting to everything. These are asked for one at a time, and each can be refused or withdrawn on its own:
Your health information
Explicit consent to process sensitive health data for your care.
Marketing
Newsletters and service updates. Declining changes nothing about your care.
Optional cookies
Analytics that help us understand how the site is used. Essential cookies keep the site secure and working, and cannot be switched off.
Sharing with a partner organisation
Any programme where a school, employer, insurer or NGO is involved in funding or coordinating your care.
Cookies
Essential cookies keep you signed in, protect forms against forgery and remember your cookie choice. They cannot be switched off, because the site does not work without them.
Analytics cookies are optional and start switched off. Nothing optional runs until you turn it on, and refusing is one click — the same as accepting. Analytics tell us which pages people use and where they get stuck; they do not read your health records.
Children, and care arranged through a school
- A parent or legal guardian must authorise care for a child and holds access to the child's record.
- Where a young person is old enough to understand the consultation, their own agreement is sought as well, and their confidentiality is respected within safeguarding limits.
- School staff — including a nurse or matron — see only what is needed to look after the learner at school and what consent permits. They do not get the full clinical record.
- Where there is a safeguarding concern, we may act on it and involve the appropriate people. This is the one situation where confidentiality can be overridden, and the reason is always the child's safety.
Where it is held
Records are held on the Radius Health patient portal and its supporting systems. Where a provider stores data outside Uganda, we require contractual protections for it. The specific hosting locations will be named here once the platform's final configuration is confirmed.
How long we keep it
Medical records are kept for the period required by Ugandan law and professional standards, which is longer than most other data. Payment records are kept for the period tax law requires. Marketing preferences are kept until you change them. The exact retention schedule will be published here once approved.
How it is protected
The platform uses encrypted connections, access limited by role so that staff see only what their job requires, audit logging of access to records, and backups. Clinician and administrator accounts require additional authentication.
No system is impossible to breach, and we will not claim otherwise. What we will tell you is which controls are in place, and what we do when one of them fails.
If something goes wrong
If personal data is lost, exposed or accessed without authority, we investigate, contain it, and record what happened. Where the incident is likely to put you at risk, we notify you and the relevant authority, explain what was affected, and tell you what to do. We will not delay telling you in order to finish investigating.
Your rights
- See your data. Ask for a copy of what we hold about you.
- Correct it. Ask us to fix anything inaccurate. A clinical record cannot be rewritten, but a correction can be recorded alongside it.
- Withdraw consent. For marketing, analytics or partner sharing, at any time. Withdrawing consent for care processing means we can no longer provide the service.
- Object or restrict. Ask us to stop or limit a particular use.
- Ask us to delete. We will, unless the law or a professional obligation requires the record to be kept — in which case we will tell you which.
- Complain. To us first, and to Uganda's data-protection authority if you are not satisfied.
Exercising any of these is free, and doing so will not affect the care you receive.
How to reach us about your data
A dedicated data-protection contact has not been published yet. Until it is, use the contact form — it creates a record someone can answer, rather than sending mail to an unattended inbox.
See also the Terms of Service and clinical governance.