1. Scope & Roles
Solace Healthcare Technologies ("Solace", "we", "us", or "our") provides cloud-based Electronic Medical Records (EMR), practice management, billing, clinical charting, and patient booking services to medical clinics, specialist hospitals, and healthcare practitioners across Nigeria and emerging markets via mysolace.xyz and mysolace.spex.com.ng.
Under the Nigeria Data Protection Act (NDPA 2023) and the Nigeria Data Protection Regulation (NDPR):
- Healthcare Providers (Clinics / Hospitals): Act as Data Controllers determining the lawful purpose and clinical necessity of collecting patient records.
- Solace: Acts as a Data Processor, handling and storing clinical records strictly according to the controller's instructions, our Master Services Agreement, and statutory privacy laws.
2. Categories of Data Collected
A. Practice & Staff Information
When a clinic registers an account, we collect practitioner and administrative personnel details: full names, professional medical license identifiers, official clinic email addresses, phone numbers, staff roles (Doctor, Nurse, Pharmacist, Cashier), and password hashes (stored using one-way bcrypt hashing).
B. Protected Health Information (PHI) Processed for Clinics
When clinic staff use Solace to manage patient care, our platform stores:
- Patient Demographics: Name, age, gender, address, emergency contact, HMO provider and policy enrollment numbers.
- Clinical Records: Vitals recordings, clinical consultation notes, medical histories, allergies, diagnoses (including ICD-10 classifications), procedure notes, and dental charting.
- Diagnostics & Prescriptions: Laboratory test requests, digital test results, radiology reports, pharmacy prescriptions, and dispensing history.
- Billing & Invoices: Fee items, copays, invoices, payment status, and receipt references. We do not store raw credit/debit card numbers; all payment processing is tokenized securely via certified PCI-DSS payment gateways including Flutterwave and Paystack.
C. Public Portal & Story Inquiries
When prospective patients book an appointment or submit an inquiry through a clinic's public page, we collect the patient's name, email, phone number, preferred visit date/time, selected clinic service, and optional visit notes.
3. Legal Basis for Processing
We process personal and health data under the following recognized legal grounds:
- Performance of a Contract: Providing practicing healthcare facilities with the software required to manage clinical workflows.
- Vital Interests & Healthcare Provision: Assisting licensed physicians and medical personnel in delivering timely, accurate, life-saving clinical diagnoses and continuity of care.
- Compliance with Legal Obligations: Retention of medical records in accordance with federal and state healthcare guidelines, medical ethics councils, and tax record mandates.
- Legitimate Interests: Preventing unauthorized access, defending against malpractice disputes, and detecting fraud or cyber threats.
4. Security & Storage Architecture
Protecting medical confidentiality is central to everything we build:
- Strict Multi-Tenancy Isolation: Clinic databases and operational partitions are logically segregated. No healthcare facility can ever query, inspect, or accidentally view another clinic's patient records.
- Encryption in Transit: All communications between clinic browsers, mobile devices, and our servers are encrypted using modern Transport Layer Security (TLS 1.3 / 256-bit SSL).
- Encryption at Rest: Database backups and uploaded clinical files (e.g. lab result scans) are encrypted using industry-standard AES-256 protocols.
- Role-Based Access Control (RBAC): Granular staff permissions ensure receptionists cannot read confidential doctor notes, cashiers only access invoices, and medical directors have complete audit oversight.
- Audit Trails: Timestamped access logs record record creations, updates, and prescription issuances to satisfy medical malpractice and compliance scrutiny.
5. Sub-processors & Disclosures
Solace does not sell, rent, or monetize patient or practitioner data to advertisers, pharmaceutical companies, or third parties under any circumstances. Data is only shared with approved infrastructure sub-processors:
- Certified Cloud Infrastructure: ISO 27001 and SOC 2 Type II compliant enterprise cloud hosting and automated backup facilities.
- Transactional Communications: SMS and email delivery gateways (e.g. SendGrid) for appointment confirmations and staff security notifications.
- Payment Infrastructure: Licensed payment partners (Flutterwave) for secure subscription and invoice settlements.
- Legal & Regulatory Demands: We will only disclose records if compelled by a court order, valid warrant, or legal process issued by a competent Nigerian court of law.
6. Data Retention & Portability
Healthcare facilities maintain full ownership of their medical files. In the event of subscription termination:
- Clinics are granted a 30-day export grace period to download complete patient lists, billing histories, and medical archives in standardized formats (CSV, JSON, PDF).
- Following the grace period, records are archived or permanently expunged in accordance with the clinic’s written instruction and mandatory statutory retention guidelines.
7. Your Data Subject Rights
In accordance with the NDPA and NDPR, data subjects (patients, clinicians, practice staff) enjoy statutory rights:
- Right to Access: Request confirmation and copies of personal data held.
- Right to Rectification: Request correction of inaccurate demographic or contact details.
- Right to Erasure ("Right to be Forgotten"): Subject to statutory medical retention obligations.
- Right to Restrict or Object: Restrict processing under specific legal disputes.
- Right to Data Portability: Receive data in a structured, machine-readable format.
8. Data Protection Officer (DPO)
For privacy inquiries, audit verifications, or data subject requests, please contact our Data Protection Office: