Patient information is treated as confidential by default.
This notice explains the principles built into PulseGrid Health. It is a software and operational template: the clinic deploying the platform must review it, add its own contact details and align it with Ghana's Data Protection Act, 2012 (Act 843) and any other applicable law before using it with real patients.
Last updated: · Review before go-live.
What we collect
- Identity and contact details: name, date of birth, age, sex, residential area, phone number and emergency contact.
- Clinical information: medical history, allergies, medications, vital signs, triage responses, diagnoses, prescriptions and referrals.
- Account and access records: staff role, verification status, sign-in activity and audit events.
- Technical data: the minimum needed to run and secure the local service, such as session identifiers.
Why we collect it
Information is collected to register patients, deliver and coordinate care, maintain accurate records, support clinical review and referrals, generate the patient's own reports, and meet legal and operational obligations. It is not sold and is not used for advertising.
How it is protected
No system is perfectly secure. The clinic must keep the server patched, restrict physical access, use HTTPS where the network is not fully trusted, and store backups securely.
QR identity
A patient QR code contains only an opaque random token. It does not contain a name, diagnosis, medication or any other clinical data. Opening the token requires a signed-in staff account with the right role, and each retrieval is audit-logged. A lost QR code can be replaced without changing the medical record.
Sharing and disclosure
Clinical information is shared only with the care team involved in the patient's treatment, with authorised referrals, or where disclosure is required by law. Telemedicine media travels directly between participants where the network allows it; signalling messages coordinate the call and do not carry the consultation content.
Patient rights
Subject to applicable law, patients may request access to their record, ask for corrections, ask how their information is used, and raise a concern with the clinic. Requests should go to the clinic's designated data protection contact, whose details must be added by the deploying facility.
Who is responsible
The clinic that hosts PulseGrid is the data controller for the records it creates. The software is a local tool: the clinic decides who has access, how long records are retained and how backups are stored.
Retention
Records are kept for as long as required by clinical and legal obligations. Retention periods must be configured by the clinic and reviewed with local legal advice. Backups should follow the same retention and destruction rules as live records.
Incident response
If a breach is suspected, the clinic should contain access, preserve audit logs, notify the designated data protection contact and follow the notification duties that apply under Act 843 and other relevant rules.
Contact
Add the clinic's data protection contact before go-live.
Contact the clinic