This policy explains how H-Link Health (“H-Link”, “we”, “us”) handles personal data in two places: on this website, and on the H-Link platform that healthcare organisations use to run their facilities.
1. Our role
On the platform, the healthcare organisation (the “Tenant”) decides what patient data is recorded and why. The Tenant is the data controller, and H-Link is its data processor. Patients who want to exercise their rights over their records should contact the facility that treated them; we will help the facility respond.
On this website, H-Link is the controller of the information you send us through our forms.
For people in Ghana, the Data Protection Act, 2012 (Act 843) applies in both cases.
2. What we collect
- Website enquiries. When you request a demo, apply for the pilot or contact us, we receive what you type into the form — typically your name, role, organisation, email address and phone number — together with the page you sent it from and any campaign tags in the link you followed.
- Website analytics. We count page visits using a privacy-focused analytics service that sets no cookies and does not identify individual visitors.
- Platform users. For each member of staff: name, email address, role, facility and sign-in credentials (passwords are stored only as salted hashes).
- Patient data. Clinical and administrative data that facility staff record: demographics, encounters, diagnoses, prescriptions, laboratory results, imaging, billing and insurance information.
- Operational data. Technical logs used to run, secure and troubleshoot the platform.
3. How we use it
We use personal data to provide, secure and support the platform; to answer your enquiries and, where you asked us to, arrange a demo or assess a pilot application; and to meet our legal obligations. We do not sell personal data, and we do not use patient data for marketing.
4. Where it is stored
The platform and its data are hosted by Amazon Web Services in the United States (us-east-1). Some features send data to the service providers listed below. Most are in the United States; some are based elsewhere, including in Ghana, Nigeria and Kenya. When your facility onboards, we work through the Act 843 requirements for this with you.
5. Sub-processors
| Provider | What it does for us | What it receives |
|---|---|---|
| Amazon Web Services | Hosting, databases, file storage | All platform data |
| Modal | GPU hosting for AI models we operate | Clinical text, images and audio sent to AI features |
| Google (Gemini) | AI model provider | Clinical text sent to some AI features, including questions typed into the knowledge assistant |
| OpenAI | AI model provider | Text sent to some AI features |
| Anthropic | AI model provider | Text sent to some AI features |
| LiveKit | Video consultations | Participant names and the live audio and video of the call |
| Cloudflare | DNS, bot protection on website forms, and relaying video-call traffic | Technical request data and IP addresses; video-call media, which stays encrypted |
| SendGrid (Twilio) | Email delivery | Recipient address and message content |
| Twilio, Hubtel, Arkesel, Africa’s Talking, Textbelt | SMS delivery | Phone number and message content |
| Twilio | WhatsApp messages; back-up provider for video consultations and for relaying video-call traffic | Phone number and message content; participant names and call audio and video when it carries a call |
| Google (Firebase Cloud Messaging) | Mobile app notifications | Device identifier and notification content |
| Paystack, Stripe, Hubtel | Payment processing, where a payment is taken through H-Link | Payer’s name, email address or phone number, the amount and a payment reference |
| Sentry | Error monitoring | Technical error reports |
| Google Fonts | A barcode font on some printed laboratory labels | The browser’s IP address |
| Plausible Analytics | Cookie-free website analytics | Anonymous page-view data (website only) |
We will update this list before adding a sub-processor that receives patient data.
6. Security
The controls protecting platform data — and the ones not yet in place — are described on our security page.
7. Retention
Website enquiries are kept while we are in discussion with you and for up to two years afterwards, unless you ask us to delete them sooner. Platform data is kept for the length of the Tenant’s subscription. When a subscription ends, the Tenant can export its clinical records in FHIR R4 format. At the Tenant’s written request, we then return or delete the Tenant’s data as set out in the Tenant’s agreement, except where the law requires us to keep it. Deletion is carried out by our team on request; the platform does not yet delete records automatically on a schedule.
8. Your rights
You can ask us for a copy of the personal data we hold about you from this website, and ask us to correct or delete it. For patient records, contact the facility; it controls those records and we will help it respond. You can also complain to Ghana’s Data Protection Commission.
9. Contact
Privacy questions and requests: info@h-link.solutions.