In short. For our website, sales and customer accounts, Flexify Ltd decides how personal data is used (we are the controller). For patient and staff records inside Hospify Pro, the hospital, clinic, diagnostic centre or pharmacy decides (they are the controller) and we only process that data on their instructions (we are the processor). We never sell personal data, and we never use patient data for advertising.
1. Who we are
Hospify Pro is a product of Flexify Ltd, a company registered in England and Wales (company number 16871618), with an office in Dhaka, Bangladesh. In this policy “we”, “us” and “our” mean Flexify Ltd.
This policy applies to hospify.pro, our demo and marketing pages, the Hospify Pro web, mobile and desktop applications, the Hospify Local Server and lab connectors, and our sales, billing and support communications.
We process personal data in line with the UK General Data Protection Regulation (UK GDPR), the Data Protection Act 2018 and, where they apply to our customers or to us, the data protection and health information laws of Bangladesh and other countries where Hospify Pro is used.
2. Our two roles
| Data | Our role | Who to contact |
|---|---|---|
| Website visitors, enquiries, demo and trial requests | Controller | Us |
| Customer account owners and Users (name, email, phone, role, login, activity logs) | Controller | Us |
| Billing, invoices and payment records | Controller | Us |
| Support conversations (WhatsApp, email, phone) | Controller | Us |
| Patient, doctor, referrer and staff records entered into Hospify Pro by a healthcare provider | Processor on behalf of that provider | The hospital, clinic, diagnostic centre or pharmacy |
3. Data we collect
From website visitors and prospects
- Information you give us in forms or messages: name, email, phone or WhatsApp number, facility name and type, country, number of users or branches, and your message.
- Usage information collected by Google Analytics and the Meta Pixel: pages viewed, approximate location (country/city), device and browser type, referring site and interactions. See our cookie policy.
- Technical logs kept by our hosting and security providers: IP address, browser, date and time of requests, used to keep the website secure.
From customers and Users
- Account data: facility name, address, registration details, account owner and User names, email, phone, role and permissions.
- Billing data: plan, invoices, payment method type and transaction references. Card and mobile-wallet details are handled by the payment provider; we do not store full card numbers or wallet PINs.
- Usage and security data: login times, IP address, device and browser, actions recorded in the audit log, error reports and performance data.
- Support data: messages, call notes and screenshots you send us.
Inside Hospify Pro (processed for our customers)
Healthcare providers record data such as patient identifiers, contact details, demographics, appointments, prescriptions, diagnoses, vitals, test orders and results, images, bills and payments; doctor and referrer details; and staff attendance, rosters and payroll. This includes health data, which is a special category of personal data. See section 5.
4. How and why we use data (as controller)
| Purpose | Lawful basis (UK GDPR) |
|---|---|
| Replying to enquiries, arranging demos and trials | Legitimate interests; steps before entering a contract |
| Creating and running customer accounts, providing the Service and support | Performance of a contract |
| Billing, collecting payments, accounting and tax records | Contract; legal obligation |
| Service, security and billing notices | Contract; legitimate interests |
| Keeping the Service and website secure, preventing fraud and abuse, audit logging | Legitimate interests; legal obligation |
| Measuring and improving the website and Service (analytics) | Legitimate interests or consent, as required for cookies |
| Product news and marketing to business contacts | Legitimate interests or consent; you can opt out at any time |
| Complying with law and responding to lawful requests from authorities | Legal obligation |
| Establishing, exercising or defending legal claims | Legitimate interests |
5. Patient and staff data in Hospify Pro
5.1 Each healthcare provider using Hospify Pro is the controller of the patient and staff data it records and is responsible for having a lawful basis, giving patients any required information, and obtaining any required consent (for example to receive reports by WhatsApp).
5.2 We process that data only as a processor, on the provider’s documented instructions, to host, store, back up, secure, transmit and display it and to provide support, under our Data Processing Agreement. We do not use patient data for our own purposes, for advertising or for selling, and we do not share it except with the sub-processors needed to run the Service.
5.3 If you are a patient and want to access, correct or delete your records, please contact the hospital, clinic, diagnostic centre or pharmacy that treated you. If you contact us, we will pass your request to that provider and help them respond.
5.4 Support staff may access customer data only when needed to resolve a support request or security issue, with the customer’s permission where practical, and every access is logged.
6. Who we share data with
We share personal data only with service providers that help us run Hospify Pro and our business, under contracts that require them to protect it, and only as needed for their service:
- Cloud hosting, storage and backup providers, including Wasabi for encrypted off-site backups and a second backup provider for an immutable copy;
- Network, DNS and security providers, such as Cloudflare;
- Messaging providers: WhatsApp Business Platform (Meta) and SMS gateways and mobile network operators, to deliver reports, prescriptions, bills and reminders;
- Payment providers: bKash, Nagad, SSLCommerz, Stripe and PayPal;
- Website providers: Hostinger (website hosting), Web3Forms (form delivery), Google Analytics (website analytics) and Meta (Facebook ad measurement);
- Email, communication and support tools used to talk to customers;
- AI model providers, only when a customer turns on the AI Assistant (see section 12);
- our professional advisers (lawyers, accountants, auditors) and insurers;
- authorities, courts or regulators where the law requires it;
- a buyer or successor if our business is reorganised, sold or merged, subject to this policy.
A current list of sub-processors that handle customer data is available to customers on request at [email protected]. We do not sell or rent personal data.
7. International transfers
We operate from the United Kingdom and Bangladesh, and our service providers may store or process data in other countries. Where personal data is transferred outside the UK, we use appropriate safeguards such as UK adequacy regulations, the UK International Data Transfer Agreement or Addendum to the EU Standard Contractual Clauses, together with encryption and access controls. Where a customer needs its data hosted in a particular country, or on its own on-premise server, this can be agreed in an Enterprise or on-premise agreement.
8. How long we keep data
| Data | Retention |
|---|---|
| Enquiries and demo requests that do not become customers | Up to 24 months after last contact |
| Customer account data | For the life of the subscription, then 30 days for export |
| Patient and staff data inside Hospify Pro | As instructed by the customer; deleted 30 days after the account ends, then removed from backups as they rotate out (normally within 90 days) |
| Invoices and accounting records | As long as tax and company law requires (normally 6 years in the UK) |
| Security and audit logs | Up to 24 months, or longer if needed for an investigation |
| Support conversations | Up to 36 months |
| Analytics data | Up to 14 months in Google Analytics |
9. Security and breaches
We protect data with measures appropriate to health information, including a separate encrypted database for each facility, encryption in transit and at rest, role-based access, two-factor authentication options, audit logs, staff confidentiality obligations and daily encrypted off-site backups. See our security page.
No method of transmission or storage over the internet is completely secure, and we cannot guarantee absolute security against hacking or other cyberattacks. If a personal data breach occurs, we will act promptly to contain it, notify affected customers without undue delay, and notify the relevant regulator and individuals where the law requires.
10. Your rights
Subject to the law that applies to you, you have the right to:
- access a copy of your personal data;
- correct inaccurate or incomplete data;
- ask us to delete your data;
- restrict or object to our processing, including objecting to direct marketing at any time;
- receive your data in a portable format;
- withdraw consent where processing is based on consent.
To exercise a right, email [email protected]. We may need to verify your identity, and we will respond within one month. For patient records held by a healthcare provider, see section 5.3.
We do not make decisions about individuals based solely on automated processing that produce legal or similarly significant effects.
11. Marketing
We may send business contacts occasional news about Hospify Pro by email or WhatsApp. Every message includes a way to opt out, or you can tell us at any time. We never send marketing to patients whose data is held in Hospify Pro.
12. AI features
The AI Assistant is an optional add-on that a customer chooses to turn on. When used, the minimum data needed for the request (for example a report or a summary of a visit) is sent securely to an AI model provider to generate a suggestion, which a qualified professional must review. We use providers that do not use this data to train their models, and we remove direct identifiers where practical. Customers can turn the AI Assistant off at any time.
13. Children
Our website and Service are intended for businesses and healthcare professionals, not children. Healthcare providers may record data about patients who are children; they are responsible, as controller, for handling that data lawfully, including obtaining consent from parents or guardians where required.
14. Changes to this policy
We may update this policy as our Service or the law changes. We will post the new version on this page with the “last updated” date, and tell customers about significant changes by email or in the Service.
15. Contact and complaints
For any privacy question or request, contact Flexify Ltd at [email protected] or write to 82A James Carter Road, Mildenhall, Bury St Edmunds IP28 7DE, United Kingdom.
If you are unhappy with how we handle your data, please contact us first so we can try to put it right. You also have the right to complain to the UK Information Commissioner’s Office (ico.org.uk) or to the data protection authority in your own country.
Flexify Ltd, registered in England and Wales (company number 16871618), 82A James Carter Road, Mildenhall, Bury St Edmunds IP28 7DE, United Kingdom. Bangladesh office: Flexify Ltd, 752/2 West Shewrapara, Begum Rokeya Sarani, Mirpur, Dhaka-1216. Email [email protected].
