How Labsynk handles health information.

Labsynk is a product of Mudeer Technologies Ltd ("Labsynk", "we", "us"). This policy covers the Labsynk platform (the facility software, the patient app and the SMS, WhatsApp and USSD services) and the labsynk.com website.

Questions about this policy or your information can be sent to hello@labsynk.com.

What we hold depends on how you use Labsynk:

• Facility accounts: the name, type and location of a facility, and details of its staff users, such as names, roles, professional licence numbers, work contact details and sign-in activity.
• Patient records processed on behalf of facilities: the clinical and administrative information a facility records while caring for a patient, such as demographics, visits, diagnoses, prescriptions, lab and imaging results, vital signs, allergies, billing and insurance (HMO) details.
• Patient app data: your Labsynk Health ID, contact details, family members you manage, access permissions you grant or revoke, appointments, reminders and app settings.
• Website forms: the details you send us when you book a demo or contact us, such as your name, facility, country, phone number, email and message.
• Technical information: device and browser type, IP address, and logs needed to keep the service secure and working.

We do not use patient records for advertising, and we do not sell personal information.

Facilities decide why and how they record clinical information about their patients. For those clinical records, the facility is the controller and Labsynk processes the records on the facility's instructions, under an agreement with that facility.

For facility accounts, the patient app and our website, Labsynk decides how the information is used and is responsible for it.

Patients keep their rights over their own information in both cases. Where a facility is the controller, we will help that facility respond to your requests, and you can also contact us directly.

A facility on the Labsynk network can see your record held by other facilities only when you grant access. You can grant or revoke access to any facility from your phone, and you can see every time your record is opened.

Emergency access: if you are brought to a facility and can't give consent, for example because you are unconscious, a clinician can open your emergency summary (blood group, genotype, allergies and current medicines). Every emergency access is logged, and you are notified.

Within a facility, staff see what their role needs. Access is recorded in a permanent log that the patient can view.

• To provide the platform: running facility workflows, sending prescriptions and lab orders where you or your clinician direct them, and delivering results.
• To keep it safe: detecting misuse, securing accounts and investigating incidents.
• To support facilities: migration, training and help after launch.
• To reply to you: answering demo requests and messages.
• To improve Labsynk: using usage information about how the software is used. Where we use health information to improve the product, we will use it only as allowed by the facility's agreement and the law, and in de-identified form where we can.
• To meet legal duties: for example, reports a facility is required to file with health authorities, which the facility directs.

Labsynk AI helps clinicians with tasks like drafting consultation notes, summarising a patient's history and flagging early risk. AI output is a draft or suggestion. A qualified clinician reviews every suggestion and makes every decision. AI never diagnoses or prescribes on its own.

Patients can opt out of AI processing of their record at any time from the patient app, or by asking their facility or us. Opting out does not affect the care you receive.

We will describe the AI providers we use, where processing happens and how long inputs are kept in a list available on request, and update it when it changes.

• Facilities you grant access to, and the pharmacy or laboratory you or your clinician choose for a prescription or test.
• Your HMO or insurer, when a facility submits an eligibility check, pre-authorisation or claim for your care.
• Service providers who help us run Labsynk, such as hosting and messaging providers, under contracts that limit what they may do with the information.
• Health authorities, courts or regulators when the law requires it.
• A buyer or successor if Mudeer Technologies Ltd or Labsynk is reorganised or sold, under the same protections.

Information is encrypted in transit and at rest, and hosted in your region where local law requires it, under the data protection laws that apply to you. Where information must move between countries, we will use safeguards the law allows.

Clinical records are kept for as long as the facility instructs, in line with the medical record retention rules that apply to that facility. Facility account information is kept while the account is active and for a limited period afterwards. Website form submissions are kept only as long as needed to respond and follow up. Access logs are kept for as long as the record they relate to.

Specific retention periods will be set out here after counsel review.

We designed Labsynk around privacy: encryption in transit and at rest, role-based access, and a permanent log of who opened what and when. No system is perfectly secure. If a breach affects your information, we will tell the affected facilities, and you where required, as the law requires.

Depending on where you live, you can ask to:

• Access the information held about you, and get a copy.
• Correct information that is wrong or incomplete.
• Delete information, where the law allows. Some clinical records must be kept for a set time even if you ask.
• Take your information with you in a portable format (portability).
• Object to or restrict some uses, including AI processing.
• Withdraw consent you have given, such as access granted to a facility.

Send requests to hello@labsynk.com or use the patient app. Where a facility controls the record, we will pass your request to them and help them answer it. You can also complain to your data protection authority.

Parents and guardians can manage records for their children in the patient app. Adults can manage records for other family members only with their permission or legal authority.

We will update this policy as Labsynk changes and tell you about important changes in the app or by email. Contact: hello@labsynk.com. Mudeer Technologies Ltd.