Privacy policy.
How the MedX group handles personal data. Version 1.0, October 2026.
Country and product policies
Where a country's law or a product needs its own policy, that policy applies alongside this one:
- Kenya: MedX Technologies Kenya Ltd, for MedX Workspace in Kenya.
- MedX Assistant (browser extension)
1. Who we are
MedX builds software that connects laboratories, health facilities, diagnostic devices and health programmes. The MedX group is:
- Med X International Limited (Uganda, registration no. 80020001873866), Plot 4, Old Kira Road, Kampala, which develops and supports MedX software and runs this website; and
- MedX Technologies Kenya Ltd, Woodvale, Woodvale Street, Westlands, Nairobi, which provides MedX software in Kenya (see the Kenya privacy policy).
In this policy "MedX", "we" and "us" mean the MedX company you deal with. We follow the data protection laws of the countries we work in, including Uganda's Data Protection and Privacy Act, 2019 and Kenya's Data Protection Act, 2019.
2. Our two roles
- For patient data we are a data processor. Laboratories, hospitals, clinics and health programmes use our software to hold their patients' records. The facility or programme is the data controller: it decides what is collected and why, and we process the data only on its instructions, under a written contract. If you are a patient, contact the facility that tested or treated you; its privacy notice applies to your record.
- For our own business data we are a data controller. This covers visitors to this website, people who contact us, our customers and partners, and the user accounts of the staff who use our software.
3. What we collect, and why
| Data | Why we use it | Lawful basis |
|---|---|---|
| What you send us through the contact or demo form: name, email, organisation, role, what you are interested in and your message. | To reply to you and arrange a demonstration. | Your request (steps before a contract), and our legitimate interest in answering enquiries. |
| Emails, calls and meetings with customers, partners and suppliers. | To run contracts, support, billing and the business relationship. | Performance of a contract; legal obligations such as tax records; legitimate interest. |
| Website usage: the pages you view, the address you came from, your browser and device type, and an approximate location derived from your IP address. | To understand which pages are useful and improve the website. | Legitimate interest. |
| Staff user accounts in our software: name, work contact details, role, facility, sign-in records and the audit trail of actions taken. | To provide accounts, keep the software secure and keep records accountable. | Performance of our contract with the facility; legitimate interest; the facility's legal duty to keep records. |
| Patient data in our software. | To provide the service on the facility's or programme's behalf. | The facility's lawful basis, on whose instructions we act (section 2). |
We do not sell personal data, and we do not use patient data for marketing. Only aggregated or de-identified data, which does not identify any patient, is used for service statistics or, where the facility agrees, research.
4. Cookies and browser storage on this website
- Analytics. We use PostHog to count page views. It sets a cookie that recognises a returning browser. We do not use it to identify you, and we do not use advertising cookies.
- Your theme choice. If you switch between light and dark mode, your browser remembers the choice in its local storage. It never leaves your device.
You can block or delete cookies in your browser settings; the website still works without them.
5. Who we share data with
- Other MedX group companies, where they provide or support the service you use.
- Service providers who work for us under written terms: Google Workspace (email, messaging and documents), PostHog (website analytics), and the hosting providers that run our website and software.
- For patient data, only those the facility or programme directs, such as a referral laboratory, a national health information exchange or a public health authority where the law requires reporting.
- Regulators, courts or the police, where the law requires us to.
Patient data is hosted where the contract with the facility or programme says, normally in the country of the facility. A country policy lists the providers used there.
6. International transfers
Website analytics and our Google Workspace tools are run by providers outside Uganda and Kenya, including in the United States. Where we send personal data to another country, we do so under the safeguards the applicable data protection law requires, such as the provider's data processing terms.
7. How long we keep data
| Data | How long |
|---|---|
| Website enquiries that do not lead to a contract | 2 years after our last contact |
| Customer, contract and billing records | 7 years after the contract ends |
| Website analytics | As set in our analytics tool, no longer than 2 years |
| Patient data and staff accounts in our software | As the facility or programme decides, and as set out in the country policy |
8. How we protect data
Access is limited to the people who need it, with individual accounts and multi-factor authentication for our staff. Data is encrypted in transit and, in our software, at rest. Our software keeps an audit trail of who changed which record. If a personal data breach affects a facility's data, we tell the facility promptly so that it can meet its own duties to the regulator and to the people affected.
9. Your rights
Depending on the law that applies to you, you have the right to:
- be told how your personal data is used;
- access the personal data we hold about you;
- have inaccurate data corrected;
- have data deleted where there is no longer a lawful reason to keep it;
- object to, or ask us to restrict, how we use it;
- receive your data in a machine-readable format.
For your own data, email privacy@medx.international. For a patient record, contact the facility that holds it; if you contact us, we pass the request to the facility and help it respond. We may ask you to confirm your identity first. There is normally no charge.
10. Complaints
Please contact us first at privacy@medx.international. You can also complain to the data protection regulator where you live: in Uganda, the Personal Data Protection Office (pdpo.go.ug); in Kenya, the Office of the Data Protection Commissioner (odpc.go.ke).
11. Changes to this policy
We review this policy at least once a year and publish any new version on this page with its date. Where a change matters to our customers, we tell them.
12. Contact us
| Privacy requests | privacy@medx.international |
|---|---|
| Med X International Limited | Plot 4, Old Kira Road, Kampala, Uganda |
| MedX Technologies Kenya Ltd | Woodvale, Woodvale Street, Westlands, Nairobi; P.O. Box 70423-00100 GPO Nairobi |
| General enquiries | info@medx.to |