Privacy Policy

1. Who We Are

Yeabe Dialysis Speciality Clinic, located at 2Q88+99M, back of Nega City Mall, Ologo Apartment, Addis Ababa, Ethiopia, operates the TrityMed mobile and web application (“the App”) to support dialysis and related clinical care. This policy explains what personal and health information we collect, why, how we protect it, and what rights you have over it.

Contact for privacy questions: yeabemedical@gmail.com

Data Protection / Privacy Officer: Yeabe Dialysis Speciality Clinic Privacy and Security Officer.

2. Data Ownership

You are the ultimate owner of your health data. This is a foundational principle of the Ethiopian national EHR standard. We are the custodian and processor of your data on your behalf and on behalf of your care providers, not its owner.

3. Information We Collect

3.1 Identity and demographic information

Full name, date of birth, sex, address (region, zone/sub-city, woreda, kebele, house number), phone number, email, marital status, occupation, preferred language, and emergency contact.

3.2 Health information

Medical record number (MRN), diagnoses, treatment history, dialysis session records, vital signs, laboratory results, medications, vascular access information, allergies, immunization history, clinical notes, referral and consultation records, and incident records.

3.3 Account and usage information

Login credentials, stored as a secure hash and never in plain text; one-time password (OTP) verification records; session and device information; and in-app activity logs.

3.4 Billing and insurance information

Insurance policy details, billing and payment records, and claims status.

4. Why We Collect It

We process your information to:

• Provide dialysis and related clinical care, including scheduling, treatment documentation, and follow-up.
• Communicate with you about appointments, treatment, and your care team.
• Process billing and insurance claims.
• Meet legal, regulatory, and reporting obligations to the Ministry of Health and other competent authorities.
• Maintain the security, integrity, and audit trail of your medical record.
• Improve the quality and safety of care through de-identified or aggregate use only, unless you separately consent to identified research use.

We do not sell your personal or health information.

5. Consent

By registering for and using TrityMed, you are asked to give explicit consent to this policy. We record the date, time, and version of the policy you consented to. You may:

• Withdraw consent for non-essential processing, such as marketing communications, at any time in Settings.
• Request a copy of your data.
• Request correction of inaccurate data.
• Request that your account be deactivated.

Consent for clinical data collection necessary to provide safe dialysis care cannot be withdrawn while you remain an active patient of the clinic, as withdrawing it would prevent us from safely treating you. You may still request deactivation of your record when you are no longer receiving care.

6. Who Can Access Your Data

Access is restricted by role and limited to what each role needs to perform its duties, following least-privilege access principles:

• Your treating physicians, nurses, and dialysis technicians.
• Laboratory, pharmacy, dietitian, and social work staff involved in your care, where applicable.
• Billing and insurance staff, limited to billing-relevant information.
• Administrative staff, limited to non-clinical account and scheduling data.
• System administrators, for technical operation only and under audit.

Every access to your record is logged: who accessed it, what they did, when, and from where. These logs cannot be altered or deleted.

We do not share your data with third parties for their own marketing purposes. We may share data:

• With other health facilities, at your request or your care team’s request, for continuity of care, such as referrals.
• With the Ministry of Health and national health information systems, where required by law or national EHR interoperability requirements.
• With service providers who process data strictly on our behalf under contract, such as cloud-hosting providers, and who are bound by confidentiality obligations.
• Where required by law, court order, or to prevent serious harm.

7. How We Protect Your Data

• All data in transit is encrypted using TLS/HTTPS.
• Data at rest is encrypted.
• Multi-factor authentication is required for account access.
• Role-based access control and least-privilege enforcement are used.
• Comprehensive, tamper-resistant audit logging records all record access.
• Regular security testing and vulnerability management are performed.
• Staff are trained on privacy and security obligations, and access is revoked promptly when no longer needed, including after staff departure.

No system is 100% secure. If a breach occurs that affects your information, we will notify affected individuals and the competent authority without undue delay, consistent with applicable law.

8. Data Retention

Consistent with the national EHR standard, we do not permanently delete health records, including after account closure, because medical records must remain available for continuity of care, legal, and public health purposes. Instead, inactive or closed records are deactivated and access is restricted, with the deactivation date recorded against your record.

Non-clinical data, such as marketing preferences and device tokens, is deleted upon request or after 24 months of inactivity, unless it must be retained for a legitimate legal, security, or operational purpose.

Clinical record retention periods follow applicable Ethiopian health record retention requirements, Ministry of Health guidance, and Yeabe Dialysis Speciality Clinic’s approved record-retention policy.

9. Your Rights

You have the right to:

• View your own health information through the patient portal. This is view-only; edits and deletions to the clinical record must go through your care team.
• Request correction of inaccurate demographic or contact information.
• Request a copy of your records.
• Ask who has accessed your record and when.
• File a complaint with us, or with the competent Ethiopian authority, about how your data has been handled.

10. Children and Dependents

Where a patient is a minor or is unable to manage their own account, an authorized caregiver or legal representative may register and act on the patient’s behalf. We verify the caregiver’s authority before granting access.

11. International Users / App Store Distribution

TrityMed is operated by Yeabe Dialysis Speciality Clinic in Ethiopia and is intended primarily for patients of that facility. It may be distributed through international app stores for accessibility. Regardless of where you access the App from, your health data is processed under Ethiopian law and the safeguards described in this policy.

12. Changes to This Policy

We may update this policy as our practices, the law, or the national EHR standard evolve. We will notify you of material changes in-app and request renewed consent where required.

13. Contact Us