✨ Next-Gen Healthcare SaaS: Automated Safaricom M-Pesa STK Push & Multi-Branch EMR • 14-Day Free Trial

Healthcare Privacy & Data Protection

Privacy Policy

Briah Tech Clinic SaaS is committed to protecting the privacy, confidentiality, and integrity of healthcare data, medical records, and organizational information.

Last Updated: August 15, 2026•Version 2.4

1. Introduction & Scope

Briah Tech Clinic SaaS (“Briah Tech”, “we”, “us”, or “our”) operates a cloud-based multi-tenant Electronic Medical Records (EMR), Clinic Enterprise Resource Planning (ERP), laboratory, pharmacy, and billing platform.

This Privacy Policy explains our practices regarding the collection, processing, storage, and transfer of personal data and Protected Health Information (PHI) when healthcare organizations (“Tenants”), their staff (“Users”), and their patients interact with our platform and services.

2. Data Controller & Processor Roles

The Clinic as Data Controller

Your healthcare organization is the Data Controller of all patient records, medical charts, triage observations, lab tests, prescriptions, and billing transactions entered into the system.

Briah Tech as Data Processor

Briah Tech processes patient and clinical data strictly on behalf of and according to the instructions of the subscribing healthcare organization under our Business Associate / Data Processing terms.

3. Information We Collect

We collect and process the following categories of information:

Account & Organization Information: Clinic name, registration numbers, branch locations, authorized administrator names, business emails, billing addresses, and contact phone numbers.
Clinical & Patient Records (Handled for Tenants): Demographics, Medical Record Numbers (MRN), triage vitals, consultation notes, ICD-10 diagnostic codes, laboratory orders & results, prescriptions, dispensing records, and insurance claim metadata.
Payment & Billing Data: Transaction references, M-Pesa receipts, invoice items, and payment status. We do not store raw credit card numbers or banking PINs.
Technical & Audit Telemetry: Logins, IP addresses, session timestamps, user agent strings, and immutable system audit logs for medical record access compliance.

4. How We Use Information

Delivering clinical workflows, appointments, and doctor consultations

Processing laboratory orders, approvals, and diagnostic reports

Managing pharmacy inventory, prescription dispensing, and batches

Generating invoices, cashier receipts, and insurance claims

Maintaining healthcare audit trails and regulatory compliance

Sending appointment reminders via automated SMS/Email queues

5. Strict Multi-Tenant Data Isolation

Briah Tech Clinic SaaS enforces strict relational and logical tenant isolation at every architectural tier:

Database Level Isolation: Every query enforces tenant scoping with PostgreSQL Row Level Security (RLS). A user from Clinic A can never view, query, or infer records belonging to Clinic B.

Role-Based Access Control (RBAC): Granular permissions ensure staff members only see patient records relevant to their clinical role and branch.

6. Healthcare Regulatory Compliance

Our platform operations adhere to rigorous regional and international healthcare data privacy standards:

Kenya Data Protection Act (2019)

Full adherence to principles of lawfulness, data minimization, accuracy, purpose limitation, and respect for data subject rights registered with the Office of the Data Protection Commissioner (ODPC).

HIPAA / ISO 27001 Ready Safeguards

End-to-end encryption in transit (TLS 1.3) and at rest (AES-256), immutable audit logging, automated vulnerability scanning, and multi-factor authentication (MFA).

7. Data Retention & Backups

Medical records are preserved in accordance with statutory healthcare record-keeping mandates (typically 7 to 10 years depending on jurisdiction). We execute automated daily encrypted backups replicated across redundant availability zones. Finalized clinical amendments preserve historical versions without destructive data loss.

8. Subprocessors & Third-Party Integrations

We partner with vetted, industry-leading infrastructure providers under strict Data Processing Agreements:

Subprocessor	Service Provided	Data Transferred
Supabase / AWS	Encrypted Cloud Hosting & PostgreSQL Database	Encrypted application & database data
Safaricom (Daraja M-Pesa)	Mobile Money Payment Processing	Transaction amount & phone number for STK Push
Africa's Talking / Twilio	SMS Reminders & Notifications	Recipient phone number & reminder text
Resend	Transactional Email Dispatch	Email address & system notifications

9. Your Rights & Data Portability

Under applicable data protection laws, subscribing organizations and data subjects retain the right to:

Access and export clinical and organizational data in open, structured formats (CSV, JSON, PDF).
Request rectification of inaccurate demographic or administrative records.
Restrict processing or request account termination upon subscription completion.
Receive automated audit summaries of who accessed specific patient records.

10. Contact Our Data Protection Officer

If you have questions, compliance requests, or wish to exercise data protection rights, please contact our Data Protection Team:

Briah Tech Clinic SaaS — Data Protection Office

Email: hello@briahsolutions.com

Phone: +254 700 010 886 (WhatsApp available)

Address: 1st Floor Avenue House CBD, Kenyatta Avenue, Nairobi, Kenya (Postal Code: 00100)

✨ Next-Gen Healthcare SaaS: Automated Safaricom M-Pesa STK Push & Multi-Branch EMR • 14-Day Free Trial

Claim Free Trial

Healthcare Privacy & Data Protection

Privacy Policy

Briah Tech Clinic SaaS is committed to protecting the privacy, confidentiality, and integrity of healthcare data, medical records, and organizational information.

Last Updated: August 15, 2026•Version 2.4

1. Introduction & Scope

2. Data Controller & Processor Roles

The Clinic as Data Controller

Your healthcare organization is the Data Controller of all patient records, medical charts, triage observations, lab tests, prescriptions, and billing transactions entered into the system.

Briah Tech as Data Processor

Briah Tech processes patient and clinical data strictly on behalf of and according to the instructions of the subscribing healthcare organization under our Business Associate / Data Processing terms.

3. Information We Collect

We collect and process the following categories of information:

Account & Organization Information: Clinic name, registration numbers, branch locations, authorized administrator names, business emails, billing addresses, and contact phone numbers.
Clinical & Patient Records (Handled for Tenants): Demographics, Medical Record Numbers (MRN), triage vitals, consultation notes, ICD-10 diagnostic codes, laboratory orders & results, prescriptions, dispensing records, and insurance claim metadata.
Payment & Billing Data: Transaction references, M-Pesa receipts, invoice items, and payment status. We do not store raw credit card numbers or banking PINs.
Technical & Audit Telemetry: Logins, IP addresses, session timestamps, user agent strings, and immutable system audit logs for medical record access compliance.

4. How We Use Information

Delivering clinical workflows, appointments, and doctor consultations

Processing laboratory orders, approvals, and diagnostic reports

Managing pharmacy inventory, prescription dispensing, and batches

Generating invoices, cashier receipts, and insurance claims

Maintaining healthcare audit trails and regulatory compliance

Sending appointment reminders via automated SMS/Email queues

5. Strict Multi-Tenant Data Isolation

Briah Tech Clinic SaaS enforces strict relational and logical tenant isolation at every architectural tier:

Database Level Isolation: Every query enforces tenant scoping with PostgreSQL Row Level Security (RLS). A user from Clinic A can never view, query, or infer records belonging to Clinic B.

Role-Based Access Control (RBAC): Granular permissions ensure staff members only see patient records relevant to their clinical role and branch.

6. Healthcare Regulatory Compliance

Our platform operations adhere to rigorous regional and international healthcare data privacy standards:

Kenya Data Protection Act (2019)

Full adherence to principles of lawfulness, data minimization, accuracy, purpose limitation, and respect for data subject rights registered with the Office of the Data Protection Commissioner (ODPC).

HIPAA / ISO 27001 Ready Safeguards

End-to-end encryption in transit (TLS 1.3) and at rest (AES-256), immutable audit logging, automated vulnerability scanning, and multi-factor authentication (MFA).

7. Data Retention & Backups

8. Subprocessors & Third-Party Integrations

We partner with vetted, industry-leading infrastructure providers under strict Data Processing Agreements:

Subprocessor	Service Provided	Data Transferred
Supabase / AWS	Encrypted Cloud Hosting & PostgreSQL Database	Encrypted application & database data
Safaricom (Daraja M-Pesa)	Mobile Money Payment Processing	Transaction amount & phone number for STK Push
Africa's Talking / Twilio	SMS Reminders & Notifications	Recipient phone number & reminder text
Resend	Transactional Email Dispatch	Email address & system notifications

9. Your Rights & Data Portability

Under applicable data protection laws, subscribing organizations and data subjects retain the right to:

Access and export clinical and organizational data in open, structured formats (CSV, JSON, PDF).
Request rectification of inaccurate demographic or administrative records.
Restrict processing or request account termination upon subscription completion.
Receive automated audit summaries of who accessed specific patient records.

10. Contact Our Data Protection Officer

If you have questions, compliance requests, or wish to exercise data protection rights, please contact our Data Protection Team:

Briah Tech Clinic SaaS — Data Protection Office

Email: hello@briahsolutions.com

Phone: +254 700 010 886 (WhatsApp available)

Address: 1st Floor Avenue House CBD, Kenyatta Avenue, Nairobi, Kenya (Postal Code: 00100)

Privacy Policy

Table of Contents

1. Introduction & Scope

2. Data Controller & Processor Roles

The Clinic as Data Controller

Briah Tech as Data Processor

3. Information We Collect

4. How We Use Information

5. Strict Multi-Tenant Data Isolation

6. Healthcare Regulatory Compliance

Kenya Data Protection Act (2019)

HIPAA / ISO 27001 Ready Safeguards

7. Data Retention & Backups

8. Subprocessors & Third-Party Integrations

9. Your Rights & Data Portability

10. Contact Our Data Protection Officer

Privacy Policy

Table of Contents

1. Introduction & Scope

2. Data Controller & Processor Roles

The Clinic as Data Controller

Briah Tech as Data Processor

3. Information We Collect

4. How We Use Information

5. Strict Multi-Tenant Data Isolation

6. Healthcare Regulatory Compliance

Kenya Data Protection Act (2019)

HIPAA / ISO 27001 Ready Safeguards

7. Data Retention & Backups

8. Subprocessors & Third-Party Integrations

9. Your Rights & Data Portability

10. Contact Our Data Protection Officer