Privacy policy

HOSPITAL360 is hospital management software made by Studio 13 Developers, Kampala, Uganda. It is used by hospitals and clinics to keep patient records, run their departments and bill for care, and by patients and parents through the patient portal. This policy explains what information HOSPITAL360 holds, why, who can see it and the choices you have. It applies to the website and to the HOSPITAL360 Android app, which opens the same website.

Who is responsible for your information

Each hospital that uses HOSPITAL360 decides what it records about its patients and staff and is responsible for those records under Uganda's Data Protection and Privacy Act, 2019. Studio 13 Developers provides and maintains the software. The public demonstration at www.studio13developers.com/hospital360 contains only synthetic (made-up) records; do not enter real patient information there.

Information held

• Patients: identity details (name, sex, date of birth, national ID number), contact details, next of kin and guardians, insurance or employer cover, visits, vital signs, clinical notes, diagnoses, test results, imaging reports, prescriptions, admissions, bills and payments, consents and message preferences.
• Staff accounts: name, work email and phone, role, professional registration number, sign-in times and the device address (IP) used.
• Portal accounts: name, email or phone number, and a password stored only in scrambled (hashed) form.
• Activity records: who opened, changed, printed or exported which record and when (the audit trail).

Why it is used

• To provide and coordinate care between departments (reception, triage, doctors, laboratory, imaging, pharmacy, wards).
• To bill for care, take payments and follow up unpaid bills and insurance claims.
• To send appointment reminders and results notices by SMS or email, only when the patient has agreed.
• To meet legal and reporting duties, and to keep the system secure.

HOSPITAL360 does not sell personal information, show advertising, or use third-party analytics or tracking.

Who can see it

• Only hospital staff whose role needs it. Clinical records are hidden from roles such as cashiers; sensitive notes need a recorded reason ("break-glass") and every viewing is logged.
• Patients and authorised parents or guardians, through the portal, see released results, discharge summaries, their own bills and appointments. A parent's access ends when the child turns 18.
• Service providers the hospital chooses, and only what they need: an SMS gateway for messages, MTN or Airtel mobile money to process a payment you start, and the hosting company. Other health systems receive records only when the hospital connects them, for example for a referral.

How it is protected

Encrypted connections (HTTPS), passwords stored in hashed form, two-step sign-in for sensitive roles, automatic sign-out when idle, private storage for documents, encrypted backups and a tamper-evident audit trail.

How long it is kept

Medical and billing records are kept for as long as the law and the hospital's records policy require; they are corrected by recorded amendments rather than deleted. Portal accounts are kept until you delete them.

Your rights

You may ask the hospital to see your records, to correct them, or to stop optional messages. Use the portal's Requests and Preferences sections, or ask at the hospital's records desk. You can delete your portal account at any time; see how to delete your account.

Not a medical device

HOSPITAL360 is records and administration software. It is not a medical device and does not diagnose, treat, cure, or prevent any medical condition. Always consult a qualified healthcare professional for medical advice, diagnosis or treatment.

Contact

Questions about this policy or the demonstration: hospital360@studio13developers.com. Questions about your records at a hospital: that hospital's records desk.