eMed Assistant Logo

Privacy Policy

eMed Care LK (“we,” “our,” or “us”) provides a digital healthcare management platform designed to streamline clinical and administrative workflows. We are committed to protecting the privacy and security of personal and health information in accordance with applicable data protection laws, including Sri Lanka’s Personal Data Protection Act (PDPA) No. 9 of 2022, and, where applicable, the U.S. Health Insurance Portability and Accountability Act (HIPAA).

1. Data Controller Vs. Data Processor

Data Controller

eMed Care LK acts as Data Controller for user account management, billing, website analytics, and customer support services.

Data Processor

For patient records and clinical data, the contracting healthcare provider acts as Data Controller. eMed Care LK acts as Data Processor on their behalf.

2. Personal Data We Collect

  • Account & Contact Info: Name, email address, mobile number, professional role, clinic/organisation details, login credentials, and billing records.
  • Patient & Health Data: Names, identification numbers, medical histories, consultation notes, diagnoses, prescriptions, treatment logs, and queue records. Health data is treated as sensitive personal data subject to additional legal safeguards.
  • Technical & System Logs: IP address, device identifiers, browser specifications, access timestamps, audit logs, and security monitoring events.
  • Communications: Support queries, feedback submissions, and administrative correspondence.

3. How We Use Personal Data & Lawful Grounds

Data processing is conducted under lawful bases (contract performance, legal obligations, legitimate business interests, or explicit consent) to:

  • Operate, deliver, and maintain the eMed Care LK digital health platform.
  • Streamline patient record-keeping, appointment scheduling, and clinical workflows.
  • Deliver technical support, system security monitoring, and updates.
  • Ensure data backups, business continuity, and regulatory compliance.

Medical Disclaimer: eMed Care LK does not provide medical advice or execute clinical decisions. All diagnostic and treatment decisions remain the sole responsibility of qualified healthcare professionals.

4. Health Data & Children's Privacy

Sensitive Safeguards: Strict role-based access protocols and advanced technical measures restrict access to health records exclusively to authorized personnel.

Minor Safety: Healthcare organizations must secure appropriate parental/guardian consent before processing minor patient data. Platform access for legal guardians is granted solely through organizational authorization.

5. Access Control & Security Governance

Access permissions are governed through strict role-based controls within the platform:

  • Doctors / Locum Doctors: Authorized access to clinical patient data necessary for medical care.
  • Assistants: Restricted access limited to administrative and queue functions.
  • Patients: Self-service portal access where enabled by the provider.
  • System Administrators: Strictly audited and logged access for maintenance and operational integrity.

Security Infrastructure

Data is protected via encryption in transit and at rest, role-based controls, comprehensive audit logging, system monitoring, regular security reviews, and structured incident response procedures.

6. Data Sharing & Cross-Border Transfers

We do not sell or rent personal data. Information is disclosed strictly to:

  • Healthcare Organizations: Permitted personnel within the user's designated medical practice.
  • Vetted Sub-processors: Cloud hosting, security, infrastructure, and communication providers bound by strict Data Processing Agreements (DPAs).
  • Legal & Regulatory Bodies: When legally mandated by court order or statutory requirement.
  • Cross-Border Transfers: International data flows are subject to legally recognized transfer mechanisms and data protection standards.

7. Data Retention & Breach Protocol

Data is retained only as long as necessary for clinical, contractual, or legal requirements. Patient record retention parameters are determined by the managing healthcare provider.

In the event of a security incident, eMed Care LK maintains strict assessment, containment, and notification protocols in compliance with applicable laws.

8. Individual Data Rights

Subject to statutory limits, individuals hold rights to request access, correction, deletion, or restriction of their personal data, withdraw consent, or lodge complaints with the Data Protection Authority of Sri Lanka. Patients seeking data access should contact their healthcare clinic directly.

9. Cookies & User Responsibilities

Cookies are used for platform security and navigation. Users are responsible for keeping credentials secure, maintaining confidentiality, and reporting unauthorized activity promptly.

10. Contact Information

For privacy queries, data rights requests, or operational concerns, please contact us:

Registered Address: 411/2/B/1, Athurugiriya Rd, Malabe 15116, Sri Lanka.
Email Address: [email protected]
Contact Telephone: 0707077323
Official Website: emedcare.lk