Privacy Policy

This Privacy Policy explains how Curiaq Hospital (“Curiaq”, “we”, “us”) collects, uses, shares and protects personal information when you visit our website, request a demonstration, or use the Curiaq hospital and clinic management software (“the Services”). We wrote it to be read, not skimmed, so it is organised around the questions people usually ask.

1. Two different roles we play

When you browse our website, contact us or become a customer contact, Curiaq decides why and how your information is used and acts as the data controller.

When a hospital, clinic or diagnostic centre (“Customer”) stores patient, staff or operational data inside the Curiaq software, the Customer is the controller of that data and Curiaq acts as a data processor, handling it only on the Customer’s documented instructions and under a written data processing agreement. Patients who want to access, correct or delete their medical information should contact their healthcare provider directly; we will support the provider in responding.

2. Information we collect

Information you give us

• Contact details such as name, job title, organisation, email address and phone number when you fill in a demo request or contact form.
• Information about your facility — for example bed count, departments and current software — that you choose to share so we can tailor a proposal.
• Account and billing details for Customers, including authorised users, invoicing contacts and payment records.
• Communications with our sales, implementation and support teams, including support tickets and call notes.

Information collected automatically

• Technical data such as IP address, browser type, device information, pages viewed, referring pages and time spent on the site.
• Cookie and similar technology data as described in our Cookie Policy.
• Within the software: security logs, audit trails and usage metrics that keep the Services secure and reliable.

3. How we use information

• To respond to enquiries, schedule demonstrations and prepare proposals.
• To provide, configure, maintain, secure and support the Services under our agreement with each Customer.
• To send service notices such as maintenance windows, security alerts and release notes.
• To improve our website and product using aggregated or de-identified information.
• To send occasional product news, where permitted — you can opt out at any time using the link in each email.
• To meet legal, regulatory, accounting and audit obligations, and to establish or defend legal claims.

We do not sell personal information, and we do not use patient data from Customer systems for advertising, profiling or training unrelated products.

4. Legal bases

Where the law requires a legal basis, we rely on: performance of a contract (providing the Services); legitimate interests (responding to enquiries, securing our systems, improving the product) balanced against your rights; consent (certain cookies and marketing emails), which you may withdraw at any time; and legal obligation (tax, accounting and lawful requests).

5. How we share information

• Service providers who host infrastructure, send email or SMS, process payments or provide support tools, bound by confidentiality and data-protection terms.
• Integration partners that a Customer chooses to connect, such as laboratory analyzers, payment gateways or accounting software, only to the extent the Customer configures.
• Professional advisers such as auditors and legal counsel, under duties of confidentiality.
• Authorities where required by law, court order or to protect the rights, safety and property of patients, Customers, Curiaq or others.
• Successors in the event of a merger, acquisition or sale of assets, subject to this Policy.

6. Security

We protect information with role-based access control, encryption in transit and at rest, network segmentation, monitored audit logs, encrypted backups, vulnerability management and staff confidentiality commitments. No system is perfectly secure; if we become aware of a security incident affecting personal information, we will notify affected Customers and, where required, individuals and authorities without undue delay.

7. Retention

Website enquiry data is kept for up to 24 months after our last contact unless a business relationship follows. Customer account data is kept for the duration of the agreement and for the period required by tax and accounting law afterwards. Data stored in the software is retained and deleted according to the Customer’s instructions and the agreement, including export and deletion at the end of the contract.

8. International transfers

Cloud-hosted Services may use data centres selected for reliability and security. Where information is transferred across borders, we use contractual and technical safeguards appropriate to the sensitivity of the data. Customers may choose on-premise deployment where data residency is required.

9. Your rights

Depending on applicable law, you may have the right to access, correct, delete or restrict use of your personal information, to object to certain processing, to data portability and to withdraw consent. To exercise these rights for information Curiaq controls, contact us using the details below. We may need to verify your identity before acting on a request. For information held in a Customer’s system, please contact that healthcare provider.

10. Children

Our website is intended for healthcare professionals and organisations. We do not knowingly collect personal information from children through the website. Patient records of minors stored by Customers are handled under the Customer’s instructions and applicable health-records rules.

11. Changes to this Policy

We may update this Policy to reflect changes in our practices or the law. The “Last updated” date shows when it was last revised. Material changes will be highlighted on this page and, for Customers, communicated by email.

12. Contact us

Email: mail@curiaqhospital.com
Phone: +880 1717-266026
Postal address: see our Contact page.