Privacy Policy

This Privacy Policy explains how Cruze Intelligent Systems (U) Ltd ("Cruze", "we") handles information processed through Bulamu Medical Facility OS ("Bulamu"). It is written to align with the Uganda Data Protection and Privacy Act, 2019.

1. Roles: controller and processor

Your medical facility is the data controller for the patient and clinical information it enters into Bulamu - it decides what information is collected and why, and is responsible for obtaining patient consent as required by law. Cruze acts as a data processor, processing that information only to provide, maintain, and support the Service on your facility's instructions.

2. Information we process

• Facility and account information: facility name, type, address, phone, and administrator/staff name, email, and role.
• Patient records entered by facility staff: demographics, consultations, prescriptions, lab results, reproductive health records, and related clinical data, only as entered by your facility's authorized users.
• Consent records: Bulamu stores who recorded a patient's consent and when, as provided by your facility's staff.
• Patient Portal information: for patients who have a Patient Portal account, the email address and phone number on the account, a Patient ID, a scrambled (hashed) password, notification preferences and notifications, documents the patient chooses to upload, appointment requests, and a record of which facilities the patient has allowed to access their records.
• Billing information: subscription status and payment references. Card and mobile money details are handled directly by Pesapal, our payment processor - Bulamu does not store your payment credentials.
• Usage and audit data: login activity and an audit trail of sensitive record changes, used for security and accountability.

3. How information is used

• To provide the clinical, administrative, and reporting functions of the Service.
• To generate national health reporting exports (such as HMIS 105 and, where your facility configures it, DHIS2 and FHIR exports) that your facility controls and initiates.
• To process subscription payments via Pesapal.
• To send notification emails that are relevant to a person's role or account (for example a restock alert to a pharmacist, or a "results are ready" notice to a patient). These emails never contain patient names or clinical details, and recipients can switch them off.
• To maintain security, audit trails, and prevent unauthorized cross-facility access.

4. Security measures

Access is role-based and scoped to each facility - staff can only see their own facility's records, with oversight limited to authorized Bulamu administrators. Sensitive integration credentials are encrypted at rest. Changes to patient, user, and financial records are logged in an audit trail. Data is transmitted over encrypted connections.

5. Data retention

Clinical records are retained for as long as your facility's account remains active and as required for continuity of patient care and applicable Ugandan health-record retention obligations. Records are soft-deleted (retained with a deletion marker) rather than immediately erased, to preserve audit and clinical history integrity. Once a record or facility has been deleted, its clinical information is kept, restricted, for 5 years and then permanently erased (earlier on request where legally permissible). Our Data Retention and Deletion Policy sets out how long each kind of information is kept and exactly what happens when a record, a staff account, a Patient Portal account or a facility is deleted or closed.

6. Sharing with third parties

We share information only as necessary to run the Service: with Pesapal for subscription payment processing, and with Uganda's DHIS2 national health information system only where your facility has explicitly configured and triggered that export. We do not sell facility or patient information.

7. Your rights

Facility administrators may request export or correction of their facility's data, and patients may exercise their rights under the Data Protection and Privacy Act, 2019 (including access, correction, and objection) through their treating facility, which controls the underlying records. Patients with a Patient Portal account can view their own records, review or revoke which facilities may access them, choose which notification emails they receive, and close the account themselves at any time.

8. Local storage and offline data

Bulamu is offline-first: recently accessed records are cached on the device (via browser storage) so staff can keep working without connectivity, then sync once back online. Facilities are responsible for the physical security of devices used to access Bulamu.

9. Changes to this Policy

We may update this Privacy Policy from time to time; material changes will be communicated to facility administrators.

10. Contact

Use the WhatsApp or email icons in the footer of this page to reach us about privacy matters.