Patient Privacy Notice

Vedge is a software platform that your healthcare provider uses to keep your records safe, send you reminders, and share your results with the people treating you. We are a technology company — we do not provide medical care and we do not decide what goes into your record.

Your clinic is the data controller— they decide what data to collect and how it’s used. Vedge is a data processor — we hold the data on their behalf, keep it secure, and act only on their instructions.

Your clinic’s authorised staff see everything they need to treat you — demographics, clinical notes, prescriptions, lab results, imaging reports.

Vedge employees only access your record in narrow, logged circumstances: to fix a bug you or your clinic reported, to respond to a security incident, or under a legal order. Every access is recorded in an audit log your clinic can see.

Other clinics that haven’t been given access by you or your current clinic cannot see your record, except through the Master Patient Index which exists to prevent duplicate records and to route referrals — and even there, clinical content is not shared without an active referral.

• Delivering care through your clinic’s staff.
• Sending you SMS or email reminders and notifications (see §4).
• Generating bills and processing insurance claims you consent to submit (NHIS or private).
• Keeping the platform secure and reliable.

We do not sell your data, use it to advertise to you, or give it to training datasets for third-party AI models.

Vedge may send you SMS or email on behalf of your clinic — appointment reminders, result-ready alerts, welcome messages, shareable links to imaging or lab reports. These messages are sent using your clinic’s sender identity where configured, or using “Vedge” as the sender otherwise.

You can opt out of any specific category of message at any time by replying STOP to an SMS or using the unsubscribe link in an email. Clinical safety messages (e.g. a critical result flagged by your doctor) will still reach you through your clinic’s standard process.

Your clinic may choose to enable AI features that help its practitioners interpret results or prepare notes. If enabled:

• AI suggestions are clinical decision support only — your doctor makes the final diagnosis.
• Data sent to the AI provider (OpenAI) is de-identified where feasible, and subject to a zero-retention agreement so it is not used to train any model.
• Your clinic can turn AI features off for your record on request.

Your clinic decides the retention period for your clinical record, subject to the minimum windows set by Ghana’s HEFRA standards:

• Adult records: 6 years from last interaction
• Minor records: 12 years from the minor's age of majority (21)
• Maternal and death records: indefinitely

Audit-log entries are kept for 6 years from event so a doctor suspecting misuse can investigate.

Under the Ghana Data Protection Act 2012, you have the right to:

• See what data your clinic holds about you.
• Correct anything that is inaccurate.
• Ask for deletion (subject to legal retention).
• Object to specific uses (like marketing).
• Receive your data in a portable format.
• Complain to the Data Protection Commission.

Contact your clinic first — they are the data controller and most requests are handled there. If you can’t get a satisfactory response, write to Vedge’s DPO at dpo@tryvedge.com.

For paediatric patients, a parent or guardian acts on the child’s behalf until the age of majority (21 years in Ghana). At majority the patient takes over their own access and consent.

For anything about your clinical record: contact the clinic where you received care. Their contact details are in the portal or on any letter/SMS they sent you.

For anything about Vedge itself:

• Data Protection Officer — dpo@tryvedge.com
• Ghana Data Protection Commission — file a complaint