Privacy Policy

HealthNext is used by independent clinics and healthcare organisations. The clinic controls the patient and operational records entered by its authorised staff. HealthNext provides the application and processes that information to deliver the service.

Clinic-specific privacy notices may add requirements that apply to a patient’s care and local law.

• Patient identity, contact, appointment, clinical, prescription, imaging, billing, and document information entered by authorised clinic users.
• Staff profile, role, branch assignment, authentication, MFA, and activity records.
• Clinic, branch, inventory, supplier, purchase, payment, licensing, and configuration information.
• Technical records such as device type, screen performance, errors, URLs, diagnostic details, and audit events.
• Google Business Profile reviews and reply workflow information when a clinic enables that integration.

• Provide clinic workflows, protect accounts, enforce access, and support continuity of care.
• Process appointments, prescriptions, inventory movements, bills, payments, and reports.
• Diagnose errors, monitor performance, prevent misuse, maintain audit trails, and meet configured retention requirements.
• Sync reviews and publish an approved public reply only when an authorised user explicitly confirms it.

Information is shown only to signed-in users whose clinic, branch, role, and assigned permissions allow access. Clinic administrators are responsible for assigning appropriate access and removing it promptly when duties change.

Information may be processed by infrastructure, authentication, payment, communication, or integration providers strictly to deliver enabled features. HealthNext does not sell patient or clinic information.

Records are retained according to the clinic’s settings, legal obligations, operational needs, and configured cleanup controls. Some audit, billing, payment, or signed clinical records may need to be preserved. Clinics should submit correction, access, export, or deletion requests through their authorised administrator.

• Keep sign-in credentials and authenticator codes private.
• Use accurate information and access records only for authorised work.
• Contact the relevant clinic to exercise rights relating to patient records.
• Stop using optional integrations or ask an administrator to disable them where appropriate.

This policy may be updated as HealthNext features, safeguards, providers, or legal obligations change. The effective date at the top identifies the current version.