Privacy Policy

1. Who is responsible for your information

Qarni PolyClinic is responsible for personal information collected through the clinic, this website, and the patient portal. We process information in accordance with applicable Somali data-protection requirements, including the Data Protection Act (Law No. 005 of 13 March 2023), where it applies.

2. Information we collect

• Identity and contact data: name, date of birth or age, gender, phone, email, address, and patient or appointment identifiers.
• Clinical data: symptoms, history, vital signs, consultation notes, laboratory and imaging orders and results, diagnoses, prescriptions, and treatment information.
• Operational data: appointments, queue status, staff activity, inventory, dispensing records, enquiries, job applications, and moderated feedback.
• Security data: sign-in events, audit records, IP address, device or browser information, and information needed to prevent abuse.

3. Why we use it

We use the minimum information reasonably needed to provide and coordinate care, verify identity, operate appointments and the patient portal, dispense medication, respond to enquiries, maintain patient safety, secure the system, meet legal obligations, and improve clinic operations. Depending on the activity, processing is based on providing healthcare, your request or consent, legitimate clinic operations, or a legal obligation.

4. When information is shared

We do not sell personal or medical information. Access is limited by staff role and care responsibilities. Information may be shared with laboratories, imaging providers, referring clinicians, technology providers, or public authorities only when required for care, system operation, safety, or law. Service providers may host data or deliver email outside Somalia; when this occurs, we assess the provider and use appropriate contractual, access, and security safeguards.

5. Retention and deletion

Clinical and dispensing records are retained for the period required for safe continuity of care and applicable law. Security and audit records are retained according to operational risk. Enquiries, applications, and feedback are kept only as long as needed for their stated purpose. Data is then securely deleted or anonymized, subject to legal holds, backup expiry cycles, and medical-record obligations.

6. Security

We use layered administrative and technical controls, including role-based access, authenticated sessions, audit trails, release controls for diagnostic results, request validation, and protected transport. No system can promise absolute security. If you believe your portal account or information has been compromised, contact the clinic promptly and do not send medical details through ordinary email.

7. Your choices and rights

Subject to applicable law and clinical-record requirements, you may ask to access or correct your information, receive information about its use, withdraw consent where consent is the basis, object to or restrict certain processing, request deletion of eligible non-clinical data, or raise a complaint. We may need to verify your identity before acting. You may also contact Somalia's Data Protection Authority.

8. Cookies and the patient portal

The patient and staff portals use essential, secure cookies to maintain authenticated sessions. We do not use these session cookies for advertising. Do not share your password, and sign out when using a shared device.

9. Children and emergency care

A parent, guardian, or authorized representative may provide information for a minor or dependent patient. The website and contact form are not emergency services; seek immediate local medical help for an emergency.

10. Contact and complaints