Privacy policy

Who is responsible for what

The practice or clinic that subscribes to Medalyt is the controller of its patients’ data: it decides what is recorded and why. Medalyt is the processor: it stores and processes that data on the practice’s instructions and uses it for nothing else.

That means Medalyt does not sell data, does not hand it to third parties for commercial purposes and does not use it to train models.

What is stored

Only what running a practice requires:

• About the patient: name, ID document, contact details, date of birth, history, visits, diagnoses, prescriptions, vital signs, lab tests and any files the doctor attaches.
• About the professional and their team: name, email, phone, specialty, licence number and the role they sign in with.
• About operations: appointments, payments, inventory movements and a technical log of who changed what.

Who can see the medical record

The record belongs to the relationship between a patient and their doctor. A doctor sees the records of their own practice; front-desk staff see only what their permission allows, which does not include the clinical history.

If the same patient is seen by doctors at different practices, each sees their own. For a second doctor to see history recorded by another, the patient must grant it in writing from their portal, and can withdraw that permission at any time.

Patient rights

Access the full history and download it as a PDF from the portal, without asking anyone.

Ask for a wrong entry to be corrected, and for deletion of anything the law does not require to be kept. Requests go to the treating practice; if you write to Medalyt, you will be directed there.

Know who has opened the record, and revoke any permission granted to another doctor.

Who the data is shared with

Only the providers that make the service work, each with access limited to its function: hosting and the database, appointment email delivery, phone notifications, video calls and the subscription payment processor. None receives the data for purposes of their own.

Data is also disclosed when a competent authority requires it through a valid legal channel.

How long it is kept

While the practice has an active account, and afterwards for as long as each country’s rules on medical records require. If a doctor leaves the clinic, the record stays with the clinic: a patient does not lose their history because staff changed.

Where the data lives

On encrypted cloud servers outside El Salvador. Using Medalyt accepts that international transfer, which is what makes the record available from any device.

Changes and contact

If this policy changes materially, notice is given inside the application before it takes effect. For anything about personal data: privacidad@medalyt.com.