Privacy Policy & ePHI Protection
Our highest priority is preserving the confidentiality, integrity, and security of your personal health information.
Technical Security Safeguards
AES-256 Encryption at Rest
All patient medical histories, clinical prescriptions, and diagnostic uploads are encrypted at rest using AES-256 with managed KMS keys.
TLS 1.3 In-Flight Security
Video streams, audio packets, and chat messages transmit over authenticated WebRTC and HTTPS endpoints secured with TLS 1.3.
Strict Role-Based Access (RBAC)
Access to electronic protected health information (ePHI) is strictly limited to authorized treating physicians and patient-designated proxies.
Immutable Audit Trails
Every patient profile view, prescription download, and medical record modification logs an immutable tamper-evident audit record.
1. Information We Collect
WellSpace collects only the minimum personal and health data strictly necessary to furnish safe telemedicine services:
- Account Identity: Full legal name, date of birth, gender, primary email address, mobile phone number, and emergency contact.
- Electronic Protected Health Information (ePHI): Blood group, known allergies, chronic conditions, current medication schedules, immunization records, and uploaded lab test reports.
- Consultation Records: Session timestamps, duration, doctor clinical visit notes, ICD-10 diagnostic codes, and digital prescriptions.
- Payment Metadata: Transaction IDs, card brand, and last 4 digits (full card credentials are tokenized directly by PCI-DSS Level 1 Stripe / SSLCommerz gateways; WellSpace never stores raw card numbers).
2. How We Use Your Health Data
Your health information is utilized exclusively for clinical care coordination:
- Matching you with qualified medical specialists and reviewing doctor availability.
- Enabling treating physicians to review your health records prior to consultation.
- Generating official digitally verifiable prescriptions and follow-up guidance.
- Delivering automated appointment reminders via email and transactional notifications.
WELLSPACE NEVER SELLS, LEASES, OR MONETIZES PATIENT PERSONAL OR CLINICAL DATA TO THIRD PARTIES OR PHARMACEUTICAL ADVERTISERS.
3. Data Retention & Record Archival
Pursuant to statutory clinical record retention mandates, patient medical consultation records and digital prescriptions are preserved for a minimum statutory period of seven (7) years from the date of service creation.
Non-clinical diagnostic staging uploads or draft notes may be deleted at any time upon verified patient request.
4. Your Data Protection Rights
Under applicable healthcare data privacy frameworks, you hold:
- Right to Access & Portability: Instantly view and download your electronic medical records and prescriptions in PDF/JSON format.
- Right to Rectification: Request correction of inaccurate demographic or personal background data.
- Right to Erasure (Account Deletion): Request account deactivation and redaction of non-statutory personal identifiers.
- Consent Revocation: Revoke optional notifications or diagnostic sharing preferences at any time.
Contact our Data Protection Officer (DPO)
Submit data access requests, deletion tickets, or privacy questions to dpo@wellspace.health