LinkHMS Patient Portal Privacy Notice

Effective date: 19.09.2026
Version: 1.0

At LinkHMS, we value your privacy and are committed to protecting your personal information. This notice explains how we handle your data when you use the LinkHMS Patient Portal at my.linkhms.com.

This notice covers how LinkHMS manages information within the Patient Portal. It does not cover how your clinic uses or safeguards your medical records. For information about your medical records, please contact your clinic directly.

We are guided by applicable data protection laws, including the Nigeria Data Protection Act (NDPA) and the General Data Protection Regulation (GDPR), and we strive to ensure transparency, security, and respect for your rights.

Your clinic is responsible for your medical records. Your prescriptions, diagnoses, appointments and test results belong to the clinic that treated you. LinkHMS provides the software the clinic uses to store them. We only handle that information on the clinic’s instructions.

LinkHMS is responsible for your portal account — the login itself, and the link between your email address and your clinic records.

LinkHMS B.V., Museumlaan 2, 3581HK Utrecht, Netherlands.

• Your email address, or addresses if you have more than one.
• Your first and last name, as your clinic recorded it.
• One-time login codes, and a record that you signed in.
• If you accept analytics cookies: which pages you opened and a random identifier for your browser. This is never linked to your name, your email or your medical records.

We do not ask you for anything else, and the portal does not let you enter anything about yourself.

We process your portal account information under the following legal bases:

Consent

• If you choose to accept analytics cookies, we process data such as the pages you visit and a random identifier for your browser. This information is never linked to your name, email, or medical records.
• You may withdraw your consent for analytics at any time through your cookie/portal settings.

Legitimate interest

• We process your email address, first and last name (as recorded by your clinic), and one-time login codes to provide secure access to the Patient Portal and to maintain account integrity.
• Recording that you signed in helps us protect your account and ensure the portal functions reliably.

We only process your information for the purposes described above and in compliance with applicable data protection laws.

To let you sign in and see your own records, and to keep the account secure. If you accept analytics, we also use it to see which parts of the portal people use so we can improve it.

You can only see records from a clinic that has confirmed your email address on your patient file. If a clinic changes or removes that address, that clinic’s records stop appearing in the portal the next time you sign in.

If you attend more than one clinic and each has confirmed an email address for you, the portal shows all of them together.

The portal does not use cookies to sign you in. Your session is stored in your browser and cleared when you log out.

We ask separately before loading analytics. You can say no, and the portal works exactly the same. You can change your choice at any time from “Cookie settings” at the bottom of any page.

On Amazon Web Services, in Frankfurt (Germany) or Cape Town (South Africa) depending on your clinic’s region. Your account details are stored in Frankfurt.

• Amazon Web Services (AWS) — used to host and store your information and to send your login codes and notification emails.
• Google Analytics and Mixpanel — used to process analytics information when you give consent.

Each is bound by contract to protect your information and to use it only for these purposes.

• Portal account — for as long as at least one clinic has a confirmed email address for you, and for 12 months after the last one is removed. After that, we delete it.
• Login codes — retained for only a few minutes.
• Sign-in records — up to 24 months.
• Analytics — 12 months.

We respect your data protection rights under applicable data protection laws, including the General Data Protection Regulation (GDPR) and the Nigeria Data Protection Act (NDPA).

Depending on the applicable law and circumstances, you may have the right to:

• Access the personal information we hold about you.
• Correct inaccurate or incomplete information.
• Request erasure of your personal information where applicable.
• Request restriction of how we process your personal information where applicable.
• Object to certain ways we use your personal information.
• Withdraw your consent where we rely on consent to process your information.
• Request a copy of your personal information in a portable format, where applicable.
• Lodge a complaint with the relevant data protection supervisory authority if you believe your data protection rights have been infringed.

Medical records

For your medical records, please contact your clinic directly. The clinic holds and is responsible for the medical records and requests relating to their accuracy and correction.

Portal account

For information relating to your portal account, email privacy@linkhms.com. Your request will be handled by our Data Protection Officers. We will respond to your request within 30 days. If we are unable to fulfil your request within this period, we will let you know and explain the reason for the delay.

If we change this notice, we will post the new version here and update the date above.