Privacy Policy & Sovereign Data Agreement
Effective Date: October 17, 2026. OmniMed is engineered from the ground up to respect medical confidentiality. We believe essential clinical tools should never extract, store, or monetize your patient data.
THE OMNIMED PRIVACY GUARANTEE: ZERO PATIENT HEALTH INFORMATION IN THE CLOUD
OmniMed never collects, sees, stores, transmits, aggregates, or analyzes your patients' medical records. All clinical charts, patient identities, prescriptions, appointment calendars, and billing records reside 100% locally on your clinic's physical computers. Even if compelled by a court or technical subpoena, OmniMed cannot provide patient records because our servers never receive them.
1. Our Privacy Philosophy: Local-First Sovereignty
At OmniMed Health Technologies Inc. (“OmniMed”, “We”, “Us”, or “Our”), we believe that medical software should operate with the same confidentiality as a doctor-patient consultation room.
Most electronic health record (EHR) platforms are structured as centralized multi-tenant cloud software (SaaS), where thousands of clinics upload sensitive patient records into central third-party servers. OmniMed rejects this architecture. We build local-first software where all operational medical data remains strictly inside your clinic facility on your hardware.
This Privacy Policy explains what limited telemetry and account data we collect to provide you with software licenses and website services, and explicitly certifies what data we never touch.
check_circle2. The Core Guarantee: Zero Patient Data Collection
We provide an explicit, legally binding guarantee regarding all patient information managed inside the OmniMed Desktop Workstation and OmniMed Clinic Server:
- No Protected Health Information (PHI): We do NOT collect, transmit, intercept, or store patient names, contact numbers, national identity numbers, dates of birth, addresses, insurance numbers, medical charts, diagnostic codes, prescription notes, surgical summaries, or lab results.
- Local Database Isolation: The internal database initialized by OmniMed runs solely on your local computer storage. It has no outbound synchronization pipe to OmniMed cloud servers.
- No Cloud Telemetry of Clinical Work: We do NOT track which patients you consult, what medications you prescribe, or when your patients arrive in your waiting room.
- Zero Third-Party Advertising: We do not include any third-party tracking pixels, analytics SDKs, or advertising libraries inside the OmniMed desktop software binaries.
3. Information We DO Collect (And Why)
We collect only the minimum necessary information required to manage your software purchase, authenticate your practitioner account, enforce license seat boundaries, and provide technical support:
When you create an account on our website, we collect your name, email address, medical role, clinic name, and a securely salted password hash (managed via Supabase Auth). This is used solely to verify your download permissions and manage license keys.
Financial transactions are handled by Freemius Inc., our Merchant of Record. We receive transaction metadata (order ID, plan slug, license ID, purchaser email, country) for invoicing and accounting compliance. We never handle or store full credit card numbers.
Website Logs & Analytics: When you browse our marketing website (omnimed.dz), our web servers collect standard HTTP server logs (IP address, browser user-agent, requested URL) and privacy-first, cookieless aggregate traffic telemetry via Vercel Analytics to ensure website stability and performance.
4. Software Licensing & Anti-Piracy Telemetry
To prevent unauthorized license duplication, pirated deployments, and fraudulent key resale, the software communicates briefly with our Supabase licensing edge service during initial activation and periodic offline certificate renewals:
- One-Way Hardware Fingerprint: The software generates a cryptographic SHA-256 hash derived from physical hardware parameters (such as CPU ID and motherboard UUID). This string is mathematically irreversible and contains zero personal data, clinic data, or patient data.
- Activation Timestamp & Network IP: The public IP address of the machine making the licensing request and the timestamp are logged to audit activations and prevent mass automated key leaks.
- Local Cluster Discovery Coordinates: If you run the OmniMed Clinic Server Hub in a multi-room setup, the server reports its internal local IP address (e.g.
192.168.1.50) to our licensing record. This coordinate is stored securely and used solely so workstation computers in other rooms can auto-locate the hub over your clinic Wi-Fi without manual network configuration. - Software Version: The installed build version (e.g.,
2.4.0) is transmitted to check for critical maintenance patches and security updates.
5. Regulatory Roles: HIPAA & GDPR Compliance
United States HIPAA Classification (45 CFR § 160.103)
Under the Health Insurance Portability and Accountability Act (HIPAA), a “Business Associate” is an entity that creates, receives, maintains, or transmits Protected Health Information (PHI) on behalf of a covered healthcare entity. Because OmniMed is on-premise local-first software and our company never receives, transmits, possesses, or maintains custody of your patients' PHI, OmniMed does NOT act as a Business Associate for your local patient records. The healthcare clinic remains the sole legal custodian and covered entity.
European General Data Protection Regulation (GDPR / UK GDPR)
For website customer accounts, billing references, and licensing telemetry, OmniMed acts as a Data Controller under the lawful basis of contractual performance (Art. 6(1)(b) GDPR) and legitimate interest in fraud prevention (Art. 6(1)(f) GDPR). For all patient health records processed within the software on your hardware, your clinic acts as the Sole Data Controller and Processor.
6. Third-Party Infrastructure & Processors
We partner strictly with enterprise-grade infrastructure providers to manage our website, accounts, and licensing delivery. None of these providers have access to your patient records:
| Provider | Purpose | Data Processed |
|---|---|---|
| Supabase Inc. | User account auth & license verification database | Account email, clinic name, hardware hash, license key |
| Freemius Inc. | Merchant of Record, checkout, invoices & tax compliance | Billing details, payment gateway tokens, VAT country |
| Resend Inc. | Transactional email delivery | Account confirmation, password reset, license delivery emails |
| Cloudflare Inc. | Secure binary file downloads (R2) | Download IP address and file request logs |
We do not sell data: OmniMed has never sold, rented, leased, or monetized Customer personal data or telemetry, and will never do so under any circumstances.
7. Data Security & Clinic Best Practices
Security in Transit: All communications between the OmniMed software and our licensing servers, as well as all website traffic, are encrypted using modern Transport Layer Security (TLS 1.3 / HTTPS).
Recommended Clinic Security Safeguards: Because your patient records reside on your local computers, we urge clinic directors and practitioners to implement the following physical and digital security standards:
- Full-Disk Encryption: Enable native hardware encryption (BitLocker on Windows, LUKS on Linux, or FileVault on macOS) on all workstations and server machines.
- Air-Gapped Daily Backups: Execute regular automated database backups to an encrypted external solid-state drive or dedicated offline NAS disconnected from public internet access.
- Clinic Wi-Fi Isolation: Isolate clinic medical computers on a private VLAN or dedicated WPA3 enterprise Wi-Fi network, completely separate from guest patient Wi-Fi.
- Screen Locks & User Accounts: Configure operating systems to automatically lock consultation room computer screens after 3 minutes of inactivity.
8. Your Rights & Account Data Retention
You have the right to access, inspect, correct, or request deletion of your practitioner account on omnimed.dz. You may exercise these rights at any time by contacting our privacy team.
Retention Policy: We retain your account credentials and license records for as long as your license remains valid and operational, or as required by applicable tax and accounting laws to verify commercial sales. If you terminate your account, personal account telemetry is deleted in accordance with our retention schedule.
9. Privacy Inquiries & Data Protection Contact
If you have questions, regulatory compliance requests, or wish to exercise your data subject privacy rights under GDPR or local privacy statutes, please reach out directly to our Data Protection Officer: