Privacy Policy

Zentrium Business Solutions ("Vitrae", "we", "us") provides a cloud-based hospital management system ("Vitrae HMS" or the "Service") used by hospitals and clinics ("Customers") across Nigeria, Ghana, Kenya, and South Africa. This Privacy Policy explains what information we collect, how we use it, and the choices available to you.

It matters who controls what data. When a hospital signs up for Vitrae HMS, they submit account and billing information directly to us — we are the controller of that data. Separately, hospital staff enter patient health records into the Service on behalf of their patients — for that data, the hospital is the controller and Vitrae acts only as a processor, following the hospital's instructions and its own data protection obligations to its patients.

Depending on how you interact with us, we may collect:

• Account information: name, work email, phone number, role, and hospital affiliation, for hospital staff with a Vitrae login
• Billing information: hospital name, contact details, and subscription plan (payment card details are handled by our payment processor, not stored by us)
• Patient health information: entered into the Service by hospital staff, on behalf of and under the direction of the hospital customer
• Website and lead information: name, email, phone, and message content submitted through our public website (e.g. the onboarding, demo request, or careers forms). When you submit a demo request we also record the approximate location (city, region, country) of the network it was sent from, your truncated IP address, and your browser type, so our team can route and verify the request
• Usage and technical data: log data, device and browser information, and general usage patterns, used to operate and improve the Service
• Website visitor data, only if you accept optional cookies: the public pages you open, your approximate location derived from your IP address, and your precise location if your browser separately permits it. Your IP address is truncated before the visit is stored. This is never collected inside the authenticated hospital application — see our Cookie Policy for the detail

We use the information described above to:

• Provide, maintain, and secure the Service for hospital customers and their staff
• Process onboarding, demo, and careers submissions, and communicate with you about them
• Send account, billing, and service-related notifications
• Monitor and improve the performance, reliability, and security of the Service
• Comply with legal obligations and enforce our Terms of Use

We do not sell personal data or patient health information. We may share information with trusted service providers who help us operate the platform (such as cloud hosting and email delivery providers), each bound by confidentiality obligations, or where required by law, regulation, or valid legal process.

Where you have accepted optional cookies on our public website, your IP address is sent to ipwho.is, a third-party geolocation provider, so the visit can be attributed to a country and city. This happens only for visitors who have accepted, only on our public website, and never for activity inside the hospital application. Separately, when you submit a demo request, your IP address is sent to ipwho.is once to locate that submission, as described in section 3; only the truncated address is stored.

We apply role-based access control, encryption in transit, tenant-level data isolation between hospital customers, audit logging of access to sensitive records, and multi-factor authentication options for staff accounts. No system is perfectly secure, and we continuously work to improve our safeguards.

We retain account and patient data for as long as a hospital customer maintains an active subscription, and for a reasonable period afterward as required for legal, regulatory, or legitimate business purposes, after which it is deleted or anonymized in line with our data retention practices and the hospital customer's instructions.

Website visit records collected under optional cookies are deleted automatically 400 days after the visit.

Depending on your location, you may have rights under applicable data protection law — including Nigeria's Nigeria Data Protection Act (NDPA), South Africa's Protection of Personal Information Act (POPIA), Kenya's Data Protection Act, and Ghana's Data Protection Act — to access, correct, or request deletion of your personal data. If your health records are held by a hospital using Vitrae HMS, that hospital is generally the right point of contact to exercise these rights, since they control that data; we will support them in responding to valid requests.

Vitrae HMS is hosted on cloud infrastructure that may process data in a country other than where a hospital customer operates. Where this occurs, we take steps to ensure data is protected consistently with this Policy and applicable law.

Vitrae HMS is a business tool used by hospital staff and is not directed at children. Patient records for minors are entered and managed by authorized hospital staff on behalf of the hospital, under the hospital's own consent and safeguarding policies.

We may update this Privacy Policy from time to time. We will post the updated version on this page with a revised "Last updated" date, and for material changes, we will make reasonable efforts to notify affected hospital customers directly.