Privacy Notice

Melotech provides hospital and pharmacy management software. This notice explains what personal data we handle and why.

1. Our role

Melotech is the data controller for the account data of the people who buy and administer the software (hospital administrators, staff account holders and website visitors). For patient records that a subscribing hospital enters into the system, the hospital is the controller and Melotech acts as a processor on that hospital's instructions.

2. Data we collect and why

• Account details (name, work email, phone, role, hospital) — to create accounts, provide the Service, and contact you about it. Legal basis: performance of a contract.
• Sign-in and security data (login credentials in hashed form, sign-in and sign-out events, device and browser information, IP address) — to secure accounts, keep a tamper-evident audit trail and prevent fraud. Legal basis: legitimate interests and legal obligation.
• Usage and telemetry (pages used, errors, sync activity) — to keep the Service working and improve it. Legal basis: legitimate interests.
• Support messages — to answer your questions. Legal basis: legitimate interests.
• Patient and clinical records entered by a hospital (demographics, consultations, prescriptions, dispensing, laboratory results, admissions, invoices) — processed only to provide the Service to that hospital, on its instructions.

Payment card details are never collected or stored by Melotech; they are handled by Paddle at checkout.

3. Who we share data with

• Service providers / subprocessors — hosting, database, email delivery and error monitoring providers acting on our instructions.
• Paddle.com, our reseller and Merchant of Record, for the sale of the software, subscription management, payments, tax compliance and invoicing.
• Professional advisers — legal and accounting, where necessary.
• Authorities — where required by law.

We do not sell personal data or use it for advertising.

4. International transfers

Our hosting and email providers may process data outside your country. Where that happens we rely on appropriate safeguards such as standard contractual clauses or an adequacy decision.

5. Retention

Account and billing records are kept for the life of the subscription and for up to 7 years afterwards where tax or legal rules require it. Hospital-controlled clinical records are kept while that hospital's account is active and for 30 days after termination, after which they are deleted or anonymised unless the hospital instructs otherwise. Audit-trail entries are append-only and retained for the life of the account.

6. Your rights

Subject to the law that applies to you, you may ask us to give you access to your personal data, correct it, delete it, restrict or object to its use, or provide it in a portable format, and you may withdraw consent where we rely on it. Write to support@melotechos.com and we will respond within one month. If you are in the UK or EEA you may also complain to your local supervisory authority. If your data was entered by a hospital, please contact that hospital first — we will pass requests on to them.

7. Security

We use appropriate technical and organisational measures, including encryption in transit and at rest, row-level access controls so each hospital sees only its own records, role-based permissions, and a tamper-evident audit trail of changes.

8. Cookies

We use strictly necessary cookies and local browser storage to keep you signed in, remember the hospital you chose, and hold data entered while offline until it can sync. We do not use advertising cookies. You can clear or block cookies in your browser settings, but the Service will not work correctly without the necessary ones.

9. Contact

Melotech — support@melotechos.com.