Privacy policy

Who this policy applies to

This policy covers visitors to harmonyspringsfamily.com and authorised workforce members who use Harmony EMR. Patient medical information entered into the EMR is also governed by the hospital’s clinical confidentiality, records-management, and applicable legal obligations.

Information we handle

• Account and workforce information: name, work email, phone number, staff identifier, title, role, assigned branch, departments, and permissions.
• Authentication and security information: sign-in events, session information, device and diagnostic data, access logs, and audit trails.
• Clinical and operational records: information authorised users create or access while delivering or administering care, including patient records, orders, results, billing records, notes, and documents.
• Content you choose to provide: profile images, photos, files, signatures, or dictated audio when you actively use those features and grant the relevant device permission.
• Website enquiries: the contact details and message you submit through our public website or support channels.

Why we use information

We use information to authenticate users, enforce role-based access, provide clinical and administrative workflows, maintain safety and auditability, respond to support requests, protect the service, meet legal obligations, and improve reliability. We do not sell personal or health information and do not use it for third-party advertising or cross-app tracking.

Device permissions

Harmony EMR may request camera, photo-library, microphone, document, or notification access only when a feature needs it. Camera and photo access support profile images, signatures, and authorised clinical attachments. Microphone access supports user-initiated clinical dictation. Notifications support operational updates. You can deny or later change these permissions in your device settings, although the related feature may then be unavailable.

Sharing and service providers

Information is available only to authorised hospital personnel based on their responsibilities. We may use carefully selected infrastructure, hosting, communications, security, and support providers that process information on our instructions. We may also disclose information where required by law, to protect patients or others, or in response to a valid legal process.

Retention and deletion

Account profile data is retained while access is active and for a reasonable period afterward for security, legal, and audit purposes. Clinical, financial, and audit records may need to be retained for periods required by healthcare, professional, tax, or other applicable rules. When information is no longer required, it is deleted, anonymised, or securely archived. See our account access and deletion page for how to submit a request.

Security

We use role-based access, authentication controls, access logging, protected connections, backups, and administrative safeguards designed to protect information. No system can guarantee absolute security; users must keep credentials private, use approved devices, and promptly report suspected misuse.

Your choices and rights

Subject to applicable law and necessary clinical-record restrictions, you may request access to or correction of your personal information, restriction or objection to certain processing, or deletion of eligible account information. Staff can update supported profile fields in the mobile app. Contact us to exercise another right or raise a concern. We may need to verify your identity and authority before acting.

Children and patients

The staff mobile application is not intended for children or general consumer use. Patient information, including information about children, may be processed by authorised clinical personnel as part of healthcare delivery and is subject to enhanced confidentiality requirements.

Changes to this policy

We may update this policy as our services or legal obligations change. The current version and effective date will remain available on this page and through the app.