How we protect your data

Digifort Labs acts as a Data Fiduciary for data we collect directly (for example, enquiries on this website) and as a Data Processor for patient data we handle on behalf of hospitals.

• Lawful purpose & consent: personal data is processed only for the purposes it was provided for.
• Data minimisation: we collect only what is needed to deliver the service.
• Your rights: data principals may request access, correction or erasure through the hospital or through us.
• Grievances: privacy questions and complaints can be raised with our grievance contact below.

• Encryption at rest: stored patient documents are encrypted (AES-256).
• Encryption in transit: all traffic to the platform uses HTTPS.
• Access control: role-based permissions, account lockout and new-device verification.
• Tenant isolation: each hospital's records are kept separate from other hospitals.

Access to and changes of records are logged with the user and time. Hospital administrators can review these logs for compliance checks.

Hospitals remain responsible for obtaining patient consent and for how their staff use the system. We provide the tools, including role permissions and audit logs, to help them meet those obligations.