Orion EMR — Privacy Policy
Effective Date: 17 October 2026
Last Updated: 17 October 2026
Controller: Orion HMS For Computer Systems & Communication Equipment Software Design CO. L.L.C S.O.C, a Limited Liability Company (Single Owner) licensed by the Department of Economy and Tourism, Dubai — Commercial Licence No. 1656716, Commercial Register No. 2934565
Registered Office: P.O. Box 566747, Dubai, United Arab Emirates
Contact, including data protection: customercare@orionhms.com
1. Introduction
This Privacy Policy explains how Orion HMS ("we", "us", "our") collects, uses, shares, retains and protects personal data through the Orion EMR platform, which includes the web application at orionhms.com, the Orion EMR mobile app for clinic staff, and the public pages that let patients book appointments, sign consents and join video consultations (together, the "Platform").
It applies to:
- Patients of clinics that use the Platform
- Clinic staff — clinicians, therapists, nurses, administrators and other employees who have a Platform account, including users of the mobile app
- Prospective customers who send us an enquiry through our website
- Visitors to our public website
2. Who is responsible for your data
2.1 Clinics are responsible for patient and staff records
Each clinic that subscribes to the Platform (a "Clinic") decides what it records about its patients and its own employees. For that data the Clinic is the controller and we process it on the Clinic's behalf and under its instructions. This covers medical records, appointments, billing, consents, and the HR, payroll and attendance records a Clinic keeps about its staff.
If you are a patient or a clinic employee and you want to access, correct or delete your records, contact your Clinic first. We will help the Clinic answer your request.
2.2 We are responsible for our own data
We are the controller for the data we collect for our own purposes: website enquiries, the operation and security of Platform accounts, security and audit logs, and our own communications with Clinics.
3. What we collect and why
3.1 Patient data (processed for the Clinic)
| Category | Examples | Why |
|---|---|---|
| Identity and contact | Name, date of birth, gender, Emirates ID or other ID number, nationality, phone, email, address, emergency contacts, photograph | To identify the patient and contact them about their care |
| Clinical record | Medical, surgical, social and family history, problems, allergies, vital signs, diagnoses, examination and consultation notes, prescriptions, laboratory results, uploaded documents | To provide and record healthcare |
| Specialist records | Fertility and IVF treatment records, embryology and genetic test results, and applied behaviour analysis (ABA) therapy records, which are frequently about children | To provide those specialist services |
| Consents and signatures | Consent forms, handwritten signatures, the name and relationship of a parent or guardian who signs for a child | To record informed consent |
| Insurance and billing | Insurer, plan, policy details, invoices, payments, statements | To bill for care and claim from insurers |
| Communications | Appointment confirmations and reminders, consent preferences, survey answers | To keep the patient informed and record their preferences |
| Video consultations | Session details; when a patient accepts the video consultation consent, their Emirates ID, date of birth, phone number, IP address and browser details are recorded with the consent | To deliver the consultation and evidence the consent |
Health data is sensitive personal data. It is processed only to provide the Clinic's services and as UAE law requires.
3.2 Clinic staff data (processed for the Clinic)
| Category | Examples | Why |
|---|---|---|
| Account | Name, work email, role, password (stored only as a one-way hash), last login | To give you secure access to the Platform |
| Professional | Licence numbers and expiry dates, qualifications, specialties, languages, profile photo, signature | To schedule and sign clinical work and track licence renewals |
| Employment | Job title, department, manager, hire and termination dates, emergency contact, identity, visa and employment documents your Clinic uploads, disciplinary records | For your Clinic's HR administration |
| Pay | Basic salary, allowances, commission, deductions and payslips | For your Clinic's payroll |
| Leave | Leave requests, notes and balances | For your Clinic's leave management |
| Attendance and location | When you clock in or out in the mobile app: your precise location (latitude and longitude), its accuracy, the time, and whether you were inside your clinic's area | To confirm you are at your workplace when you clock in or out |
3.3 Mobile app data
The Orion EMR mobile app is for clinic staff. It collects:
- Precise location, only when you tap clock in or clock out. The app takes a single location reading at that moment. It never reads your location in the background, never tracks you continuously, and does not collect location at any other time. If you refuse location permission, you can still use the rest of the app but cannot clock in or out. Your location is sent to the Platform and stored with your attendance record. If you try to clock in or out from outside your clinic's area, the attempt is refused and the location of that attempt is recorded in the security audit log.
- Push notification token. If you allow notifications, your device receives a token that lets us send you notices, currently about leave requests and approvals. Notifications contain no names and no clinical information.
- Biometric unlock. If you use Face ID or fingerprint to unlock the app, the check happens entirely on your device. We never receive your biometric data — only whether the check passed.
The app does not use advertising identifiers, analytics or crash-reporting services, and does not access your contacts, camera, photos, microphone or files.
If you clock in while offline, the clock-in (including its location) is held on your device until your connection returns, then sent and removed from the device.
3.4 Website and enquiry data (we are the controller)
When you send an enquiry through our website we collect your name, email, phone, clinic name, specialty, emirate and message, plus your IP address and browser details. We use them to reply to you and to protect the form from abuse.
3.5 Security and audit data
To keep the Platform secure and accountable we record:
- Sign-in records: every sign-in attempt to an existing account, whether it succeeded, the IP address and browser details
- Session records: IP address and browser details for each active session
- Audit log: who created, changed or deleted a record, when, and what the record looked like before and after the change. Because of this, the audit log contains copies of the personal data that was changed.
- Application logs: technical error records, which deliberately exclude request contents
4. Legal basis
We and the Clinics rely on:
- Providing healthcare and meeting legal obligations — the health data laws of the UAE and of the Emirate of Dubai require clinics to keep medical records and allow them to process health data for treatment
- Contract — to provide the Platform to Clinics, and for a Clinic to employ its staff
- Legal obligation — record retention, tax, employment and regulatory reporting obligations
- Legitimate interests — securing the Platform, preventing fraud and abuse, and replying to enquiries
- Consent — for promotional messages, for video consultations, and for optional device permissions (location, notifications, biometrics), each of which you can withdraw
5. Where your data is stored
The Platform runs on Microsoft Azure in the UAE North region (Dubai). The database, file storage, caches, application logs and encryption keys are all hosted there. Database backups are kept in the same region and are not copied abroad. Our video consultation server is also hosted in UAE North, and consultations are not recorded.
Some service providers that deliver messages are located outside the UAE (see section 6). Only the data needed to deliver each message is sent to them.
6. Who we share data with
We do not sell personal data and do not use it for advertising.
6.1 Service providers
| Provider | What it does | Data it receives | Location |
|---|---|---|---|
| Microsoft Azure | Hosting, database, file storage, logs | All Platform data | UAE North |
| Resend | Sends email | Email address and email content: appointment details, secure links, account invitations and password resets, and Clinic marketing emails. Documents, prescriptions, invoices and results are never attached — emails contain only a secure link that requires identity verification | Outside the UAE |
| Twilio | Sends SMS and WhatsApp messages, using each Clinic's own Twilio account | Phone number and message content, such as patient first name, clinician, clinic, appointment time and secure links | Outside the UAE |
| Expo (expo.dev) | Delivers mobile push notifications through Apple and Google | Device push token and the notification text, which contains no names or clinical information | Outside the UAE |
6.2 Regulators
UAE law requires healthcare facilities in Dubai to share patient data with NABIDH, the Dubai Health Authority's health information exchange. Where a Clinic's facility is in Dubai and its NABIDH connection is active, the Platform sends the required patient and encounter information to NABIDH on the Clinic's behalf. Data from facilities outside Dubai is never sent to NABIDH. Patients can ask their Clinic about NABIDH opt-out options available under DHA rules.
We will also disclose data to courts, regulators and authorities where UAE law requires it.
6.3 Within your Clinic
Patient and staff data is visible to the Clinic's authorised users according to the role the Clinic gives them. Clinic administrators and HR administrators can see staff attendance records, including clock-in location.
6.4 Our support staff
Authorised members of our support team can access a Clinic's account to provide support. Every action they take is recorded in the audit log under their own identity.
7. How long we keep data
- Medical records are retained for the period UAE health law requires. Federal Law No. 2 of 2019 requires health data to be kept for at least 25 years from the last procedure. We do not delete medical records automatically. When a Clinic deletes a patient record, the record is deactivated and kept for this retention period.
- Staff records — employment, payroll, leave and attendance records, including clock-in locations — are kept for as long as the Clinic keeps them. The Platform does not currently delete them automatically.
- Audit logs and sign-in records are kept for as long as the Clinic's account exists, so the history of who accessed and changed records remains available.
- Push notification tokens are deactivated when you sign out, when your sessions are ended, or when your device stops accepting notifications.
- Application logs are deleted after 30 days. Database backups are deleted after 35 days. Deleted files remain recoverable for 30 days.
- Website enquiries are kept to respond to you and manage our relationship with your organisation.
8. How we protect data
- All connections to the Platform, the database and the cache are encrypted with TLS 1.2 or higher
- Data at rest in the database and file storage is encrypted by Microsoft Azure
- The database and cache are reachable only from the Platform's private network, not from the public internet
- Stored files are private; downloads use links that expire within one hour, and patient share links expire after seven days and require identity verification
- Passwords are stored only as one-way bcrypt hashes; sessions expire and refresh tokens rotate, with reuse treated as theft
- Each Clinic's data is kept separate from other Clinics' data, and role-based permissions restrict who can see what within a Clinic
- Sign-in, password-reset and public endpoints are rate-limited
- Changes to records are recorded in an audit log
- Administrative access to the cloud environment uses Microsoft Entra ID, and secrets are held in Azure Key Vault
No system is completely secure. If a personal data breach is likely to put people at risk, we will notify the affected Clinics without undue delay and support them in notifying patients and regulators.
9. Your rights
Subject to UAE law, you can ask to:
- access a copy of your personal data
- correct inaccurate data
- delete your data, where the law does not require it to be kept — medical record retention law usually means clinical records cannot be deleted on request
- restrict or object to certain processing
- withdraw consent you have given, including for promotional messages
- complain to the relevant UAE authority
Patients: contact your Clinic. You can also stop promotional messages at any time using the unsubscribe link in any marketing email or by replying STOP to an SMS.
Clinic staff: for HR, payroll or attendance records, contact your Clinic. To have your Platform account deleted, or for anything else, contact us at customercare@orionhms.com. We will deactivate your account, which ends all of its sessions and stops its notifications, and reply to tell you which of your data is kept because your Clinic or the law requires it, and why.
Mobile app permissions: you can turn off location, notifications or biometric unlock at any time in your device settings.
We may need to verify your identity before acting on a request. We aim to respond within 30 days.
10. Cookies and browser storage
The Platform uses only what it needs to work:
- a secure, http-only cookie and browser storage that keep you signed in
- a cookie that remembers your chosen language
- browser storage for display preferences, such as calendar view
We do not use analytics, advertising or tracking cookies. Clinic marketing emails sent through the Platform record whether they were opened.
11. Children
The Platform is used by clinics that treat children, including for ABA therapy. Children's data is entered by the Clinic, and a parent or guardian gives consent where the law requires it. Children do not have Platform accounts.
12. Changes to this policy
We will update this policy when our processing changes and change the "Last Updated" date above. We will notify Clinics of material changes.
13. Contact
Orion HMS
P.O. Box 566747, Dubai, United Arab Emirates
All enquiries, including data protection and security: customercare@orionhms.com
This policy is provided in English. If a translation differs, the English version prevails.