Who we are and how to reach us
Capital Solutions Co. (“Capital Solutions”, “we”, “us”) is a company registered in the Arab Republic of Egypt and established in 2022. We supply, install and service radiotherapy, quality assurance and healthcare equipment for hospitals and clinics in Egypt. We are the controller of the personal data described here.
Our office is at 250, District 3/4, 5th settlement, Cairo, Egypt. Write to info@capital-solutions.co, or call +20 2 2475498 (landline), +20 100 109 0980 (mobile and WhatsApp) or +20 100 997 8416 (support).
This policy covers the English and Arabic versions of capital-solutions.co, the client portal, the staff portal, guide links we share with you, and the learning platform. It does not cover our partners’ and manufacturers’ own websites, which we link to but do not control.
What we collect and why
Contact form: your first and last name, email address, phone number, organisation (optional), the subject you pick from the menu, and your message. The subject decides which member of our staff receives the enquiry. Name, email, phone and message are required; we cannot answer an enquiry without them. You must tick a consent box before the form will send. If you write to us about a vacancy, whatever you put in the message reaches us the same way, so please do not paste identity-document numbers or health information into it.
With every contact submission we also store your IP address, your browser’s user-agent string and the language the form was sent in. These stay attached to the enquiry rather than only in short-lived logs, because they are what let us separate a genuine enquiry from an automated one and evidence abuse. The form is protected by a hidden honeypot field and a per-IP rate limit instead of a captcha, so nothing about you is sent to a third-party captcha service.
Newsletter: your email address and preferred language. Subscription is double opt-in — we store the address when you submit it but send nothing except a confirmation message until you follow the confirmation link. Confirmation and unsubscribe use separate hashed tokens, and every newsletter carries an unsubscribe link.
Portal and learning accounts: your name, email address, phone number, job title, preferred language, role, the organisation you belong to (for client accounts), and a scrypt hash of your password — never the password itself. Client and staff accounts are created by Capital Solutions staff; there is no public sign-up on the main website. On the learning platform you may create a learner account, which works only there and cannot sign in to the client or staff portals.
Support tickets: the subject and body of every ticket and reply you post, the installation it concerns, its status and priority, timestamps including when we first responded, and any files you attach. Our staff can add internal notes to a ticket; those are marked internal and are never returned to a client account.
Organisation records: for each hospital or clinic we work with we hold the organisation’s name, contact email, phone, address, city and country, free-text notes written by our staff, and the equipment installed at the site with serial numbers, locations, warranty dates and service history.
Learning platform: which courses you are enrolled on and the state of that enrolment, how far through each lesson video you have watched so playback can resume, when you completed a lesson, and every quiz attempt — your score, whether you passed, and the specific answers you chose, kept so you can review them.
Paid courses: where a course has a price, your email address is passed to Polar to open a checkout, and we store the resulting order and checkout references, the amount and the currency. We never receive or store your card details.
Sessions: each time you sign in we store a session record holding the session token, its expiry, and the IP address and user-agent of the device used. Signing out or letting the session lapse removes it.
Audit log: actions taken on client data — creating, updating or deleting an account, organisation or installation; creating, replying to or changing a ticket; granting an enrolment; publishing content; sending a newsletter; updating an enquiry — are written to an append-only log recording who did it, what was affected, the IP address and when. It exists so that a change to a hospital’s records can always be traced.
Server logs: our host records requests to the site — IP address, path, status and timing — and the application writes diagnostics when something fails. These rotate on a short cycle.
Analytics and session recording
We use Umami for analytics. It runs on our own server rather than a vendor’s cloud, so the data stays under our control and is not pooled with other companies’ traffic. Umami sets no cookies, does not fingerprint you across sites, and is never used for advertising. It records the page visited, the referrer, and coarse details such as browser, operating system, device type and country.
Umami’s session recorder is currently switched on. Alongside page-view counting it captures a replayable reconstruction of a visit — pages viewed, scrolling, mouse movement, clicks and navigation — which our team uses to find broken layouts and the points where people get stuck. Recordings are held on the same self-hosted Umami instance, and are never sold, shared for advertising, or used to build a profile of you.
Both scripts load on every page the site serves, including signed-in portal, staff and learning pages. A recording of a signed-in session can therefore include what is on screen and what is typed into a ticket or a form. Do not enter patient-identifiable information anywhere on this site; where a support case genuinely needs clinical detail, send it to us by an agreed route instead of typing it into the portal.
Recording is not necessary for the site to work. If you would rather not be recorded, any content blocker that blocks our analytics domain, or a browser setting that blocks third-party scripts, stops both the tracker and the recorder and leaves the rest of the site working normally.
Cookies and local storage
There is no cookie banner because we set no advertising, profiling or third-party tracking cookies.
A session cookie prefixed “capital-solutions” is set only when you sign in to a portal or the learning platform. It is HTTP-only so page scripts cannot read it, sent with SameSite=Lax, and marked Secure in production. Sessions last seven days and refresh once a day while you keep using them, with a five-minute cache inside the cookie that saves a database lookup on each request. In production the cookie is scoped to .capital-solutions.co so that one sign-in covers both the main site and the learning subdomain.
Your light or dark theme choice is stored under the key “theme” in your browser’s local storage. It stays on your device and is never sent to us.
Fonts are served from our own domain rather than Google Fonts or any other font CDN, so simply loading a page does not disclose your visit to a third party.
Who processes data for us
Railway — application hosting and the PostgreSQL database that holds everything described above.
Amazon Web Services — S3 stores every uploaded file: ticket attachments, report attachments, product and news images, partner logos and lesson videos. Public images are delivered through Amazon CloudFront.
Plunk — sends our transactional email (password resets, newsletter confirmations, enquiry notifications) and our newsletter broadcasts. Plunk holds recipient addresses as contacts and distinguishes marketing from transactional messages.
Polar — checkout and payment processing for priced courses.
Umami, self-hosted by us, as described above.
We do not sell personal data and we do not disclose it for third-party advertising. We disclose it otherwise only where Egyptian law obliges us to, or where it is necessary to protect our rights or someone’s safety.
Where data is held, and transfers outside Egypt
Our hosting, database, file storage, email and payment providers operate outside the Arab Republic of Egypt, and file storage is in the United States. Using this site, the portals or the learning platform therefore involves transferring your personal data abroad to be processed.
Egypt’s Personal Data Protection Law (Law No. 151 of 2020) restricts cross-border transfers. We rely on your consent and on the transfer being necessary to provide the service you asked for, and we choose providers that contract to protect the data and to process it only on our instructions.
If you would prefer your data not to leave Egypt, do not use the forms — telephone us instead, on any of the numbers above.
How long we keep it
Contact submissions are kept while they remain relevant to a live or prospective relationship, or until you ask us to delete them. Anything marked as spam is cleared out routinely.
Newsletter records: an unconfirmed subscription can be removed at any time; unsubscribing records the date and stops all sending. Ask us and we will delete the row outright.
Portal and learning accounts: when somebody leaves an organisation we normally deactivate the account rather than delete it, because tickets, replies and audit entries name their author, and deleting the account would break the service history of that hospital’s equipment. A deactivated account cannot sign in and receives no email. If you want your personal data erased rather than deactivated, ask us — where we are not required to keep the record we will delete it or strip the identifying fields, retaining only what is needed to preserve the equipment history.
Uploaded files persist for as long as the ticket, report or content item that references them exists.
Session records end with the session. Audit entries are kept as security records and, by design, are never edited after the fact. Server logs rotate on a short cycle.
How we protect it
Passwords must be at least twelve characters and are stored only as scrypt hashes. Password-reset links expire after one hour.
There is no public registration anywhere on the site, which removes a whole class of abuse.
Access is role-based. Clients see only their own organisation’s tickets, installations and documents; internal notes and the reporting section are restricted to our staff; account and organisation administration is restricted further still.
Uploads go straight to storage through short-lived signed URLs, and every stored object has a database record naming who uploaded it.
No system is perfectly secure. If a breach affects your personal data we will act on it and notify you and the competent Egyptian authority where the law requires it.
Children
This site, the portals and the learning platform are intended for hospital and clinic staff and for our own employees. They are not directed at children and we do not knowingly collect personal data from anyone under 18. If you believe a child has given us data, write to us and we will delete it.
Your rights
Under Law No. 151 of 2020 you may ask us to confirm what personal data we hold about you and give you a copy; correct anything inaccurate or incomplete; delete data we no longer have grounds to keep; restrict or object to a particular use; withdraw consent, including newsletter consent, which you can also withdraw from the unsubscribe link in any newsletter; and receive the data you gave us in a portable form.
Write to info@capital-solutions.co with enough detail for us to find the records. We reply within a reasonable period and normally within thirty days, and we may ask you to verify your identity first so that we do not hand your data to somebody else. Exercising these rights costs nothing.
If our answer does not satisfy you, you may complain to Egypt’s Personal Data Protection Centre.
Changes to this policy
We revise this policy whenever the site changes what it collects or who processes it. The date shown at the top of this page is the date of the current version. Where a change materially affects data you have already given us, we will say so by email if we hold an address for you.