Privacy Policy

1. Information We Collect

Account & Profile Data

When you register, we collect name, email, phone number, role, facility name, and authentication credentials.

Patient Health Data

The Platform processes patient data (demographics, clinical records, lab results, prescriptions, billing) on behalf of your facility. We act as a data processor; you remain the data controller.

Usage & Technical Data

We automatically collect IP address, device info, browser type, access times, and feature usage for analytics and security.

2. How We Use Your Information

• Provide, maintain, and improve the Platform.
• Authenticate users and enforce access controls.
• Process patient data per your instructions and applicable law.
• Send service communications (updates, security alerts, billing).
• Analyze usage to enhance features and performance.
• Comply with legal obligations and protect rights.

3. Legal Basis (Kenya Data Protection Act)

We process personal data on the following grounds:

• Contract performance: To deliver the Platform per your agreement.
• Legitimate interest: Security, fraud prevention, analytics.
• Legal obligation: Regulatory compliance, audit trails.
• Consent: Marketing communications (opt-out available).

4. Data Sharing

We do not sell personal data. We may share data with:

• Subprocessors: Cloud hosting (AWS/Azure), payment gateways, email/SMS providers — under DPAs.
• Your facility: Authorized staff per role-based access.
• Legal authorities: When required by law or court order.
• Business transfers: In a merger/sale, with notice and equivalent protections.

5. Data Security

• Encryption in transit (TLS 1.2+) and at rest (AES-256).
• Role-based access control and audit logs.
• Regular vulnerability scanning and penetration testing.
• Incident response plan with 72-hour breach notification per Kenyan law.

6. Data Retention

• Account data: Retained while account is active, then deleted within 90 days of termination.
• Patient data: Retained per your facility's policy and Kenyan medical record laws (minimum 7 years).
• Logs & analytics: Aggregated/anonymized after 12 months.

7. Your Rights

Under the Data Protection Act, you have the right to:

• Access your personal data.
• Rectify inaccurate data.
• Request erasure (subject to legal retention).
• Restrict or object to processing.
• Data portability.
• Withdraw consent (for marketing).
• Lodge a complaint with the Office of the Data Protection Commissioner.

Submit requests to medvelohealth@gmail.com.

8. International Transfers

Our infrastructure may be hosted outside Kenya. Transfers rely on standard contractual clauses or adequacy decisions to ensure equivalent protection.

9. Cookies & Tracking

We use essential cookies for authentication and session management. Analytics cookies (optional) help us improve the Platform. You can manage preferences in your browser.

10. Children's Privacy

The Platform is not directed at children under 18. We do not knowingly collect children's data. If you believe we have, contact us for immediate deletion.

11. Changes to This Policy

We may update this policy. Material changes will be notified via email or in-app banner 30 days before taking effect. Continued use constitutes acceptance.

12. Contact

Data Protection Officer: medvelohealth@gmail.com
MedVelo, Nairobi, Kenya