Partner API Terms

1. What these terms cover

These Partner API Terms apply when a manufacturer, distributor, pharmacy or other organisation ("you", a "partner") connects its systems to DawaTrack through the Partner API, in the sandbox or in production. They are an agreement between you and InsightFlow Technologies, which provides DawaTrack ("we", "us").

They add to our Terms of Service and Privacy Policy, which also apply to you. If these terms and the Terms of Service differ about the Partner API, these terms apply. The technical rules (endpoints, scopes, limits and formats) are in the developer documentation, which forms part of these terms.

The person accepting these terms confirms they're authorised to bind the organisation named in the application.

2. Getting access

• Sandbox. Sandbox credentials are issued straight away for building and testing. The sandbox holds sample data only; it can never read or change real facilities' or suppliers' records.
• Production. Production access is given only after our team reviews your application, including the PPB licence or business registration number you supply. We may ask for more information, and we may decline an application. A match in the PPB register supports an application; it doesn't approve it on its own.
• The information in your application must be accurate. Tell us promptly if it changes, including if a licence lapses, is suspended or is revoked.
• Access is for your organisation only. Don't share it with, or build it into a service for, another organisation without our written agreement.

3. Credentials

• Keep client secrets and tokens confidential, store them securely and use them only from systems you control. Never put them in mobile apps, browser code or public code repositories.
• You're responsible for every call made with your credentials.
• If you think a credential may have been exposed, rotate it straight away and tell us within 24 hours at partners@dawatrack.com.
• We may revoke or rotate a credential at any time to protect DawaTrack, its users or the data it holds, and will tell you why unless the law or an investigation prevents it.

4. Scopes and limits

• Your access is limited to the scopes we grant, which depend on your type of organisation. Don't try to reach data or actions outside them.
• Respect the rate limits published in the developer documentation. Don't get around them, for example with several accounts or credentials.
• Don't use the API to scrape, copy in bulk or mirror DawaTrack's data, the public medicine checks or the recalls list, and don't send traffic intended to disrupt the service.

5. Data you send

• Everything you send must be accurate and lawful, and yours to send: product and GS1 identifiers you own or are authorised to use, and batches, shipments, packing, recalls and other events that actually happened.
• Data you send can reach facilities and other partners, and is kept as part of the traceability record. Records needed for pharmacy and traceability law are kept for the periods those laws require, even if you later stop using the API.
• Recalls and safety notices you send through the API reach the facilities that received the affected batch. You remain responsible for your legal duties as a manufacturer or dealer, including starting recalls and notifying the Pharmacy and Poisons Board as its guidelines require. DawaTrack doesn't do that for you.
• If you discover that something you sent was wrong, correct it through the API or tell us at once, especially if it affects a recall or a batch's status.

6. Data you receive

• Use data you receive only for the purpose your access was granted for, such as tracing your products, running a recall or reconciling shipments.
• Don't sell, license or give it to anyone else, use it to profile facilities or individuals, or combine it to build a database that competes with DawaTrack.
• For any personal data you receive, you act as an independent data controller and must comply with the Data Protection Act, 2019, including keeping it secure and only as long as you need it.
• When your access ends, delete data you received through the API, except what the law requires you to keep.

7. Security and incidents

• Protect the systems that call the API and hold its data with appropriate technical and organisational measures, including encrypted connections and access limited to the people who need it.
• Tell us without undue delay, and in any case within 72 hours, after you become aware of a security incident that affects DawaTrack data or credentials, and help us deal with it.
• Don't test or probe DawaTrack's security, except under a written security-testing agreement with us. If you find a vulnerability, report it to partners@dawatrack.com and don't use or disclose it.

8. Webhooks

• Check the signature on every webhook before acting on it, as the developer documentation explains, and treat webhook endpoints and their secrets as credentials.
• Keep your endpoints available. We retry deliveries as the documentation describes; after that, a missed event can be fetched through the API. We may pause deliveries to an endpoint that keeps failing.

9. API changes

• We may add to the API at any time. Adding new fields, endpoints or event types isn't a breaking change, so build your integration to ignore what it doesn't recognise.
• Before a change that would break a working production integration, we'll email your contact address at least 90 days ahead and publish it in the developer documentation. Changes needed urgently for security or to comply with the law may come sooner; we'll explain why.
• The sandbox may change without notice.
• We may update these terms. We'll email partners at least 14 days before a material change takes effect. Continuing to use the API after that date means you accept the change.

10. Fees

Any fees for API access are set out in a written agreement with us. We won't start charging for access you already have without telling you at least 30 days ahead, so you can stop before then if you don't agree.

11. Names and logos

You may say accurately that your product works with DawaTrack. Don't suggest that we endorse, certify or partner with you beyond that, and don't use our logo without our written permission. We may list you as a partner, by name, unless you ask us not to.

12. Suspension and ending

• You can stop using the API at any time and ask us to close your partner account.
• We may end your access with 30 days' notice.
• We may suspend credentials straight away, and end your access if the problem isn't fixed, if you seriously break these terms, if a required licence lapses or is revoked, if continuing would break the law, or to protect DawaTrack, its users or the data it holds. Where we can, we'll tell you first and give you a chance to fix it.
• When access ends, section 6 applies to data you received, and records you sent stay in the traceability record as section 5 explains.

13. Liability and everything else

The API is provided as section 18 of the Terms of Service describes. Sections 17 (confidentiality), 19 (limitation of liability), 20 (indemnity), 23 (law and disputes) and 24 (general) of the Terms of Service apply to the Partner API too. For a partner that pays no fees, our total liability under section 19 is limited to KES 100,000 in any 12-month period.