Privacy Policy

1. Who we are

DawaTrack is provided by InsightFlow Technologies ("DawaTrack", "we", "us"). It's a platform for pharmacies, clinics, hospitals and other health facilities, the suppliers that sell to them, and partners that connect through our API, plus free public tools such as the medicine check.

This policy explains how we handle personal data under the Data Protection Act, 2019 of Kenya ("the Act") and its regulations. It applies to our website, the facility platform, the supplier portal, the Partner API and our emails and messages. Our Terms of Service and, for facilities, the Data Processing Agreement in your portal also apply.

2. Our two roles

Under the Act, who is responsible for personal data depends on whose purposes it serves.

3. What we collect

3.1 Facility owners and staff. Name, email, phone, role, branch, employee or professional registration number, and the facility's name, licence number, location, KRA PIN and similar business details. Sign-in records: when you sign in, two-step verification settings (we never see your authenticator app's secret after setup), and the actions you take in the platform, kept as an audit trail.

3.2 Patients and customers (for facilities). What the facility chooses to record, which can include name, phone number, prescriptions, medicines dispensed, prescriber details and payment details. Health information is sensitive personal data under the Act.

3.3 Suppliers. Company details, PPB licence, KRA PIN, registration number, contact person's name, phone and email, and the documents you upload, which may name directors or your pharmacist-in-charge. We also check your licence against the PPB's public register.

3.4 API partners. Organisation and contact details, and records of API calls made with your credentials.

3.5 Payments. For subscriptions and for facilities' M-Pesa sales: phone numbers, M-Pesa transaction codes, amounts and status. We don't collect card numbers.

3.6 Website visitors and public tools. What you type into the medicine check (product numbers, batch and serial numbers), details you send through the contact form or the facility finder, and the facility you last opened from the finder, kept in a cookie.

3.7 Technical and security data. IP address, browser and device type, pages visited in the platform, failed sign-in attempts, and error reports. We use these to keep DawaTrack secure and working.

4. Why we use it

We don't sell personal data, don't use it for advertising, and don't use patient data for anything other than providing the service to the facility.

5. Cookies

• Always on (needed for the site to work): keeping you signed in, protecting forms against forgery, and remembering your cookie choice. We keep a record of the choice you make, as proof of consent.
• Preferences: the facility you last opened from "Find your facility", so we can offer it next time. It holds only that facility's web address.
• Analytics, only if you agree: Plausible, which counts visits to the website without cookies and without storing your IP address, hosted in the EU. Nothing loads until you agree.

We don't use advertising cookies. Change your cookie choices

6. Who we share it with

6.1 Service providers (subprocessors). They work under written terms that require them to protect the data and use it only for us.

We'll update this list before adding a new provider that handles facilities' data, as our Terms of Service commit us to.

6.2 Other DawaTrack users, as the service requires. A facility and a supplier see each other's business and contact details on the orders between them. Facilities that received a recalled batch see the supplier's recall notice. The public recalls list and medicine check show supplier names and recall details, never which facilities received a batch.

6.3 Authorities. We share data with the Pharmacy and Poisons Board, the Data Protection Commissioner, courts or law enforcement when the law requires it, and tell the affected customer where we're allowed to.

6.4 Business changes. If our business is reorganised or sold, data may pass to the new owner under the same protections, and we'll tell you.

7. Transfers outside Kenya

Several of the providers in section 6 store or process data outside Kenya. When that happens we rely on the safeguards the Act and its regulations allow, such as contractual commitments that protect data to the standard of Kenyan law, and we choose providers with recognised security practices. You can ask us for details of the safeguard that applies to a provider.

8. How long we keep it

9. How we protect it

• Each facility's data is kept in its own database space, so one facility can't reach another's.
• Data is encrypted in transit. Passwords are stored as one-way hashes, and sensitive settings such as M-Pesa keys are encrypted in our database.
• Two-step verification is available on every account and can be required by a facility. Sign-in pauses after repeated wrong passwords, and accounts sign out after a period without activity.
• Actions in the platform are recorded in an audit trail, and access to production systems is limited to staff who need it.
• We back up data regularly. If a breach puts personal data at risk, we act under the Act: we notify the Data Protection Commissioner and affected people where we're the controller, and the facility without undue delay where we're its processor.

10. Your rights

Under the Act you have the right to:

• be told how your personal data is used (this policy);
• get a copy of the personal data we hold about you;
• have inaccurate data corrected, and data deleted where we have no reason to keep it;
• object to our use of it, including where we rely on legitimate interests;
• have its use restricted while a question about it is resolved;
• receive data you gave us in a portable format, and have it sent to another provider where that's possible;
• withdraw consent, such as for analytics cookies, at any time.

Some data we must keep by law, such as regulated records for their 20-year period; we'll tell you when that applies. Write to privacy@dawatrack.com or use our data protection contact page. We'll confirm who you are, won't charge you, and will reply within the time the law sets.

Patients: because your facility controls your records, send requests to them. If you write to us, we'll pass your request to the facility and help it answer.

If you're unhappy with how we've handled your data, you can complain to the Office of the Data Protection Commissioner at odpc.go.ke. We'd appreciate the chance to put it right first.

11. Automated decisions

We don't make decisions with legal or similarly significant effects about you by automated means alone. For example, a supplier's licence matching the PPB register is shown to a person on our team, who makes the approval decision.

12. Children

DawaTrack accounts are for adults acting for businesses. Facilities may record children's information as patients; they're responsible for doing so lawfully, including any consent the Act requires from a parent or guardian, and we process it on their instructions.

13. Changes to this policy

We'll publish each version here with its date. For a material change, we'll email account holders at least 14 days before it takes effect.