Terms of Service

1. Who these terms are with

These Terms of Service ("Terms") are an agreement between you and InsightFlow Technologies, which provides the DawaTrack platform ("DawaTrack", "we", "us", "our"). They apply to every part of DawaTrack: the facility platform, the supplier portal, the Partner API and the public tools on our website.

If you accept these Terms for a pharmacy, clinic, hospital, supplier or other organisation, you confirm that you're authorised to bind it, and "you" means that organisation.

These Terms work together with our Privacy Policy and, for facilities, the Data Processing Agreement presented inside your portal ("DPA"). If these Terms and the DPA conflict about personal data, the DPA applies.

2. Words we use

• Facility: a pharmacy, clinic, hospital, dispensary, veterinary practice or similar organisation registered on DawaTrack, with its own portal and web address.
• Supplier: a licensed wholesaler, distributor, manufacturer or importer approved to use the supplier portal.
• Partner: an organisation given credentials for the Partner API.
• Authorised users: the people you allow to use your account, such as staff added by your facility's administrator.
• Customer data: the information you or your authorised users put into DawaTrack, including stock, sales, prescriptions, patient and customer records, orders and documents.
• Regulated records: prescriptions, dispensing logs, the controlled-drugs register and other records that Kenyan law requires to be kept for a set time.

3. Who can use DawaTrack

DawaTrack is for businesses, not individual consumers. To use it you must be at least 18, and the organisation you act for must hold the licences its work requires, such as a Pharmacy and Poisons Board ("PPB") premises licence for a pharmacy or a dealer's licence for a supplier. You must keep those licences valid while you use DawaTrack and tell us if one is suspended, revoked or not renewed.

Members of the public may use our public tools (section 5.4) without an account.

4. Accounts and security

• Give us accurate information when you register and keep it up to date.
• Each authorised user must have their own login. Don't share passwords or accounts.
• Your facility's administrator decides who has access and with what role, and should remove access promptly when someone leaves. You're responsible for what happens under your account.
• We offer two-step verification for every account and recommend it, especially for administrators. A facility can require it for its administrators and managers.
• Tell us straight away at support@dawatrack.com if you suspect someone has accessed your account without permission.

5. The services

5.1 Facility platform. Purchase orders and receiving against your suppliers' shipments, stock and batch records, dispensing by scan with prescriptions and the controlled-drugs register, returns to suppliers and transfers between branches, traceability records and recall notices, each in a portal at your facility's own web address.

5.2 Supplier portal. Purchase orders from facilities, shipments and each receiver's confirmation of them, returns, batch trace and recalls.

5.3 Partner API. Programmatic access for approved partners, described in our developer documentation.

5.4 Public tools. The medicine check, the recalls and withdrawals list and the facility finder are free information services. Section 10 explains their limits.

We improve DawaTrack over time and may add, change or remove features. We'll tell you in advance if a change materially reduces what you use DawaTrack for.

6. Fees

• Facilities use DawaTrack free. There is no trial and no subscription, and we don't ask for a payment method.
• If we ever decide to charge facilities, we'll email every facility at least 30 days ahead, and nothing is charged unless the facility agrees to it.
• Suppliers and partners pay what a signed written agreement with us sets out, on the payment and refund terms it gives. Without one, their use is free.
• Regulators use DawaTrack free.
• Subscription payments facilities made before 29 October 2026 are covered by our Refund Policy.

7. Facilities' responsibilities

DawaTrack helps you keep records and follow procedures, but your facility remains responsible for running a lawful practice. In particular:

• Every dispensing and clinical decision is made by your appropriately qualified staff, using their professional judgement.
• You remain responsible for complying with the Pharmacy and Poisons Act (Cap. 244) and its regulations, the Health Act, 2017, the Digital Health Act, 2023, the Data Protection Act, 2019 and any other law that applies to you, including rules on prescriptions, controlled drugs and record keeping.
• The accuracy of what your staff enter, including batch numbers, expiry dates, quantities and patient details, is your responsibility.
• When you receive a recall or safety alert through DawaTrack, you're responsible for acting on it, including quarantining stock and following the issuing supplier's and the PPB's instructions.
• Settings that switch on safeguards, such as controlled-drug sign-off or supplier licence checks, are there to help you; switching them off doesn't change your legal duties.
• Tax obligations, including KRA eTIMS invoicing where it applies to you, remain yours. DawaTrack doesn't submit invoices to KRA.

8. Suppliers' responsibilities

• Every supplier is reviewed by our team before approval. We may ask for more information, and we may decline, suspend or remove a supplier, for example if a licence lapses or documents can't be verified. A match in the PPB register supports an application; it doesn't approve it on its own.
• Everything you submit, including licences, certificates and company documents, must be genuine, current and yours to submit. Tell us promptly if any of it changes or expires.
• Product, batch, price and delivery information you send to facilities must be accurate. Sales are between you and the facility; DawaTrack is not a party to them and doesn't take title to, store or deliver any goods.
• You remain responsible for your legal duties as a dealer, including product quality, good distribution practice, and starting recalls and notifying the PPB as its guidelines require. DawaTrack's recall tools help you reach the facilities that received a batch; they don't notify the PPB for you or replace that duty.
• Facilities' contact and order information you see through the portal may be used only to fulfil and support their orders.

9. Partner API

Partners using the API also accept our Partner API Terms, which apply in addition to this section. In short:

• Keep your API credentials secret and use them only from systems you control. You're responsible for all calls made with them.
• Respect the rate limits and the scopes you're granted, and don't try to reach data outside them.
• Sandbox credentials are for testing only and never touch real regulated data.
• We may change the API. We'll give reasonable notice of changes that break existing integrations, except where an urgent change is needed for security or legal reasons.

10. Not medical advice

DawaTrack doesn't give medical, pharmaceutical or legal advice, and nothing on the platform or website should be read as such.

The public medicine check reports recalls that suppliers have recorded on DawaTrack and, for serialised packs, what DawaTrack's network has recorded about that unit. A "no recall found" or "valid" result is not a guarantee that a medicine is genuine, safe or suitable for anyone. DawaTrack is not the national authentication system and does not act for the PPB. Anyone worried about a medicine should speak to a pharmacist or other health professional, or contact the PPB.

Information taken from the PPB register and other public sources is shown as we last received it and may be out of date.

11. Data protection

11.1 Roles. For customer data, including patient information, your facility is the data controller and DawaTrack is the data processor: we process it only on your documented instructions, to provide the services. For your account, billing, support and usage information, DawaTrack is the data controller, as explained in our Privacy Policy.

11.2 Our commitments as processor. Under the Data Protection Act, 2019 and the DPA, we:

• keep each facility's data in its own separate space and protect it with appropriate technical and organisational measures, including encryption in transit and access controls;
• bind our staff and subprocessors to confidentiality, and use subprocessors only under written terms that protect your data at least as well as these Terms;
• list our subprocessors in our Privacy Policy, and tell you before we add one so you can object;
• transfer data outside Kenya only with the safeguards the Act requires;
• tell you without undue delay after we become aware of a personal data breach affecting your data, with the information you need to meet your own duty to notify the Office of the Data Protection Commissioner and, where needed, the people affected;
• help you respond to requests from people exercising their rights, such as access or correction, and with data protection impact assessments where we reasonably can.

11.3 Your commitments as controller. You must have a lawful basis for the personal data you put into DawaTrack, including health data, which the Act treats as sensitive. You must give patients and customers any notices the law requires, and only enter what you need for your purposes.

11.4 Contact. Our Data Protection Officer can be reached through our data protection contact page or at privacy@dawatrack.com.

12. Your data and record retention

• You own your customer data. You give us permission to use it only to provide, secure and support the services and to meet our legal obligations.
• You can export your data at any time from your portal, in a machine-readable format.
• Regulated records are kept for at least 20 years and can't be deleted before then, from inside the platform or at your request, because pharmacy law requires them to be kept. You may set a longer period in your settings.
• If your account is closed, you can export your data for 30 days. After that we delete your customer data, except regulated records still inside their retention period. We keep those securely, with access restricted to what the law requires, and give a copy to you or to whoever the law requires on request. We delete them when the period ends.
• We may keep a limited copy of billing and audit records where the law requires us to, such as tax records.
• Anonymised, aggregated information that can't identify you, your patients or your facility may be used to run and improve DawaTrack.

13. Acceptable use

You must not, and must not let anyone else:

• use DawaTrack for anything unlawful, including selling, dispensing or recording medicines in breach of pharmacy or health law;
• enter information you know to be false, including fake batches, recalls, licences or documents, or impersonate another person or business;
• try to access another facility's, supplier's or partner's data, or test, probe or bypass our security, except under a written security-testing agreement with us;
• upload malicious code, or overload, disrupt or scrape the services, including the public tools;
• copy, reverse-engineer or resell DawaTrack, or use it to build a competing product, except as the law allows;
• use the services in a way that breaches the Computer Misuse and Cybercrimes Act, 2018.

14. Intellectual property

DawaTrack, including its software, design, documentation and brand, belongs to us or our licensors. While you use DawaTrack under these Terms, we give you a non-exclusive, non-transferable right to use it for your own business under these Terms. Your customer data stays yours (section 12). If you send us suggestions, we may use them without obligation to you.

15. Third-party services

Some features depend on services we don't control, such as email and SMS delivery and the PPB register. Those services have their own terms, which you may need to accept, and they can be unavailable or change. Where you connect your own systems, such as your ERP through the Partner API, you're responsible for those systems and their terms. We aren't responsible for third-party services' failures, but we'll tell you about problems we know of.

16. Availability and support

• We aim for 99.5% monthly availability of the production services, not counting planned maintenance, which we announce at least 24 hours ahead where we can.
• Support is available by email and through your portal. Our team works Monday to Friday, 8:00 to 18:00 East Africa Time.
• We back up your data regularly and keep recovery procedures, but you should also export records you can't do without.

17. Confidentiality

Each of us will keep the other's non-public business information confidential, use it only for this agreement, and share it only with people who need it and are bound to keep it confidential. This doesn't apply to information that is public through no fault of the receiver, or that a court, regulator or law requires to be disclosed (after notice to the other party where that's allowed).

18. Warranties and disclaimers

We'll provide the services with reasonable skill and care. Apart from that and anything else these Terms say expressly, the services are provided "as is", and to the extent the law allows we don't promise that they'll be uninterrupted or error-free, or that they'll meet every regulatory requirement that applies to your business.

19. Limitation of liability

Nothing in these Terms limits liability for fraud, for death or personal injury caused by negligence, or for anything else the law doesn't allow to be limited.

Subject to that, to the extent the law allows:

• neither of us is liable for indirect or consequential loss, or for loss of profit, revenue or goodwill;
• our total liability for all claims arising from these Terms in any 12-month period is limited to the fees you paid us in the three months before the event that caused the claim.

20. Indemnity

You'll compensate us for losses and reasonable costs from claims by third parties, including regulators, that arise because you or your authorised users broke the law or these Terms, or put data into DawaTrack without a lawful basis. We'll tell you promptly about such a claim and let you take part in handling it.

21. Suspension and termination

• You can close your account at any time by contacting us. A signed written agreement may set its own notice period.
• We may end these Terms with 30 days' written notice.
• We may suspend access straight away, and end these Terms if the problem isn't fixed, if you seriously breach them, if a required licence lapses or is revoked, if continuing would break the law, or to protect the security of DawaTrack or other customers. Where we can, we'll tell you first and give you a chance to fix it.
• After termination, section 12 applies to your data. Sections 10, 11, 12, 14, 17, 19, 20, 23 and 24 continue to apply.

22. Changes to these Terms

We may update these Terms, for example to reflect new features or changes in the law. We'll publish each version here with its date. For a material change, we'll email account holders at least 14 days before it takes effect. If you don't agree with a change, you can close your account before it takes effect; continuing to use DawaTrack after that date means you accept it. Changes needed urgently for legal or security reasons may take effect sooner, and we'll explain why.

23. Law and disputes

These Terms are governed by the laws of the Republic of Kenya. If a dispute arises, we'll both first try in good faith to settle it by discussion between senior representatives for 30 days. If that fails, the courts of Nairobi, Kenya, have exclusive jurisdiction. Either of us may still ask a court for urgent relief at any time.

24. General

• Whole agreement. These Terms, the Privacy Policy, the DPA and any order form or written agreement signed by both of us are the whole agreement about DawaTrack. A signed written agreement prevails over these Terms where they differ.
• Events beyond control. Neither of us is liable for delays caused by events beyond our reasonable control, such as national power or internet outages, provided we take reasonable steps to limit the effect.
• Transfer. You may not transfer these Terms without our written consent. We may transfer them as part of a reorganisation or sale of our business, and we'll tell you if we do.
• Severability and waiver. If a court finds part of these Terms unenforceable, the rest still applies. Not enforcing a right straight away doesn't waive it.
• Notices. We send notices to the email address on your account. You send notices to legal@dawatrack.com.
• Language. These Terms are written in English. A translation is for convenience; the English version applies.