My Doktari Privacy Policy

1. Scope and Who We Are

This Policy applies to personal data processed by Le-Bumba Technologies as a data controller or business operator in connection with the My Doktari app and the other Services. In some cases (for example, when a healthcare institution uses My Doktari to serve its own patients), Le-Bumba Technologies may act as a processor/service provider on behalf of that healthcare customer, and the customer's own privacy notice may also apply.

Developer and controller: Le-Bumba Technologies
Application covered: My Doktari (Google Play)
Website: www.lebumbatech.com
Email: info@lebumbatech.com
Data Protection Contact: info@lebumbatech.com

2. Data We Collect

2.1 Information you provide directly

• Account data (name, email address, phone number, password credentials, profile details).
• Identity verification data where required by law or policy.
• Support communications and feedback you send to us.
• Payment and billing metadata (processed securely through third-party payment processors; full payment card data is not stored by Le-Bumba Technologies unless expressly stated).

2.2 Health and sensitive data

• Medical records, treatment history, prescriptions, lab results, and care coordination notes submitted through the Services.
• Sensitive personal information processed only where permitted by law and with an appropriate legal basis (for example, consent, provision of healthcare, or a legal obligation).

2.3 Automatically collected data

• Log and device data (IP address, app version, device model, operating system, language, timezone).
• Usage analytics (feature usage, session data, diagnostics, crash reports, performance data, and advertising identifiers only where permitted and disclosed).
• Security and fraud prevention signals.

2.4 Data from third parties

• Healthcare providers, laboratories, insurers, or authorized integrations.
• Identity, fraud prevention, or analytics partners acting under contractual controls.

3. How We Use Personal Data

• Provide, maintain, and improve the My Doktari app and the user experience.
• Deliver healthcare workflows, appointment support, and records management.
• Authenticate users and secure accounts.
• Process transactions, provide customer support, and send service notices.
• Conduct analytics, troubleshooting, abuse prevention, and incident response.
• Apply data minimization and purpose limitation, collecting only data necessary for defined services and legal obligations.
• Comply with legal, regulatory, and contractual obligations.
• Send marketing communications only where allowed and with the required consent and opt-out controls.

4. Legal Bases for Processing

Where required by law (for example, the Kenya Data Protection Act, GDPR, or UK GDPR), we rely on one or more of the following legal bases:

• Performance of a contract (providing the Services you request).
• Legitimate interests (platform security, service improvement, fraud prevention).
• Consent (for example, optional analytics, marketing, and specific sensitive data uses).
• Legal obligation (compliance with healthcare, tax, and law enforcement requirements).
• Vital interests or public interest in the area of public health, where applicable.
• For special category data (including health data), Article 9 GDPR/UK GDPR conditions such as healthcare or social care provision, explicit consent, substantial public interest, or the establishment of legal claims, where applicable.

5. How We Share Data

We do not sell personal data. We do not share personal health data for third-party advertising profiling. We share personal data only as necessary for legitimate operations, including with:

• Healthcare providers and authorized organizations involved in your care.
• Service providers (cloud hosting, analytics, communications, payment processing, customer support), including hosting infrastructure, crash reporting, and notification delivery platforms.
• Professional advisors (legal, audit, compliance) under confidentiality obligations.
• Regulators, courts, or law enforcement when legally required.
• Successors in a merger, acquisition, or asset transfer (with notice where legally required).

All processors and service providers are subject to contractual restrictions and appropriate security controls.

6. International Data Transfers

Your personal data may be processed in countries other than your own. Where required, we implement transfer safeguards such as Standard Contractual Clauses (SCCs), International Data Transfer Agreements, or other recognized legal mechanisms.

7. Data Retention

We retain personal data for as long as necessary to provide the Services, comply with legal obligations, resolve disputes, and enforce agreements. Retention periods vary based on data type, legal requirements, and operational needs.

• Account and profile data: retained while your account is active and generally deleted or anonymized within 30-90 days after verified closure, unless retention is legally required.
• Healthcare records: retained according to applicable healthcare record retention laws and institutional requirements (which may require multi-year retention).
• Security and audit logs: retained for fraud prevention, safety, and compliance, generally for 12-24 months unless a longer legal hold applies.
• Backups: encrypted backups are rotated and purged on defined schedules consistent with business continuity and legal requirements.

8. Security Measures

We implement technical and organizational safeguards appropriate to risk, including encryption in transit and at rest, least-privilege access controls, role-based permissions, multi-factor authentication for administrative access, secure development practices, vulnerability management, and continuous monitoring. No system is 100% secure, but we continuously improve our protections.

If a notifiable data breach occurs, we will investigate promptly and provide notifications in line with applicable law, including the Kenya Data Protection Act and GDPR/UK GDPR obligations where those laws apply.

9. Your Privacy Rights

Depending on your location, you may have rights to:

• Access and obtain a copy of your personal data.
• Correct inaccurate or incomplete personal data.
• Delete personal data, subject to legal exceptions.
• Restrict or object to certain processing activities.
• Withdraw consent where processing is based on consent.
• Data portability where technically feasible.
• Opt out of targeted advertising, sale, or sharing where applicable under local law.
• Non-discrimination for exercising your privacy rights.

To submit a request, contact info@lebumbatech.com. We may need to verify your identity before processing requests. We aim to acknowledge requests within 7 days and respond within 30 days, subject to lawful extensions.

Automated decision-making: We do not make solely automated decisions that produce legal or similarly significant effects without meaningful human involvement. If this changes, we will update this Policy and provide the required rights notices.

10. Account and Data Deletion

You can request deletion of your My Doktari account and associated personal data at any time:

• In the app: Profile > Settings > Privacy > Delete Account.
• By email: send a deletion request to info@lebumbatech.com from the email address registered to your account.

Once your identity is verified, we delete or anonymize eligible account and profile data, and remove associated usage data from our active systems. Some data may be retained where a legal, regulatory, healthcare record retention, fraud prevention, or dispute resolution obligation applies; in that case we retain only the minimum necessary and delete it once the obligation expires. Encrypted backups are purged on their normal rotation schedule.

11. Children’s Privacy

The Services are not directed to children below the age at which parental consent is required by applicable law (for example, under 13 in the United States, or under 16 in certain regions) unless specifically provided for pediatric care through authorized guardians and healthcare providers. If we learn that we have collected personal data from a child unlawfully, we will delete it.

12. Healthcare and Sensitive Data Notice

My Doktari may process health information and other sensitive data. Such processing is handled with heightened protections, role-based access controls, and contractual and legal safeguards. Where applicable, we support healthcare privacy frameworks and contractual requirements (such as data processing agreements and business associate terms when required). We do not use personal health data for third-party behavioral advertising.

The Services are intended to support healthcare administration and information management; they do not replace emergency services and do not constitute medical advice. If you are experiencing a medical emergency, contact your local emergency services immediately.

13. Cookies, SDKs, and Tracking Technologies

We use cookies and similar technologies for authentication, preferences, security, analytics, and product improvement. The My Doktari mobile app may use SDK-based identifiers for analytics, crash reporting, and fraud prevention. Where required by law, we request consent before non-essential tracking and provide opt-out controls. On iOS, app tracking follows Apple's AppTrackingTransparency (ATT) framework where applicable.

14. Third-Party Services and Links

The Services may include links to third-party websites, SDKs, or integrations. Third-party services are governed by their own privacy notices and terms, and we encourage you to review them. We maintain contractual controls (such as data processing agreements) with our processors where required.

15. Changes to This Policy

We may update this Privacy Policy from time to time. Material changes will be notified through reasonable channels, such as in-app notifications or updates on www.lebumbatech.com. The "Last Updated" date at the top of this Policy reflects the most recent revision. Continued use of the Services after updates indicates acceptance, to the extent permitted by law.

16. Contact Us and Regional Representatives

For privacy questions, rights requests, account deletion, or complaints relating to the My Doktari app, contact Le-Bumba Technologies:

• Email: info@lebumbatech.com
• General support: info@lebumbatech.com
• Data protection contact: info@lebumbatech.com
• Website: www.lebumbatech.com

If you are in a jurisdiction that grants the right to lodge a complaint with a supervisory authority, you may do so at any time. For EEA/UK users, representative details will be published here once designation is complete where legally required.