UzimaNexus Privacy Policy

1. Scope and Who We Are

This Policy applies to personal data processed by UzimaNexus as a data controller or business operator in connection with the Services. In some cases (for example, when healthcare institutions use our platform), UzimaNexus may act as a processor/service provider on behalf of a healthcare customer.

Controller contact: UzimaNexus
Postal address: UzimaNexus, Nairobi, Kenya (full legal address available on request)
Email: info@uzimanexus.com
Support: admin@uzimanexus.com
Data Protection Contact / DPO Office: info@uzimanexus.com

2. Data We Collect

2.1 Information you provide directly

• Account data (name, email, phone number, password credentials, profile details).
• Identity verification data where required by law or policy.
• Support communications and feedback.
• Payment and billing metadata (processed securely through payment processors; full card data is not stored by UzimaNexus unless expressly stated).

2.2 Health and sensitive data

• Medical records, treatment history, prescriptions, lab results, and care coordination notes submitted through the Services.
• Sensitive personal information processed only where permitted by law and with an appropriate legal basis (e.g., consent, healthcare provision, legal obligation).

2.3 Automatically collected data

• Log and device data (IP address, app version, device model, OS, language, timezone).
• Usage analytics (feature usage, session data, diagnostics, crash reports, performance data, and advertising identifiers only where permitted and disclosed).
• Security and fraud prevention signals.

2.4 Data from third parties

• Healthcare providers, laboratories, insurers, or authorized integrations.
• Identity, fraud prevention, or analytics partners acting under contractual controls.

3. How We Use Personal Data

• Provide, maintain, and improve the Services and user experience.
• Deliver healthcare workflows, appointment support, and records management.
• Authenticate users and secure accounts.
• Process transactions, provide customer support, and send service notices.
• Conduct analytics, troubleshooting, abuse prevention, and incident response.
• Apply data minimization and purpose limitation, collecting only data necessary for defined services and legal obligations.
• Comply with legal, regulatory, and contractual obligations.
• Send marketing communications only where allowed and with required consent/opt-out controls.

4. Legal Bases for Processing

Where required by law (e.g., GDPR/UK GDPR), we rely on one or more of the following legal bases:

• Performance of a contract (providing requested Services).
• Legitimate interests (platform security, service improvement, fraud prevention).
• Consent (e.g., optional analytics, marketing, specific sensitive data uses).
• Legal obligation (compliance with healthcare, tax, and law enforcement requests).
• Vital interests/public interest in the area of public health where applicable.
• For special category data (including health), Article 9 GDPR/UK GDPR conditions such as healthcare or social care provision, explicit consent, substantial public interest, or legal claims where applicable.

5. How We Share Data

We do not sell personal data. We do not share personal health data for third-party advertising profiling. We share personal data only as necessary for legitimate operations, including:

• Healthcare providers and authorized organizations involved in your care.
• Service providers (cloud hosting, analytics, communications, payment processing, customer support), including providers such as hosting infrastructure, crash reporting, and notification delivery platforms.
• Professional advisors (legal, audit, compliance) under confidentiality obligations.
• Regulators, courts, or law enforcement when legally required.
• Successors in a merger, acquisition, or asset transfer (with notice where legally required).

All processors/service providers are subject to contractual restrictions and appropriate security controls.

6. International Data Transfers

Your personal data may be processed in countries other than your own. Where required, we implement transfer safeguards, such as Standard Contractual Clauses (SCCs), International Data Transfer Agreements, or other recognized legal mechanisms.

7. Data Retention

We retain personal data for as long as necessary to provide Services, comply with legal obligations, resolve disputes, and enforce agreements. Retention periods vary based on data type, legal requirements, and operational needs.

• Account and profile data: retained while your account is active and generally deleted or anonymized within 30-90 days after verified closure, unless retention is legally required.
• Healthcare records: retained according to applicable healthcare record retention laws and institutional requirements (which may require multi-year retention).
• Security and audit logs: retained for fraud prevention, safety, and compliance, generally for 12-24 months unless a longer legal hold applies.
• Backups: encrypted backups are rotated and purged on defined schedules consistent with business continuity and legal requirements.

8. Security Measures

We implement technical and organizational safeguards appropriate to risk, including encryption in transit and at rest, least-privilege access controls, role-based permissions, multi-factor authentication for administrative access, secure development practices, vulnerability management, and continuous monitoring. No system is 100% secure, but we continuously improve our protections.

If a notifiable data breach occurs, we will investigate promptly and provide notifications in line with applicable law, including GDPR/UK GDPR and Kenya Data Protection Act obligations where those laws apply.

9. Your Privacy Rights

Depending on your location, you may have rights to:

• Access and obtain a copy of your personal data.
• Correct inaccurate or incomplete personal data.
• Delete personal data, subject to legal exceptions.
• Restrict or object to certain processing activities.
• Withdraw consent where processing is based on consent.
• Data portability where technically feasible.
• Opt out of targeted advertising/sale/sharing where applicable under local law.
• Non-discrimination for exercising privacy rights.

To submit a request, contact info@uzimanexus.com. We may need to verify your identity before processing requests. We aim to acknowledge requests within 7 days and respond within 30 days, subject to lawful extensions.

Account deletion: You can request deletion in-app through Profile > Settings > Privacy > Delete Account, or by emailing info@uzimanexus.com. We will delete or anonymize eligible data, subject to legal or healthcare record retention obligations.

Automated decision-making: We do not make solely automated decisions that produce legal or similarly significant effects without meaningful human involvement. If this changes, we will update this policy and provide required rights notices.

10. Children’s Privacy

Our Services are not directed to children under the age where parental consent is required by applicable law (for example, under 13 in the U.S., or under 16 in certain regions) unless specifically designed for pediatric care through authorized guardians and healthcare providers. If we learn we collected personal data from a child unlawfully, we will delete it.

11. Healthcare and Sensitive Data Notice

UzimaNexus may process health information and other sensitive data. Such processing is handled with heightened protections, role-based access controls, and contractual/legal safeguards. Where applicable, we support healthcare privacy frameworks and contractual requirements (such as data processing agreements and business associate terms when required). We do not use personal health data for third-party behavioral advertising.

The Services are intended to support healthcare administration and information management; they do not replace emergency services. If you are experiencing a medical emergency, contact local emergency services immediately.

12. Cookies and Tracking Technologies

We use cookies and similar technologies for authentication, preferences, security, analytics, and product improvement. Mobile apps may use SDK-based identifiers for analytics and fraud prevention. Where required by law, we request consent before non-essential tracking and provide opt-out controls. On iOS, app tracking follows Apple's AppTrackingTransparency (ATT) framework where applicable.

13. Third-Party Services and Links

The Services may include links to third-party websites, SDKs, or integrations. Third-party services are governed by their own privacy notices and terms, and we encourage you to review them. We maintain contractual controls (such as DPAs) with processors where required.

14. Changes to This Policy

We may update this Privacy Policy from time to time. Material changes will be notified through reasonable channels, such as in-app notifications or updates on our website. Continued use of the Services after updates indicates acceptance, to the extent permitted by law.

15. Contact Us and Regional Representatives

For privacy questions, rights requests, or complaints:

• Email: info@uzimanexus.com
• General support: admin@uzimanexus.com
• DPO office: info@uzimanexus.com
• Postal: UzimaNexus, Nairobi, Kenya

If you are in a jurisdiction that grants the right to lodge a complaint with a supervisory authority, you may do so at any time. For EEA/UK users, representative details will be published here once designation is complete where legally required.