Privacy Notice

1. Who does what

Under Tanzania's Personal Data Protection Act, 2022, the facility that uses Daktariflow decides why and how its patients' data is used (the "controller"). MIBASOL runs the system on the facility's behalf (the "processor") and does not use patient data for its own purposes.

2. What we hold

Facility data: facility name, contact person, phone, email, plan and payment records.

Staff data: name, email, role, professional registration number, sign-in times.

Patient data entered by the facility: identity and contact details, visits, vital signs, diagnoses, prescriptions, laboratory results, invoices and payments. This includes health information, which is sensitive personal data.

3. Why

We use data only to provide the service: running the facility's daily work, billing, security and support, and meeting legal duties. We do not sell data and do not use patient data for advertising.

4. How we protect it

Each facility's data is separated from every other facility's, enforced in the database itself. Passwords are stored hashed, administrators use two-step sign-in, connections are encrypted, access is limited by role, sensitive actions are written to an audit log, idle sessions sign out automatically, and the database is backed up regularly with restore tests.

5. Who sees it

Only the facility's own staff, according to the roles the facility gives them. Our staff do not browse patient records; we access a facility's data only to fix a problem it asks us to fix, and that access is recorded. We share data with others only when the law requires it or the facility instructs us.

6. How long

Health records are kept for as long as the facility needs them and the law requires. When a facility leaves, we export its data to it and then delete it after a reasonable period, except what the law requires us to keep.

7. Your rights

People have the right to know what is held about them, to correct it, to object, and to ask for deletion where the law allows. Patients should ask the facility that treated them; the facility can ask us for help. Facility and staff data requests can come to us directly.

8. If something goes wrong

If personal data is lost or exposed, we tell the affected facility without delay so it can meet its duty to inform the Personal Data Protection Commission and the people affected.

9. Where data is stored

Data is stored on servers chosen for security and reliability. If servers are outside Tanzania, we use them only where the law permits and with suitable safeguards.