Privacy Notice

Version 2026-10-12

We collect only what we need to get medicines and care to you: who you are, where to deliver, what you ordered, and the prescriptions that authorise it. Health data is shared only with the pharmacy or practitioner handling your order.

Who is responsible

HealingMeds Technologies, which runs Healing Meds, is the data controller for the personal data described here. We handle it under Kenya's Data Protection Act, 2019. For any privacy question or request, contact us through Help & support in the app or at support@healingmeds.app.

What we collect

• Account: your phone number, and your name, email and password if you give them.
• People you care for: the name, date of birth and allergies of anyone you add, such as a child or parent you order or book for.
• Delivery: the addresses you save, including a map pin and the area name.
• Orders and payments: what you bought, from which pharmacy, the amount, and the payment reference from M-Pesa or Paystack. We never see your M-Pesa PIN or card number.
• Health data: allergies you tell us about, prescriptions you upload, prescriptions issued to you in a consultation, and the medicines you order.
• Care: doctor consultations (times, messages, and the video call itself while it happens; calls are not recorded), nurse home visits and vaccine bookings.
• Identity (pharmacies, doctors, nurses and riders only): business details, KRA PIN, licences and a National ID. The National ID is stored only if you explicitly consent.
• Rider location: while a rider is delivering, their phone's location, so the customer and pharmacy can follow the trip. It is deleted after a short period.
• Device and usage: app version, device type, network address, approximate location from your network, and which screens you use, so we can find and fix faults.

Why we use it, and on what basis

• To provide the service you asked for: to take, dispense and deliver your order, take payment, and run consultations and bookings.
• With your consent: to use your health data, to store a National ID, and to store your data outside Kenya (see below).
• Because the law requires it: to check that prescription-only medicines are properly authorised, and to keep pharmacy and tax records.
• For our legitimate interests: to verify sellers and doctors so you can trust who you buy from, keep the service secure, prevent fraud and fix faults.

We do not make decisions about you that are based only on automated processing. Pharmacists and doctors make every clinical decision.

Who we share it with

• The pharmacy, doctor or nurse handling your order or booking: they see what they need to dispense, advise or visit.
• The rider delivering it: your delivery address and phone number, for that trip only.
• Payment processors: Safaricom (M-Pesa) and Paystack, to take payments and send refunds.
• Our technology providers, under contract and only on our instructions:
  • Railway (servers and database) and Cloudflare (file storage, including prescriptions and licences);
  • Vercel (our website);
  • Google Firebase (sign-in codes and app notifications);
  • Google Maps (address search and maps);
  • Agora (live video for consultations);
  • Africa's Talking (some text messages, including backup sign-in codes).
• Authorities, when the law requires it, for example the Pharmacy and Poisons Board or the police in a fraud case.

We do not sell your personal data or your health data.

Where your data is stored

Our servers and database are in Singapore, and files are held by Cloudflare, which may store them in more than one country. This means your personal data, including health data, is transferred and stored outside Kenya. We only use providers that protect data under contract, and we keep the data encrypted in transit. When you agree to this notice at sign-up you consent to this transfer, including of your health data (sections 48 and 49 of the Data Protection Act, 2019). You can withdraw that consent at any time through Help & support; we then cannot provide the services that need that data.

How long we keep it

Order, payment and prescription records are kept as long as the law requires for pharmacy and tax records. Other account data is kept while your account is open, and removed or anonymised after it is closed.

Your rights

Under the Data Protection Act, 2019 you can ask us to:

• show you the data we hold about you, and give you a copy;
• correct it, or delete it where the law allows;
• stop or limit a particular use of it;
• withdraw a consent you gave, such as consent to store a National ID.

Ask us through Help & support in the app. We may need to confirm it is you before we act. If you are not happy with how we handled your request, you can complain to the Office of the Data Protection Commissioner (odpc.go.ke).

Security

Data is transmitted over encrypted connections, your session token is held in your device's secure storage, and access to health data is restricted to the pharmacy or practitioner handling your case. No online service can be made completely secure. If a security incident is likely to put your data at risk, we will act to contain it, notify the Data Protection Commissioner, and tell you as the law requires.

Children

The app is for adults aged 18 and over. If you order or book on behalf of a child, you are responsible for that child's data and confirm you are their parent or guardian.

Changes

If this notice changes materially we will raise the version and show you the update in the app.