Privacy Policy

This Privacy Policy explains how OncoLinks (“we”, “us”) collects, uses, stores, shares, and protects personal data when you use our platform. It is designed to give effect to Article 31(c) and (d) of the Constitution of Kenya and the Data Protection Act, 2019 (“the Act”), as overseen by the Office of the Data Protection Commissioner (ODPC).

We act as a data controller for personal data we determine the purposes and means of processing. Service providers (for example cloud authentication or database hosts) may act as data processors on our documented instructions.

1. Principles we follow (Act, s.25)

We process personal data so that it is:

• Processed in accordance with your right to privacy.
• Processed lawfully, fairly, and transparently.
• Collected for explicit, specified, and legitimate purposes — and not further processed incompatibly with those purposes.
• Adequate, relevant, and limited to what is necessary.
• Accurate and, where necessary, kept up to date.
• Kept in identifiable form only as long as needed for the stated purposes.
• Not transferred outside Kenya unless appropriate safeguards exist or you consent (Act, s.25(h) and Part VI).

2. Personal data we collect

Depending on your role, we may process:

• Identity and contact data: name, email, phone, organisation/facility, county/country.
• Account and security data: authentication identifiers, role, activation status, audit logs of admin actions.
• Professional data (medics/institutions): specialty, licence/registration numbers, facility details.
• Campaign and donation data: campaign stories you publish, donation amounts/kinds, conditions, shipment/receipt confirmations, utilisation summaries.
• Technical data: device/browser metadata, IP address, cookies/similar technologies (see Cookie Policy).

Sensitive / special-category data. Health-related information (for example diagnosis notes a patient chooses to include in a campaign, or aggregate utilisation metrics) may constitute sensitive personal data under Kenyan law. We only process such data where a lawful basis applies (typically your consent, or another basis permitted by the Act for the specific context), with heightened care, minimisation, and access controls.

3. Purposes and lawful bases (Act, s.30 & s.32)

We process personal data to:

• Create and manage accounts, roles, and authentication (contract / consent).
• Operate campaigns, QR share pages, donor tabs, matching, certificates, and leaderboards (contract / legitimate platform operation with safeguards).
• Enable medic approval and institutional donation workflows (contract / consent).
• Send security emails such as verification and password reset via Firebase Authentication (contract / legitimate security interest).
• Comply with law, prevent fraud/abuse, and handle disputes or ODPC requests (legal obligation / public interest where applicable).
• Improve reliability and security of the service (legitimate interests balanced against your rights).

Where processing is based on consent, you may withdraw consent without affecting the lawfulness of processing before withdrawal. Withdrawal may limit features that depend on that consent (General Regulations, 2021 — consent must be free, specific, informed, and not bundled unfairly).

4. Duty to notify (Act, s.29)

Before or when we collect data, we aim to inform you of:

• That personal data is being collected and why.
• Your rights under section 26 of the Act.
• Whether sharing with third parties occurs and what safeguards apply.
• How to contact us regarding your data.
• Whether providing data is voluntary or required to use a feature, and consequences of not providing it.

5. Your rights as a data subject (Act, s.26 and related provisions)

• Right to be informed about how your personal data is used.
• Right of access to your personal data in our custody.
• Right to object to processing of all or part of your personal data.
• Right to correction of false or misleading data.
• Right to deletion of false or misleading data about you; and broader erasure where the Act provides.
• Right to data portability where applicable.
• Rights regarding automated decision-making where relevant.
• Right to restrict processing in circumstances set out in the Act and General Regulations (for example contested accuracy).

To exercise rights, contact us using the details below. We will respond within the timelines contemplated by Kenyan regulations (for example access requests are generally expected to be handled promptly and without charge in ordinary cases). Minors’ rights are exercised by a parent/guardian as provided in the Act.

6. Sharing and processors

We may share personal data with:

• Other OncoLinks users as needed for the feature you use (for example a medic seeing a linked campaign; donors seeing approved public campaign pages).
• Infrastructure providers (currently Firebase / Google Cloud for auth and database) under processor arrangements.
• Professional advisers or authorities where required by law or to protect rights and safety.

We do not sell personal data. Public campaign pages intentionally expose campaign titles, stories, and fundraising progress that patients choose to publish — please avoid including unnecessary identifiers of third parties.

7. Cross-border transfers

If personal data is transferred outside Kenya (for example to cloud regions), we will rely on appropriate safeguards and/or consent as required by the Act, and document those safeguards for accountability to the ODPC where required.

8. Retention

We retain account, campaign, donation, and audit records only as long as needed for the purposes above, accountability (including donation utilisation trails), legal claims, and statutory obligations, then delete or anonymise where feasible.

9. Security

We apply organisational and technical measures appropriate to the risk (access control by role, authenticated APIs, encrypted transport in transit via HTTPS in production, and restricted admin capabilities). No method of transmission or storage is perfectly secure; please use strong passwords and protect your devices.

Where a notifiable personal data breach occurs, we will assess notification duties to the Data Commissioner and affected data subjects under the Act and General Regulations.

10. Children

OncoLinks is not directed at children creating accounts independently. Processing of a child’s data requires parental/guardian authority as set out in the Act.

11. Complaints to the ODPC

If you are unhappy with how we handle your personal data, contact us first. You also have the right to lodge a complaint with the Office of the Data Protection Commissioner:

• Website: https://www.odpc.go.ke/
• Email (general): info@odpc.go.ke
• Office: Britam Tower (12th Floor), Hospital Road, Upperhill, Nairobi
• Phone (as published by ODPC): +254 752 896 867 / +254 796 954 269

12. Contacting OncoLinks about privacy

For access, correction, erasure, objection, or other privacy requests, email the privacy contact published on your OncoLinks deployment or use the in-app admin channel. Please include enough information for us to verify your identity and locate your records.

13. Changes

We may update this Policy to reflect product, legal, or ODPC guidance changes. The “Last updated” date will change when we do. Continued use after an update constitutes notice of the revised Policy for ongoing processing, without limiting your rights under the Act.