Privacy policy.

1. About this policy

This policy explains how MedX Technologies Kenya Ltd ("MedX Kenya", "we", "us") handles personal data in connection with our laboratory software in Kenya. It is written for:

• patients whose tests are processed by a laboratory, hospital or clinic that uses our software;
• facility staff who use our software at work;
• customers and business contacts of MedX Kenya.

Our software is MedX Workspace, a laboratory information system that laboratories use to register patients with their test requests, manage samples, record results and issue reports. In this policy, "the System" means MedX Workspace as deployed for a Kenyan laboratory, together with its identity service and its FHIR data store. The System processes patient data on behalf of the laboratories that use it.

We follow the Data Protection Act, 2019 and the regulations made under it, and the Digital Health Act, 2023.

2. Who we are and our role

MedX Technologies Kenya Ltd is a company registered in Kenya, company number PVT-8Z1ZRZB8, registered office Woodvale, Woodvale Street, Westlands, Nairobi; P.O. Box 70423-00100 GPO Nairobi. MedX affiliates develop the software and provide second-line support under a services and data processing agreement with MedX Technologies Kenya Ltd.

We have two roles under the Data Protection Act, 2019:

• For patient data we are a data processor. The laboratory, hospital or clinic that tests you is the data controller: it decides what data is collected and why. We store and process the data in the System only on the facility's instructions, under a written contract. If you are a patient, your facility's own privacy notice also applies, and your facility is your first point of contact.
• For our own business data we are a data controller. This covers the user accounts of facility staff, and the details of our customers, business contacts and people who contact us.

We are registered with the Office of the Data Protection Commissioner (ODPC) as a data controller (registration 165-593B-D994, certificate no. 30174, valid 8 October 2026 to 8 October 2028) and as a data processor (registration 165-593B-D994, certificate no. 27507, valid 22 September 2026 to 22 September 2028).

3. What personal data we handle

4. Where the data comes from

• Patient data comes from the facility: from you at registration, from the request form completed by your clinician, from laboratory staff, from the facility's other systems (for example its electronic medical record) and from laboratory analysers that send results to the System.
• Staff user data comes from the facility administrator who invites the member of staff, and from the user.
• Business contact data comes from you or your organisation.
• Technical data is generated when the System is used.

5. Why we use personal data, and our lawful basis

We do not use patient data for marketing. We do not sell personal data. Only aggregated or de-identified data, which does not identify any patient, is used for service statistics or, where the facility agrees, research.

When you are registered, the facility records that you have been given its privacy notice and any consent it asks for.

6. Who we share data with

• The facility that holds your record, and its staff according to their role.
• Clinicians and others the facility directs, for example the clinician who requested your test, or a referral laboratory. The facility gives or sends your printed report to you or your clinician.
• The national Health Information Exchange (Afya Connect), where the facility uses it: the System looks up and confirms your identity in the national client registry when you are registered, identifies the facility by its Kenya Master Health Facility List (KMHFL) code, and sends released laboratory results to your shared health record, on the facility's behalf.
• Public health authorities, where the law requires notifiable disease reporting and IDSR reporting: for example the facility's disease surveillance focal person, the sub-county and county disease surveillance coordinators, and the Ministry of Health's Kenya Health Information System (KHIS). The System sends these alerts and weekly reports on the facility's behalf.
• Our sub-processors, who help us provide the service, each under a written agreement that requires them to protect the data and use it only for our instructions:
  • MedX affiliates: software development and second-line support, under a services and data processing agreement with MedX Kenya. Their engineers, who may be outside Kenya, can see patient data only during a support session that the facility approves (section 7);
  • Servercore (Nairobi, Kenya): hosting of the System in a Tier III data centre in Nairobi;
  • Angani Limited (Nairobi, Kenya): storage of encrypted backups at a second data centre in Nairobi;
  • Amazon Simple Email Service (Amazon Web Services, Cape Town region): delivery of account invitations, password resets and system notifications. Patient data in these emails is kept to the minimum needed;
  • Africa's Talking (Nairobi, Kenya): delivery of SMS notifiable disease alerts and result notifications.
• Authorities such as the ODPC, the Digital Health Agency, courts or the police, where the law requires us to.

Where the facility enables it, the System sends result notifications to patients and clinicians by SMS or email, with only the details needed to tell them a result is ready. We tell our customers before we add a new sub-processor.

7. Where the data is kept

Kenyan patient data is stored and processed in Kenya, on MedX-operated servers in the Servercore Nairobi region (a Tier III data centre in Nairobi operated by iColo/Digital Realty). Each facility's data is held in its own database. Backups are kept at a second, separate data centre in Nairobi, operated by Angani Limited.

The servers are administered by MedX Kenya staff based in Kenya. MedX engineers outside Kenya, including those of MedX affiliates, have no access to patient data by default. If a support case needs it, the facility's administrator can grant one named engineer a support session, linked to the support ticket, that lasts at most 4 hours, allows viewing only unless the administrator allows changes, and can be ended at any time. Everything done in the session is recorded in the facility's audit trail. No copy of Kenyan patient data is stored outside Kenya.

To deliver account and notification emails, the recipient's email address and the message are passed to Amazon Simple Email Service in its Cape Town region (South Africa), under the provider's data processing terms and the safeguards required by the Data Protection Act, 2019. Patient data in email is kept to the minimum needed.

8. How long we keep data

The facility decides how long patient records are kept. Our default periods are below; records are kept for at least 7 years, or longer where Ministry of Health records guidance or the facility requires.

Records under a legal hold are kept until the hold is released. At the end of the period data is securely deleted through an approved disposal process recorded in the audit trail.

9. How we protect data

We protect personal data with technical and organisational measures, including:

• access based on each user's role, checked on the server for every request and limited to their own facility, with individual accounts only;
• multi-factor authentication for staff who review and release results, administrators and all MedX staff;
• encryption of data in transit (TLS 1.3 on our public endpoints, and TLS 1.2 or higher on our connections to external services such as the Health Information Exchange, email and SMS providers) and encryption of stored data and backups (AES-256);
• an audit trail of who changed which record and what they changed, which also records who viewed records and cannot be altered;
• regular backups and monitoring, staff confidentiality agreements and training;
• independent security testing.

If a personal data breach affects patient data, we tell the facility within 24 hours of becoming aware of it and help it inform the ODPC and, where required, affected people.

10. Your rights

Under the Data Protection Act, 2019 you have the right to:

• be informed of how your personal data is used (this policy and the facility's notice);
• access the personal data held about you;
• object to the processing of all or part of your personal data;
• have inaccurate or misleading data corrected;
• have false or misleading data deleted, and data deleted where there is no longer a lawful reason to keep it;
• data portability: to receive your data in a structured, commonly used, machine-readable format and have it sent to another controller where technically possible;
• restrict processing in certain circumstances.

Some rights are limited by law. For example, laboratory records may need to be kept for your ongoing care or to meet health records rules even if you ask for deletion, and public health reporting required by law cannot be stopped by objection. We will explain if a right cannot be applied.

How to exercise your rights

• Patients: please contact the facility that tested you, because it controls your record. If you contact us, we will pass your request to the facility promptly and help it respond. The System lets the facility export your data, and it records every correction made to your details in the audit trail.
• Facility staff, customers and business contacts: contact our Data Protection Officer at privacy@medx.international.

We may ask you to confirm your identity before acting on a request. We acknowledge requests within 7 days and answer them within the period set by the Data Protection Act, 2019 and its regulations. There is normally no charge.

11. Children

Laboratories test children, so the System holds data about children on behalf of facilities. The facility is responsible for obtaining any consent needed from a parent or guardian and for giving them its privacy notice. A parent or guardian may exercise a child's rights through the facility. Records of children are kept for longer (section 8). We do not offer any service directly to children.

12. Cookies and similar technologies

MedX Workspace uses only session cookies that are strictly necessary to sign staff in and keep their session secure:

• a session cookie set by the facility's sign-in gateway (oauth2-proxy), which is valid only for that facility's own web address;
• the session cookies of our sign-in service (Keycloak), which end when the session ends.

We do not use advertising or analytics cookies, and the System contains no third-party analytics. The address field does not send what you type to a public mapping service. Patients do not use the System directly, so no cookies are set on patients' devices.

13. Automated decision-making

The System flags quantitative laboratory results that fall outside reference ranges for the patient's age, sex and sample type (high or low), and prints the laboratory's interpretation guide for each test on the report. It also alerts staff to critical results that need urgent attention. These flags support qualified laboratory staff and clinicians; results are reviewed and released by laboratory staff, and no decision that has a legal or similarly significant effect on you is made solely by automated means.

When a released result matches a condition that the law requires to be reported, the System alerts the facility's surveillance contacts so that they can follow up. This supports reporting that is required by law; it is not a decision about your care.

14. Complaints

If you are unhappy with how your data has been handled, please contact the facility (for patient records) or our Data Protection Officer. You also have the right to complain to the Office of the Data Protection Commissioner (ODPC), www.odpc.go.ke.

15. Changes to this policy

We review this policy at least once a year. If we make significant changes, we will publish the new version on this page with its date and tell our customers. The version and date are shown at the top of this policy.

16. Contact us

This policy applies alongside the MedX group privacy policy, which covers our website and business contacts across the group.