Privacy Policy

MEDevice Kenya Ltd (hereinafter referred to as "MEDevice Africa", "we", "us", or "our") is committed to protecting the privacy and confidentiality of personal data entrusted to us. We recognize that the right to privacy, as guaranteed under Article 31 of the Constitution of Kenya, 2010, and codified under the Data Protection Act, 2019, is a fundamental human right.

This Privacy Policy (the "Policy") outlines how we collect, use, process, store, disclose, and protect personal information obtained from visitors of our website (https://medevice.africa), members of our Talent Community, event participants, users of the MEDevice Africa EquipNet platform, healthcare facility clients, independent biomedical engineers, research participants, and any other stakeholders.

By accessing our website, subscribing to our newsletter, applying for opportunities through our Careers portal, registering for our events, or utilizing our MedTech services, you consent to the data practices described in this Policy.

For the purposes of this Policy, the following terms shall have the meanings assigned to them under the Data Protection Act, 2019:

Data Controller

means MEDevice Kenya Ltd, which determines the purpose and means of the processing of personal data.

Data Processor

means a natural or legal person, public authority, agency, or other body which processes personal data on behalf of the Data Controller.

Data Subject

means an identified or identifiable natural person who is the subject of personal data.

Personal Data

means any information relating to an identified or identifiable natural person (e.g., name, ID number, email address, physical address, phone number, location data, or online identifier).

Sensitive Personal Data

means data revealing a natural person’s race, health status, ethnic or social origin, conscience, beliefs, genetic data, biometric data, property details, marital status, family details (including names of children, parents, spouse or spouses), sex, or sexual orientation.

Processing

means any operation or set of operations performed on personal data, whether or not by automated means (e.g., collection, recording, organization, storage, adaptation, retrieval, use, disclosure, or destruction).

We only collect personal data that is necessary for the performance of our services, compliance with legal obligations, or the pursuit of our legitimate business interests. The categories of data we collect depend on how you interact with us:

A. General Website Visitors & Inquiries

• Contact Information: Name, email address, phone number, and organization when you fill out contact or inquiry forms, or subscribe to our newsletter.
• Technical Data: IP address, browser type and version, time zone setting, browser plug-in types, operating system, and platform via cookies and analytics.

B. Talent Community & Job Applicants (Careers Portal)

• Professional & Biodata Details: Name, email, phone number, physical address, nationality, resume/CV, cover letter, academic transcripts, professional certifications, employment history, and references.

C. Event & Webinar Registrants (MedTech Connect Series & Workshops)

• Registration Info: Name, job title, institutional or university affiliation, email address, and phone number.
• Media Captures: Photographs, video recordings, and audio recordings captured during public workshops, webinars, or physical events (which may be utilized for our professional reporting, educational efforts, or ecosystem promotion).

D. MEDevice Africa EquipNet Platform Users

• For Healthcare Facilities: Contact person’s details, facility location, facility licensing, equipment inventory, procurement requests, and billing information.
• For Biomedical Engineers: Biodata, academic credentials, licensing, engineering experience, geographical coverage, bank/mobile money details for payouts, and service delivery ratings.
• Transactional Data: Payment history, service logs, equipment diagnostic reports, and procurement records.

E. Research, R&D, and Medical Device Testing (Contextual Innovation)

• Survey Data: Demographic and professional insights gathered during our East African medical device landscape mappings, feasibility studies, and stakeholder interviews.
• Anonymized Device Data: Operational data from clinical simulations or validation of developed devices (e.g., smart nebulizers like AeroPulse), prioritizing absolute anonymization of patient data.

In accordance with Section 25 of the Data Protection Act, 2019, MEDevice Africa ensures that all personal data is:

1. 1Processed lawfully, fairly, and in a transparent manner.
2. 2Collected for explicit, specified, and legitimate purposes and not further processed in an incompatible manner.
3. 3Adequate, relevant, and limited to what is necessary for the stated purpose (data minimization).
4. 4Accurate and, where necessary, kept up to date.
5. 5Kept in a form which permits identification of data subjects for no longer than is necessary.
6. 6Processed in a highly secure manner using appropriate technical and organizational measures.
7. 7Not transferred outside of Kenya unless adequate data protection safeguards or explicit consents are in place.

We will only process your personal data where we have a lawful basis to do so under Section 30 of the Data Protection Act, 2019. These bases include:

• Consent: You have given clear and unambiguous consent for us to process your personal data for a specific purpose (e.g., subscribing to a newsletter, joining our Talent Community, or participating in an event).
• Contract: Processing is necessary for the performance of a contract to which you are a party (e.g., executing services on the EquipNet platform, processing a procurement order).
• Legal Obligation: Processing is necessary for compliance with a statutory or legal obligation (e.g., regulatory compliance with health boards, tax reporting to KRA).
• Legitimate Interests: Processing is necessary for our legitimate business interests, provided they do not override your fundamental rights and freedoms.

Withdrawal of Consent

You retain the absolute right to withdraw your consent to data processing at any time. To withdraw your consent, contact us at admin@medevice.africa. Upon receipt of your request, we will stop processing your data unless there is an overriding legal or contractual obligation that requires its retention.

As a specialized MedTech innovation firm, MEDevice Africa may occasionally interact with Sensitive Personal Data, particularly in relation to health status indicators, clinical feasibility mappings, or device development user-testing.

We will never collect or process Sensitive Personal Data without your explicit, written, and informed consent. Such data is subject to strict security protocols, including end-to-end encryption, strict role-based access limits, and anonymization where technically feasible.

We do not sell, rent, or lease your personal data to third parties. We may, however, share your information with trusted partners to help perform statistical analyses, provide customer support, arrange for logistics and delivery, or operate technical aspects of our systems (such as cloud hosting providers).

All such third parties are:

• Prohibited from using your personal data except to provide these specific services to MEDevice Africa.
• Required to maintain strict confidentiality and adhere to data protection standards equivalent to those outlined in this Policy.
• Subject to binding Data Processing Agreements (DPAs) in compliance with Kenyan law.

Under the Data Protection Act, 2019, you have robust rights regarding your personal data. MEDevice Africa is dedicated to facilitating the exercise of these rights:

1. 1Right to be Informed: The right to know why your data is being collected, how it is being used, and who it is being shared with.
2. 2Right of Access: The right to request copies of your personal data held in our custody. To request access, formally email admin@medevice.africa. We shall comply with verified access requests within seven (7) business days.
3. 3Right to Rectification: The right to request that we correct or update any personal data that is inaccurate, outdated, incomplete, or misleading.
4. 4Right to Erasure ("Right to be Forgotten"): The right to request the deletion or destruction of your personal data where there is no longer a lawful basis for its retention. We will respond to verified erasure or rectification requests within fourteen (14) business days.
5. 5Right to Object: The right to object to the processing of all or part of your personal data, including processing for direct marketing purposes.
6. 6Right to Data Portability: The right to receive your personal data in a structured, commonly used, and machine-readable format, or to request that we transfer it directly to another data controller where technically feasible.

MEDevice Africa may use your contact details to send you newsletters, updates on medical device innovations, or event invitations. We will notify you of this intent at the point of data collection and obtain your consent.

We provide a direct, user-friendly opt-out link in all our electronic communication channels. Alternatively, you may request to opt-out by emailing us. Any such direct marketing opt-out request will be actioned and finalized within twenty-four (24) hours of receipt.

The security of your personal data is a top priority. MEDevice Africa employs state-of-the-art administrative, physical, technical, and organizational security measures to prevent unauthorized access, alteration, disclosure, loss, or destruction of your information. These measures include:

• Encryption of data in transit and at rest.
• Enforcing strict password protection policies and multi-factor authentication (MFA) across internal corporate platforms.
• Limiting access to personal data strictly to employees, contractors, and engineers who require it in the course of their duties.
• Conducting periodic security audits of our website, software databases, and internal systems.
• Securing physical storage (e.g., locked cabinets for sensitive hardcopy documents).

We retain personal information only for as long as it is reasonably required to fulfill the purposes for which it was collected, to meet our contractual agreements, or to satisfy legal, tax, or regulatory obligations.

• Financial & Transactional Records: Preserved for a minimum period of seven (7) years in line with Kenyan corporate, tax, and accounting regulations.
• Applicant Data (Talent Community): Retained for up to two (2) years to facilitate ongoing recruitment and matching, unless the candidate requests prior deletion.
• General Inquiries & Marketing Data: Kept until consent is withdrawn or the interaction becomes inactive, after which it is securely deleted or anonymized.

Our servers and IT infrastructure may occasionally utilize international cloud environments. In accordance with Section 34 and 35 of the Data Protection Act, 2019, your personal data will only be transferred outside of Kenya if:

• The destination country has adequate data protection laws as verified by the Office of the Data Protection Commissioner (ODPC).
• Appropriate safeguards are established via standard contractual clauses (SCCs) with the external processors.
• You have given explicit, informed consent to the transfer.

MEDevice Africa may occasionally update this Privacy Policy to reflect changing business models, medical device technological advancements, and shifting regulatory frameworks. We recommend that users periodically review this page to stay informed about how we protect their personal data.

If you have any questions, concerns, or requests regarding this Privacy Policy, your rights, or our data handling practices, please do not hesitate to contact us:

• MEDevice Kenya Ltd
• Office Location: Westlands, Nairobi, Kenya
• Email Address: admin@medevice.africa
• Website: https://medevice.africa

If you believe your data protection rights have been violated and we have not addressed your concern satisfactorily, you have the right to lodge a formal complaint with:

• The Office of the Data Protection Commissioner (ODPC)
• Website: www.odpc.go.ke
• Email: complaints@odpc.go.ke