Privacy policy

This policy explains how Safravo Limited ("Safravo", "we", "us") handles personal information when you use DawaSmart, including the website, web workspace, mobile app, support channels and related services.

A pharmacy, clinic or hospital that uses DawaSmart is generally the controller of the patient, staff and operational data it enters. In those cases, Safravo processes that information to provide the service and according to the facility's instructions.

Depending on the services a facility enables, DawaSmart may process:

• Account and contact details for authorised users and facility administrators.
• Facility, branch, subscription, support and billing administration information.
• Operational records such as sales, inventory, suppliers, expenses, appointments and service activity.
• Patient, visit, billing, dispensing and clinical workflow information entered by an authorised facility.
• Technical information needed to secure, operate and improve the service, including device, log and usage data.

We use information only as needed to operate the DawaSmart service, including to:

• Create and administer workspaces, accounts, subscriptions and authorised access.
• Provide the operational workflows, support, communications and receipts a facility chooses to use.
• Protect the service, investigate faults or misuse, and maintain audit and security records.
• Meet legal, regulatory, accounting and contractual obligations.
• Improve reliability and usability using aggregated or de-identified service insights where appropriate.

We do not sell personal information. We share information only where necessary to provide DawaSmart, comply with law, protect the service, or with your direction.

• Infrastructure, communications, payment and support providers acting on our behalf.
• Authorised staff and users within the facility workspace, according to the access the facility assigns.
• Professional advisers, regulators or public authorities where disclosure is legally required.
• A successor organisation if Safravo is involved in a merger, acquisition or restructuring, subject to appropriate safeguards.

We use technical and organisational safeguards designed to protect DawaSmart data, including access controls, authentication, audit context and secure service operations. No internet service can be guaranteed completely secure, so facilities must also protect their credentials, devices and authorised-user access.

Where a facility processes patient or other sensitive data, it remains responsible for assigning appropriate access and using the system in accordance with applicable professional and privacy obligations.

DawaSmart uses cloud infrastructure that may process data outside Kenya, including DigitalOcean infrastructure in the United States. Where data is transferred internationally, Safravo applies appropriate contractual, technical and organisational safeguards consistent with applicable law.

We retain information for as long as needed to provide the service, maintain security and audit records, resolve support issues, meet legal obligations and enforce agreements. On closure of a workspace, data is handled under the applicable subscription or data-processing terms; facilities should arrange any required export before service access ends.

Subject to applicable law, individuals may request access to, correction of, objection to, restriction of, deletion of, or portability of their personal information. For information held by a facility, contact that facility first because it controls the relevant patient or staff record.

To update a marketing preference or make a privacy request about DawaSmart, contact us at info@safravo.co.ke.

We may update this policy when DawaSmart, our legal obligations or our processing practices change. Material changes will be communicated through the service or by another appropriate channel. Questions or requests can be sent to info@safravo.co.ke or +254 746 289 413.