Privacy Policy
What personal data we collect, why, and the rights you have.
This policy explains what personal data VitalPoint collects through vitalpoint.io, the VitalPoint app for health facilities, the Family Plan and our shop, how we use it, and the choices and rights you have. We follow Tanzania’s Personal Data Protection Act, 2022.
1 Who we are
VitalPoint (“VitalPoint”, “we”) runs vitalpoint.io and the VitalPoint platform from Tanzania. You can reach us at privacy@vitalpoint.io.
Our role depends on the service:
- Health facilities: when a pharmacy, clinic, dispensary or hospital records a patient’s details and vital signs in VitalPoint, the facility decides why and how that data is used. The facility is the data controller; we process the data on its behalf and on its instructions.
- Everything else: for website visitors, Family Plan members, shop customers and facility staff accounts, we are the data controller.
2 What we collect
- Account details: name, email address, phone number, role and password (stored only in encrypted, hashed form). For facilities, also the facility name, type, licence number, address and phone.
- Patient details entered by a facility: first and last name, date of birth, sex, phone number and, if given, the type and number of an identity document such as NIDA.
- Health data: blood pressure, blood sugar, heart rate, oxygen saturation (SpO₂), weight, height, waist size and temperature, and the reports, scores and risk levels produced from them.
- Shop orders: your name, phone number, region, delivery address, the items you order and how you choose to pay.
- Payments: mobile money number and transaction references. Your PIN and full card number go directly to the payment provider; we never see or store them.
- Technical data: IP address, browser and device type, language, pages visited, and the cookies described below.
Health data is sensitive personal data. We handle it with extra care and only for the purposes in this policy.
3 How we use your data
- To provide our services: create accounts, record vital signs, produce and deliver health reports, and run the Family Plan.
- To send a report to a patient on WhatsApp when the facility asks us to.
- To process shop orders, deliveries and payments, including activation fees and subscriptions.
- To give support and send service messages, such as payment confirmations and password resets.
- To keep the service secure, prevent fraud and fix problems.
- To understand how the website is used and improve it, using statistics that do not identify you.
- To meet our legal obligations.
We do not sell your personal data, and we never use health data for advertising.
We rely on your consent, on what is needed to provide the service you asked for, on our legal obligations and, for security and improvement, on our legitimate interests. Where we rely on consent, you can withdraw it at any time.
4 Automated health reports
VitalPoint reports are produced with the help of automated tools, including artificial intelligence services run by carefully selected providers. These providers receive only the information needed to produce the report, process it on our instructions and may not use it for their own purposes.
A report is a screening aid. It does not make decisions about anyone’s treatment: a qualified health worker should always review it. See our Medical Disclaimer.
6 Transfers outside Tanzania
Some of our providers store or process data outside Tanzania. When this happens we transfer only what is necessary and use the safeguards required by the Personal Data Protection Act, such as contracts that protect your data to the same standard.
8 How long we keep data
- Patient records and reports: while the facility’s account is active or as the facility instructs, and afterwards for as long as health-record laws require.
- Accounts: until you close your account, then for a limited time for backups, disputes and legal requirements.
- Orders and payment records: for as long as tax and accounting laws require.
When data is no longer needed, we delete it or make it anonymous.
9 How we protect data
We use encrypted connections (HTTPS), hashed passwords, access controls so that each facility sees only its own patients, and regular backups. No system is completely secure. If a breach puts your data at risk, we will inform you and the Personal Data Protection Commission as the law requires.
10 Your rights
Under the Personal Data Protection Act you have the right to:
- know whether we hold your data and get a copy of it;
- have wrong or incomplete data corrected;
- have your data deleted when it is no longer needed or was processed unlawfully;
- restrict or object to how we use your data;
- withdraw your consent at any time.
To use these rights, write to privacy@vitalpoint.io. We may ask you to confirm your identity. If you are a patient of a health facility, you can also ask the facility directly; we will help it respond.
If you are not satisfied with our answer, you can complain to the Personal Data Protection Commission (PDPC) of Tanzania.
11 Children
Our website and accounts are for adults aged 18 and over. Health facilities may record the vital signs of children; they must do so with the consent of a parent or guardian.
12 Changes to this policy
We may update this policy. We will change the date at the top and, for important changes, tell you by email or with a notice in the app before they take effect.
13 Contact us
VitalPoint · Tanzania · privacy@vitalpoint.io