Privacy Policy

KwezaCare is a health care service offered by Worketech Limited in partnership with Wandikweza Organisation.

• Worketech Limited (Area 18A, Gomani Street, Plot 1, Lilongwe, Malawi) builds and operates the KwezaCare mobile application and the systems behind it.
• Wandikweza Organisation provides the health care services delivered through KwezaCare, including appointments, home visits, nursing care and clinical services, and is the custodian of the clinical records created when you receive care.

In this policy, "KwezaCare", "we", "our" and "us" mean Worketech Limited and Wandikweza Organisation acting together for the KwezaCare service.

This Privacy Policy describes how we collect, use, disclose and safeguard your information when you use the KwezaCare mobile application (the "App"). We are committed to protecting your privacy and to complying with applicable data protection law, including the Malawi Data Protection Act, 2024, the EU General Data Protection Regulation (GDPR), the California Consumer Privacy Act (CCPA), the Children's Online Privacy Protection Act (COPPA) and Apple's App Store Review Guidelines.

Your use of the App is also governed by the KwezaCare User Agreement.

Information you provide directly

• Full name, gender, date of birth and medical scheme details
• Contact information: email address, phone number and home address
• Symptoms, medications and care updates you share so that care can be arranged
• Emergency contact and next of kin details
• Profile preferences and the feedback you send us

Information collected automatically

• IP address, device identifier, operating system version and device type
• App usage data, crash logs and diagnostic data
• Location data, in real time or in the background, only with your explicit permission

Information from Google

If you choose Sign in with Google, Google shares your name and email address with us so that we can create or find your account. We never receive your Google password.

Biometric information

If you turn on Face ID, Touch ID or fingerprint unlock, your device checks your face or fingerprint itself. KwezaCare never receives, sees or stores your biometric data.

What the App does handle is the information needed to arrange care: appointment requests and logs, home visit details, the symptoms or care updates you choose to share with a health worker, and medication reminders you set. Where this information is shown to you in the App, it is retrieved for display and is not retained on the device after you sign out.

Health information is sensitive personal data, and we apply extra protections to it:

• Only the clinic staff involved in your care, and whose role requires it, can see it.
• Access is through individual staff accounts with role-based permissions, and staff are signed out after a period of inactivity.
• It is never used for advertising, marketing or non-health-related analytics, and it is never sold.

We use your data only for purposes directly related to the core functionality of the KwezaCare App:

• Providing personalised medical care and services
• Scheduling appointments, home visits and reminders
• Communicating securely with health workers
• Monitoring treatment progress with your care team
• Billing for care and recording payments
• Keeping your account secure and preventing fraud
• Analysing trends, in aggregated form, to improve how care is delivered
• Complying with legal and regulatory obligations

We do not use your information to make automated decisions that have legal or similarly significant effects on you.

We process your personal data on the following lawful bases:

• Your explicit consent (GDPR Article 6.1.a)
• Contractual necessity to provide health care (Article 6.1.b)
• Legal obligations (Article 6.1.c)
• Legitimate interests in securing accounts and improving care (Article 6.1.f)
• For health information: Article 9.2.h (provision of health care) or Article 9.2.a (explicit consent)

Where you are in Malawi, the equivalent lawful bases under the Malawi Data Protection Act, 2024 apply.

We do not collect personal data without your informed, prior consent. You will see a clear permission prompt before the App accesses your location, camera or any other sensitive data, explaining why it is needed. For example, when the App asks for your location:

You can withdraw consent at any time in the App's settings or your device settings. Withdrawing a permission may limit features that depend on it — for example, home visits are harder to arrange without an address — but it will never prevent you from using the rest of the App or from deleting your account.

We share your data only in these circumstances:

• Between Worketech Limited and Wandikweza Organisation, to operate the service and deliver your care.
• With authorised medical personnel involved in your care, for care coordination, according to their role.
• With your medical scheme, where this is needed to process a claim for your care.
• With public health authorities, where the law requires it or where it is necessary to protect someone's life or safety.
• With service providers who host and support the App under contracts that require them to protect your information to the standard set out in this policy.

We do not sell your personal information, and we do not share it for advertising or marketing.

We request and collect only the data strictly necessary for medical assistance, appointment management, emergency contact and user support. If a feature does not need a piece of information, the App does not ask for it — and health records, which the App does not need to keep in order to work, are not stored by it at all.

Data is retained only as long as necessary to fulfil the purpose for which it was collected:

• Account and profile information: while your account is active.
• Appointment and billing records: for as long as required by Malawi tax, accounting and health care regulations, after which they are deleted or anonymised.
• Security and diagnostic logs: for a short period, then discarded.
• Clinical records: held by the health care provider under its own record-keeping obligations, not by the App.

When we no longer need information, we delete or anonymise it.

To delete your account:

1. Open KwezaCare and go to the Profile tab.
2. Tap Delete Account.
3. Confirm when the App asks you to.

Your account is closed immediately and all associated personal data is permanently erased within 30 days, unless a legal obligation requires us to keep a specific record for longer — for example billing records required by tax law, or clinical records the health care provider must retain. Anything retained on that basis is separated from your profile and destroyed when its retention period ends.

You can also ask us to delete your account by writing to info@worketech.co.mw from the email address on your account. We action verified requests within 30 days. Deletion is permanent and cannot be undone.

We implement industry-standard security protocols:

• End-to-end encryption in transit (TLS/HTTPS) for all data moving between the App and our servers.
• Encrypted storage for data at rest.
• Secure authentication with role-based access controls, so staff reach only the records their role requires.
• Sign-in tokens held in your device's secure storage — Keychain on iPhone, Keystore on Android — on that device only, and excluded from device backups.
• Sessions that expire automatically, and accounts that lock after repeated failed sign-in attempts.

No data is stored on iCloud.

No system is completely secure. If a breach affects your information, we will notify you and the relevant authority as the law requires.

You have the right to:

• access your personal data and receive a copy of it;
• correct information that is wrong or incomplete;
• delete your account and your personal data, from inside the App or on request;
• withdraw consent at any time, where we rely on it;
• object to or restrict certain uses of your data;
• receive your data in a portable, machine-readable format;
• lodge a complaint with your data protection authority.

To exercise any of these rights, contact us using the details in section 16. We may need to confirm your identity first, and we respond within 30 days.

KwezaCare does not knowingly collect data from children under 13 without verified parental consent. For users under 18, data is collected with the consent of a parent or guardian, or as the law otherwise allows.

A parent or guardian can arrange care for a child through their own KwezaCare account. If you believe a child has provided us with personal data without the necessary consent, contact us and we will delete it.

We do not track users for advertising purposes, and the App contains no advertising. We do not share health information for marketing, advertising or non-health-related analytics. If tracking is ever introduced, we will request your permission through Apple's App Tracking Transparency framework first, and update this policy before doing so.

We may update this Privacy Policy as the service or the law changes. The version and dates at the top of this page show when it last changed. If the changes are significant we will tell you in the App or by email, and we may ask you to accept the updated policy before you continue.

Earlier versions stay available at their own addresses, so you can always read the version you accepted.

For privacy enquiries, data requests and account deletion:

Questions about your clinical care or your medical records should go to Wandikweza Organisation, your health care provider. We will pass on any request we receive.

All App content, systems and medical tools are owned or licensed by KwezaCare. See the User Agreement for the terms that govern your use of the App, and this page for the current privacy policy.