Privacy Policy
Last updated: July 2026. This Privacy Policy explains how UbuntuCare ("we," "our," or "us") collects, uses, stores, and protects your personal and health data when you use our platform. We are committed to protecting your privacy in accordance with the Zambia Data Protection Act No. 3 of 2021 and applicable international standards.
Table of Contents
1. Data We Collect
We collect the minimum data necessary to deliver safe healthcare: name, contact details, date of birth, national ID (where required), medical history, diagnoses, medications, laboratory results, vital signs, and insurance information. We also collect account credentials and usage logs for security and audit purposes. Sensitive health data is only collected with explicit, informed consent and is never used for purposes beyond direct care, public health reporting (de-identified), and regulatory compliance.
2. How We Use Your Data
Data is used exclusively for: providing clinical care, coordinating appointments and referrals, managing pharmacy and laboratory workflows, generating de-identified public-health analytics, improving platform functionality and user experience, and meeting legal and regulatory obligations as required by Zambian law. We do not use patient data for advertising, profiling, or any commercial purpose unrelated to healthcare delivery.
4. Data Retention & Deletion
Health records are retained for the period specified by Zambian healthcare regulations and the Zambia Ministry of Health record-keeping guidelines. After the statutory retention period expires, data is securely deleted or irreversibly de-identified. Account data is retained until account closure, subject to any legal holds or ongoing care obligations. Patients may request earlier deletion of their data, subject to legal and clinical retention requirements.
5. Your Rights
Under the Zambia Data Protection Act No. 3 of 2021, you have the following rights: right to access your personal data, right to rectify inaccurate data, right to erasure (subject to legal holds), right to restrict processing, right to data portability in a structured, machine-readable format, right to object to processing, and right to withdraw consent at any time without affecting the lawfulness of processing before withdrawal. To exercise these rights, contact our Data Protection Officer at dpo@ubuntucare.zm.
7. Data Security Measures
All data in transit is encrypted using TLS 1.3. Data at rest is encrypted using AES-256. Access to patient data is strictly role-based, with granular permissions mapped to clinical roles (provider, nurse, lab tech, pharmacist, etc.). Every access event is logged to an immutable audit trail. We conduct annual security audits by independent third parties, regular penetration testing, and mandatory data protection training for all staff. Our infrastructure is monitored 24/7 for security events.
8. Data Breach Notification
In the event of a data breach that affects personal health information, we will: contain and remediate the breach within 24 hours, notify the Zambian Data Protection Commissioner within 72 hours as required by law, notify all affected individuals without undue delay, provide clear information about the nature of the breach and steps taken, and offer credit monitoring or identity protection services where appropriate. Our incident response plan is tested quarterly.
9. International Data Transfers
If patient data is transferred outside Zambia, such transfers are governed by: standard contractual clauses approved by the Zambian Data Protection Commissioner, adequacy decisions recognizing equivalent data protection in the recipient country, and explicit patient consent where required. We maintain a register of all international data transfers and conduct periodic Data Protection Impact Assessments (DPIAs) for cross-border data flows.
10. Children's Privacy
UbuntuCare may process health data of minors (individuals under 18 years) only with the explicit consent of a parent or legal guardian. We collect the minimum data necessary for the child's healthcare. Parents or guardians have the right to access, correct, and request deletion of their child's health data. We do not knowingly process data of children for any purpose other than direct healthcare delivery.
11. Changes to This Policy
We may update this Privacy Policy to reflect changes in legal requirements, platform capabilities, or operational practices. Material changes will be communicated via: email notification to the account holder, a notice on the platform dashboard at least 30 days before the change takes effect, and where appropriate, separate consent for new data processing activities. Continued use of the platform after changes take effect constitutes acceptance of the updated policy.
12. Contact & Complaints
For questions, concerns, or complaints about this Privacy Policy or our data practices, contact: Data Protection Officer — dpo@ubuntucare.zm. Physical address: Plot 123, Great East Road, Lusaka, Zambia. You also have the right to lodge a complaint with the Zambia Data Protection Commissioner at info@dataprotection.zm or +260 211 123 789.
Data Protection Officer
Email: dpo@ubuntucare.zm
Zambia Data Protection Commissioner: info@dataprotection.zm