Data Processing Agreement

This agreement is between Zameda Systems (“Zameda”, “we”), Nairobi, Kenya, and the pharmacy that has a Zameda workspace (“you”). It applies to the cloud service at app.zameda.co.ke, including the online shop. It starts when you create your workspace and runs for as long as we hold your pharmacy’s records.

It does not apply to a pharmacy that runs Zameda on its own server. That pharmacy keeps its records on its own equipment and we do not receive them, so there is nothing for us to process.

Under the Kenya Data Protection Act, 2019, you are the data controller for your patients’ and customers’ information, because you decide what is collected and why. Zameda is your data processor: we handle it on your behalf. The Privacy Policy explains the separate case of the information we hold about your owner and staff accounts and our own business, where we are the controller.

Health information is sensitive and we treat all of it that way. Only the people at your pharmacy whose role allows it can see it.

• We process your records only on your instructions. Using Zameda, and the settings you choose, are your instructions. We do not use your records for advertising, sell them, or use them for any purpose of our own.
• If an instruction would break the law, we will tell you and may decline to follow it.
• You are responsible for having a lawful reason to collect each patient’s and customer’s information and for telling them how it is used. We do not speak to your patients or customers about your records, except to send their requests to you.
• Our staff who can reach production systems are bound to keep information confidential.

You agree that we may use the companies listed in section 5 of the Privacy Policy to run the service. We keep each one bound by written terms that require it to protect the information and keep it confidential, and we give each only what it needs for its job. We remain responsible to you for what they do on our behalf.

• We will tell pharmacy owners by email at least 30 days before we add a company that will handle your records, or replace one.
• If you object on reasonable data protection grounds, write to us within that time. We will try to find a way to keep serving you without the new company. If we cannot, you may cancel before the change starts and we will refund fees paid for time after you leave.

These measures are the ones in section 8 of the Privacy Policy. In summary:

• Connections are encrypted, and backups are encrypted before they leave our server.
• The database itself keeps each pharmacy’s records apart from every other pharmacy’s, in addition to the checks in the application.
• Passwords are stored scrambled. Two-step sign-in is available. What a person can see depends on their role, and the screen locks itself after 15 minutes without use.
• Deactivating a person’s account signs them out within seconds.
• Every change is recorded in an audit log that names the person who made it.
• Error reports have personal details removed before they are sent.

We keep improving these measures. We will not lower them in a way that weakens the protection of your records.

A person can ask to see, correct or delete their information, or to object to how it is used. If they write to us, we send the request to you and do not answer it ourselves. We help you respond, and we will find, export or change a person’s records for you if you ask us in writing. Some records cannot be deleted because the law makes you keep them, such as prescriptions, sales receipts and the controlled-drug register.

• Breaches. If your records are lost, or seen by someone who should not have seen them, we tell you without delay and in any case within 72 hours of finding out. We say what happened, what was affected and what we are doing, and we help you report it to the Office of the Data Protection Commissioner and to the people concerned where the law requires. You make that report as the controller; we give you what you need to make it.
• Questions and evidence. We answer your reasonable written questions about how we handle your records, and give you the information we hold that shows we follow this agreement.
• Audits. If that is not enough, you may audit our compliance. Give us at least 30 days’ written notice, agree the scope with us, do it in working hours and at your own cost, and accept that it cannot expose another pharmacy’s records or our hosting companies’ own premises. Do it no more than once a year, unless we have had a breach affecting you.

• You can export your records at any time from the reports and export screens.
• After you cancel, the account keeps working for 30 days so you can export everything. After that we close it.
• Within 30 days of your written request we delete or anonymise the personal information in your account and tell you when it is done, except what the law requires us to keep.
• Backups are kept for about 30 days and then removed, so deleted records leave them within that time.
• Zameda does not delete records automatically. They stay until you ask us to remove them or the account closes, and the legal retention period has passed.

Our servers are in Helsinki, Finland, with files held by Cloudflare and backups by Backblaze, as section 6 of the Privacy Policy says. Your records are held outside Kenya, and by agreeing to this you accept that. If Kenyan law requires us to hold them elsewhere, we will change where we hold them.

• Each side’s liability under this agreement is as set out in section 13 of the Terms of Service. Nothing here widens it.
• If this agreement and the Terms of Service disagree about how we handle personal information, this agreement applies.
• If we change this agreement in a way that matters, we will email the pharmacy owner at least 30 days before it takes effect, as the Terms of Service describe, and show the new date at the top of this page.
• It is governed by the laws of Kenya, and the courts of Nairobi decide any dispute we cannot settle by talking first.