Privacy

This page sets out what is collected about a person and who can read it. Both are enforced inside the database rather than promised: the rule written in the schema is the rule that decides, and it can be inspected.

It is not a legal notice. The mapping against the Personal Data Protection Act 2022 has not been done, and a legal notice written before that mapping would be inventing the compliance it is meant to describe.

What is collected

From the running schema

Identity: Name, date of birth, sex, region, countryAs entered by the person opening the account. None of it arrives from anywhere else.
Identity documents: NIDA, passport, licence, national IDA claim until somebody checks it. The number is shown back masked to its last four characters.
Contact: Phone, email, an emergency contactThe number is stored in international form with its country code, so a Kenyan number cannot match a Tanzanian one.
Health: What you record, and every encounterChronic conditions, allergies, medicines, blood group, and every encounter, laboratory result and prescription.
Profile picture: Only if you want oneYours alone. No other THOS user can read it.
Your location: Only if you allow it, and never storedUsed to order facilities by distance when you ask for that. It does not leave your device and is written nowhere.

Who can read it

Enforced by the database

You: EverythingIncluding the log of every clinician who opened your record, and when.
A clinician: Only with your consentConsent is time-bounded and you can withdraw it. Every read is written down under their name.
In an emergency: If you allowed it in advanceA clinician treating an emergency can read key history when you cannot be asked. Every such read is logged under their name.
The system operator: No patient recordThe operator console is read-only and carries no patient record at all. Database staff have access, which is true of any managed system.

What has not been done

No mapping against the 2022 Act. No registration with the Personal Data Protection Commission. No data protection officer appointed. No way to ask for your data to be deleted or to take a copy of it. No independent privacy audit.

Where the data physically rests is set out in Where data rests. Questions: info@laetoli.tz.