Privacy Policy

Makhety Digital Solutions ("we", "us", "our") operates the Hosi360 platform at hosi360.co.ke and hosi360.makhety.com. This policy explains what data we collect, how we use it, and your rights regarding it.

1. Who this policy covers

This policy applies to:

• Clinic administrators and staff who use Hosi360 to manage their facility.
• Patients whose records are entered into Hosi360 by a clinic, or who access the patient portal directly.
• Visitors to the Hosi360 marketing website.

2. Data we collect

From clinic accounts

• Business name, email address, phone number, and location
• Names and email addresses of staff users
• Subscription and billing records (amounts, M-Pesa references)
• System usage logs (page visits, actions taken, timestamps)

From patient records (entered by clinics)

• Name, date of birth, gender, contact details, and ID number
• Clinical notes, diagnoses, prescriptions, and lab results
• Appointment and billing history
• Insurance details

Patient health data is entered by the clinic and remains under the clinic's data controllership. Hosi360 processes it as a data processor on behalf of the clinic.

From website visitors

• Contact form submissions (name, email, message)
• Server access logs (IP address, browser type, pages visited)

3. How we use your data

• To provide and operate the Hosi360 platform
• To process subscription payments and issue receipts
• To send account notifications and system updates
• To respond to support requests
• To improve the platform based on usage patterns

We do not sell your data. We do not use patient health data for advertising or any purpose outside operating the platform.

4. Data sharing

We share data only with:

• Safaricom / M-Pesa: For processing payments via the Daraja API
• Our hosting provider: Cloud/VPS infrastructure used to run Hosi360
• Email delivery services: Used to send system notifications

All third parties are bound by confidentiality obligations and are not permitted to use your data for their own purposes.

5. Data storage and security

• All data is stored on servers located in or accessible from Kenya
• Data in transit is encrypted using HTTPS/TLS
• Access to production data is restricted to authorised Makhety personnel
• Daily automated backups are retained for 30 days
• Passwords are hashed using bcrypt and are never stored in plaintext

6. Data retention

We retain clinic account data for the duration of the subscription plus 12 months. Patient data entered by a clinic is retained as long as the clinic's account is active. On account termination, clinics may request a full data export before deletion.

7. Your rights

You have the right to:

• Access the data we hold about you
• Request correction of inaccurate data
• Request deletion of your data (subject to legal retention requirements)
• Export your data in a portable format

To exercise any of these rights, email us at privacy@hosi360.co.ke.

8. Cookies

Hosi360 uses only essential session cookies required for login and form security (CSRF protection). We do not use tracking cookies or third-party advertising cookies. See our Cookie Policy for details.

9. Children's data

Hosi360 may process health records of minor patients entered by clinics in the course of medical care. This data is handled with the same protections as adult patient data and is never used for any purpose outside clinical record-keeping.

10. Changes to this policy

We will notify active clinic accounts by email of any material changes to this policy at least 14 days before they take effect.

11. Contact

For privacy enquiries: privacy@hosi360.co.ke
Makhety Digital Solutions, Malindi, Kilifi County, Kenya.