1. Information We Collect

We may collect the following types of information:

• Personal Information: Names, contact details, medical information, and other identifiers provided by users, patients, or customers.
• Usage Data: Information about how you interact with our system, including login times, features used, and transaction history.
• Device Information: IP addresses, browser types, operating systems, and device identifiers.

MedKit POS Mobile & Desktop Applications

The MedKit POS Android app (package com.medkitpos.app) and the Windows desktop app are business tools provided to authorized staff of an organization. Accounts are created by the organization’s administrator; the apps are not a consumer sign-up service. The organization is the data controller for the business records entered through the apps, and this policy describes how the apps handle data.

What the apps collect and process

• Account credentials: your username/identifier and password. The password is sent to the organization’s CentraMEDKIT server over HTTPS. If you enable biometric sign-in, the identifier and password are stored on the device in the operating system’s secure keystore; otherwise they are not stored.
• Business records you enter: sales/transactions, inventory counts, purchase/receive orders, customers, referrals and referrer photos, and related records. This data belongs to your organization.
• Device & session information: a device identifier, device name/model and platform, and the app version. This is used to manage sessions, licensing/feature controls, and to check whether an app update is required.
• Usage & diagnostics: sign-in times, feature usage, and app-version/error information used to operate and improve the service.

Permissions and why the apps request them

• Internet — to communicate with your organization’s CentraMEDKIT server.
• Camera — only when you choose to photograph a referrer or a receipt.
• Photos / media (read) — only to attach an existing image from your gallery instead of taking a new photo.
• Biometric — only if you turn on biometric sign-in. Biometric data never leaves your device and is handled entirely by the operating system; the apps never receive or store your fingerprint or face data.

Local storage on the device: an authentication token, cached feature controls, and (only if enabled) biometric credentials are kept in the platform’s secure storage. They are removed when you sign out or when the session is revoked by the server.

Updates: on launch the apps contact the organization’s server to read the published version. If an update is required, the app shows a notice and opens the download link configured by your administrator.

No advertising, no selling: the apps contain no advertising and no third-party advertising or analytics SDKs, and we do not sell your data.

Children: MedKit POS is a business tool and is not directed to children.

2. How We Use Your Information

We use the collected information for the following purposes:

• To provide and maintain our medical kit management services
• To process transactions and manage inventory
• To improve our services and develop new features
• To communicate with you about updates, support, or important notices
• To comply with legal obligations and protect our rights

3. Information Sharing and Disclosure

We do not sell, trade, or otherwise transfer your personal information to third parties without your consent, except in the following circumstances:

• With service providers who assist us in operating our system
• When required by law or to protect our rights
• In connection with a business transfer or merger

4. Data Security

We implement appropriate technical and organizational measures to protect your personal information against unauthorized access, alteration, disclosure, or destruction. However, no method of transmission over the internet is 100% secure.

5. Data Retention

We retain your personal information for as long as necessary to provide our services, comply with legal obligations, resolve disputes, and enforce our agreements.

6. Your Rights

Depending on your location, you may have the following rights regarding your personal information:

• Access to your personal information
• Correction of inaccurate information
• Deletion of your personal information
• Restriction or objection to processing
• Data portability

7. Cookies and Tracking Technologies

We may use cookies and similar technologies to enhance your experience with our system. You can control cookie settings through your browser preferences.

8. Third-Party Services

Our system may contain links to third-party websites or services. We are not responsible for the privacy practices of these third parties.

9. Children's Privacy

Our services are not intended for children under 13. We do not knowingly collect personal information from children under 13.

10. Changes to This Privacy Policy

We may update this Privacy Policy from time to time. We will notify you of any changes by posting the new policy on this page and updating the "Last updated" date.

11. Contact Us

If you have any questions about this Privacy Policy, please contact us at:

Email: contact@thiarara.co.ke
Address: Nairobi, Kenya