Privacy Policy for Curis Super Administrator

Effective Date: January 11th, 2025

Last Updated: March 21st, 2025

Owner: Citrus Labs Limited

Welcome to Curis. This Privacy Policy explains how Citrus Labs Limited collects, uses, shares, and protects your data as a Super Administrator user of the Curis platform. We are fully committed to safeguarding your privacy and complying with the Data Protection Act, 2019 (Kenya).

This policy applies to all Super Administrator activities within Curis across all partnered clinics, systems, and operations. It outlines your rights, responsibilities, and our obligations regarding data handling.

We collect:

• Administrator Personal Data: Names, contact details, ID numbers.
• Clinic-Level Metadata: Staff roles, permissions, configurations.
• System-Generated Data: Login times, activity logs, device data, cookies.

Collection methods include form entries, automated tools, cookies, and direct integrations.

Your data is collected strictly to:

• Manage platform-wide permissions and settings.
• Administer clinics, staff, and infrastructure.
• Comply with legal requirements.
• Improve service delivery and support.

Super Administrators consent to data collection during onboarding. You can manage, modify, or withdraw your consent directly through the Consent Management Panel. Withdrawal may affect your system access.

We may share data with:

• Service Providers (e.g., cloud storage, analytics tools).
• Legal Authorities when required by law.
• Other Clinics only if linked via Curis and governed by agreements.

All third parties are contractually obligated to adhere to strict data protection standards.

We apply the highest standards of protection, including:

• End-to-end encryption
• Multi-factor authentication
• Access control
• Regular system audits
• Staff confidentiality training

Data is retained as long as your Super Admin account remains active or for statutory periods where required.

As a Super Administrator, you have the right to:

• Access, correct, or delete your data.
• Object to certain data uses.
• Request data transfer in machine-readable format.
• Withdraw consent at any time.

Exercise your rights via the Privacy Rights Panel or by submitting a formal request.

We use cookies for:

• Authentication
• Usage analytics
• System performance

You can manage preferences through the Cookie Preferences Panel.

If data is transferred outside Kenya, we ensure it is protected under contracts or approved legal mechanisms, such as Standard Contractual Clauses.

You will be notified of all updates via in-app banners and update logs. Version history is accessible for transparency.

Questions? Concerns? Contact our Data Protection Officer.

• Email: legal@citruslabs.co.ke
• Mailing Address: P.O. Box 23983 - 00100
• Phone: +254 112 400 000