Effective Date: 01/01/2025

Company: Nanto Ventures Limited (“we”, “us”, “our”)

Website / Domain: https://med.nanto.com, nantomed.com (and related domains)

1. Introduction

We respect your privacy and are committed to protecting your personal data. This policy explains how we collect, use, store, share and protect personal data when you log in via your Google account (or otherwise register) on our platform, and your rights under applicable data-protection laws in Kenya and globally.

2. Scope & Future Use

This policy applies to:

• Visitors to our website and users of our platform who authenticate via Google (“Sign-in with Google”).

• Any personal data we collect in connection with your account on our platform.

• Our processing of data whether you are based within Kenya or elsewhere.

We collect and process your personal data to provide you with our current services via this platform (including login via Google, account management, support, analytics, and service improvement). We may also use your data, with your consent where required, for future divisions of our business (for example new healthcare-products, healthcare services, related mobile apps, or other service offerings under our brand) or evolving features within existing services.

Any new division or service that uses your personal data for purposes beyond those you originally consented to will be clearly communicated to you, and where legally required you will be asked to provide consent or given the ability to opt-out.

We will only use your data internally or share it externally as described in this policy; we do not sell your data to third-party advertisers or data-brokers.

3. Data We Collect

When you use “Sign in with Google” or register with us, we may collect:

• Your name, email address, profile picture, Google account identifier (OAuth ID), and any other basic profile information you permit.

• Your IP address, device information, browser type, operating system, log-in timestamp, and other usage metadata.

• Any other information you provide directly (for example in your profile, preferences, contact forms etc.).

• Note: We do not collect or access your email contents, Google account passwords or other highly sensitive Google data unless explicitly stated (and only if you grant additional permissions).

4. How We Use Your Data

We process your personal data for the following purposes:

• To authenticate you on our platform via Google login, and to link your Google identity to your account with us.

• To provide, operate, maintain and improve our services, including user-account management, support, and customisation.

• To communicate with you (for example account-related notifications, service updates).

• To understand usage of our platform: analytics, monitoring, improving user experience.

• For internal long-term business purposes: e.g., maintaining user records for service continuity, auditing, security investigations, future product development or service expansion (including future divisions).

• Important: We will not sell your personal data to third parties, nor use it for targeted advertising or data-broker purposes.

5. Legal Basis & Consent

Under the Data Protection Act, 2019 of Kenya Section 25 and other applicable law, we must ensure processing is lawful, fair and transparent; purpose-limited; data-minimised; accurate; stored no longer than necessary; and processed with integrity and confidentiality. 

We rely on:

• Your consent, explicitly given when you choose to log in with Google and agree to this policy.

• Legitimate interests (e.g., secure operation of the platform, fraud prevention) where lawful.

• Contractual necessity (e.g., fulfilling services you have requested).

6. Sharing, Disclosure & Transfers

• We do not share your personal data with third-party advertisers or brokers.

• We may share your data with service-providers (e.g., hosting, analytics) who act as processors under contract and are required to protect your data.

• If we transfer data outside Kenya (for example to cloud servers in another country), we will ensure appropriate safeguards as required under the Data Protection Act (e.g., adequate data-protection level, or your consent). 

7. Data Retention

We will retain your personal data only for as long as necessary to fulfil the purposes set out in this policy (including internal business use), or as required by law or audit requirements. When data is no longer required, we will securely delete or anonymise it.

We regularly review retention periods and may delete or anonymise older data.

8. Security

We implement appropriate technical and organisational measures to protect your personal data from unauthorised access, alteration, disclosure or destruction. This includes encryption, access controls, audit-logging, secure infrastructure and incident-response procedures.

9. Your Rights

As a data subject you have rights under the Kenyan DPA, including:

• Right to be informed about your personal data. 

• Right to access your personal data.

• Right to correction or rectification of inaccurate or incomplete data.

• Right to erasure (right to be forgotten) where applicable.

• Right to object to processing, request restriction of processing.

• Right to data portability (if applicable).

• Right to withdraw consent at any time for processing based on consent.

• Right to lodge a complaint with the Office of the Data Protection Commissioner or equivalent authority in your jurisdiction.

10. Children’s Data

Our services are intended for adult users. If we learn that we have collected personal data from a child under [insert age as appropriate] without parental consent, we will take steps to delete the data.

11. Changes to This Policy

We may update this privacy policy from time to time. When we do, we will revise the “Effective Date” above and notify you of substantive changes (e.g., by email or platform notification). We encourage you to review this policy periodically.

12. Contact Us

If you have questions about this policy or our privacy practices, you may contact us at:

Email: med@nanto.com

Address: PO Box 616-00606 Nairobi, Kenya