Privacy Policy

Kaira Healthcare (“Kaira Healthcare,” “we,” “us,” or “our”) is a home-care management platform operated by Sanka Ventures, a registered business in The Gambia. Kaira Healthcare provides software that home-care agencies (“Agencies”) use to schedule visits, manage carers, record care notes, and share updates with the families and sponsors of the people they care for.

If you have questions about this policy or how your data is handled, contact us at info@kairahealthcare.com.

Kaira Healthcare is multi-tenant software: each Agency that signs up operates its own private workspace, kept isolated from every other Agency (see Section 7, “How we keep data secure”).

For most of the personal data described below — in particular the personal and health data of care recipients — the Agency, not Kaira Healthcare, decides what data is collected and why, and is responsible under applicable law for having a proper basis, such as consent, to collect it and share it with us. Kaira Healthcare acts as the Agency’s data processor / service provider for that data: we process it on the Agency’s instructions, through the Platform, and do not use it for our own independent purposes.

This policy covers data relating to:

• Agencies and their managers/administrators (“Account data”)
• Carers employed or engaged by an Agency (“Carer data”)
• Clients / care recipients receiving care through an Agency (“Client data”)
• Family members and sponsors who receive updates about a client’s care (“Sponsor data”)

Account & agency data. When an Agency signs up, we collect the agency name, business contact details, the names, roles, and login credentials of its managers/administrators, and billing details for the agency’s subscription.

Client / care-recipient data. Agencies use the Platform to record information about the people they care for, which may include name, date of birth, address, contact and emergency-contact details, next-of-kin/sponsor relationships, care plans and support needs, diagnoses and medical conditions relevant to their care, medications and reminders, mobility and risk assessments, and notes written by carers after each visit. This is sensitive health/clinical data, collected and stored because the Agency has entered it into the Platform to manage that person’s care.

Carer data. Name, contact details, role, the visits a carer is assigned or has checked into, and location/check-in data captured at the time of a visit (e.g. GPS or phone-based check-in), where the Agency has enabled this.

Sponsor / family data. Name, relationship to the client, phone number (used for WhatsApp updates), and, where applicable, email address and login credentials if the Agency gives them portal access.

Payment & billing information. Invoicing details for the Agency’s own clients (amounts, currency — typically Gambian dalasi, GMD — and payment status), and the Agency’s own subscription/billing details with Kaira Healthcare.

Usage & device data. Log-in activity, IP address, device/browser type, and general usage data collected automatically to keep the Platform secure and working correctly.

We use the information above to:

• provide and operate the Platform — rostering, visit scheduling, carer check-ins, care notes, invoicing;
• send WhatsApp and email updates to sponsors and families about visits, as configured and triggered by the Agency;
• notify Agencies of missed visits, upcoming invoices, and account activity;
• authenticate users and secure accounts;
• maintain, troubleshoot, and improve the Platform;
• comply with legal obligations and respond to lawful requests; and
• communicate with Agencies about their subscription and support requests.

We do not use client, carer, or sponsor data for advertising, and we do not sell personal data to third parties.

Because care recipients are often unable to set up or manage their own account, and because health/clinical information is especially sensitive, the Agency entering data into the Platform is responsible for:

• obtaining any consent required by applicable law from the client, or from their next of kin, sponsor, or legal representative where the client lacks capacity to consent themselves, before entering their personal or health data into the Platform;
• obtaining consent from sponsors and family members before adding them to receive WhatsApp or email updates about a client; and
• only recording information that is necessary for the client’s care.

Kaira Healthcare provides the tools; it is the Agency’s responsibility, as the party with the direct relationship to the client and their family, to ensure that collection and sharing of this data is properly authorised.

We practise strict data isolation between Agencies: an Agency’s data — including its clients, carers, and sponsors — is never visible to any other Agency on the Platform. This is enforced at the database level through row-level security, not just in the application interface.

Within an Agency’s own workspace, data is shared only with:

• the Agency’s own managers/administrators;
• the specific carers assigned to a client’s visits, who see only what they need to deliver that visit; and
• the sponsors/family members the Agency has authorised to receive updates for a specific client.

We also share data with a small number of sub-processors who help us run the Platform, under contractual confidentiality and data-protection obligations:

• Supabase — database hosting, authentication, and file storage;
• Vercel — application hosting; and
• Resend — transactional email delivery.

We do not sell personal data, and we do not share it with any other third party for their own marketing purposes.

• Per-tenant isolation: every Agency’s data is logically separated using row-level security, so one Agency’s clients, carers, and records cannot be accessed by another Agency.
• Encryption: data is encrypted in transit (HTTPS/TLS) between your device and the Platform, and at rest by our hosting providers.
• Access controls: staff and carer accounts only see data relevant to their role and assigned visits; administrative access to production systems is restricted.

No method of transmission or storage is 100% secure, and we cannot guarantee absolute security, but we work to apply reasonable and appropriate technical and organisational measures.

We retain personal data for as long as an Agency’s account is active, and for a reasonable period afterwards to meet legal, accounting, or dispute-resolution needs (for example, invoicing records). An Agency may request deletion of its data on closing its account, subject to any records we are legally required to keep. Care notes and visit records may need to be retained for a period after a client stops receiving care, consistent with the Agency’s own record-keeping obligations as a care provider.

Depending on where you are located and the law that applies, you may have rights to:

• access a copy of the personal data held about you;
• request correction of inaccurate data;
• request deletion of your data, subject to any legal retention requirements;
• object to or restrict certain processing; and
• request a copy of your data in a portable format.

This includes sponsors and family members based in the UK or EU, who may exercise rights broadly equivalent to those under the UK/EU GDPR. Because most client, carer, and sponsor data is entered and controlled by the relevant Agency, requests relating to that data should generally be directed to the Agency first; we will assist the Agency in responding, and you may also contact us directly at info@kairahealthcare.com and we will route your request appropriately.

Kaira Healthcare is built for Gambian home-care agencies, but sponsors and family members often live abroad — commonly in the UK, EU, or elsewhere in the diaspora — and access visit updates, and, where enabled, the Platform, from those locations. Our infrastructure providers (e.g. Supabase, Vercel) may process or store data on servers located outside The Gambia. By using the Platform or receiving updates from an Agency, you understand that your data may be accessed from, and processed in, countries other than your own, and we take steps to require our providers to protect data to a standard consistent with this policy.

Many of the people whose data is recorded on the Platform are elderly, unwell, or otherwise vulnerable, and may not be in a position to manage their own privacy choices. Agencies should ensure that consent, decisions about data sharing, and requests to exercise the rights in Section 9 are obtained from or exercised by the client, or, where the client lacks capacity, from an appropriate next of kin, sponsor, or legal representative acting in the client’s best interests.

The Platform is designed for adult home-care clients but may in some cases record data about a minor receiving care (for example, a young person with a disability or long-term condition). Where this applies, the Agency is responsible for obtaining consent from a parent or legal guardian before entering the minor’s data.

We may update this Privacy Policy from time to time, for example to reflect changes in the Platform or in applicable law. We will update the “Effective date” above when we do, and, where changes are material, we will make reasonable efforts to notify Agencies.

If you have questions, requests, or concerns about this policy or how your data is handled, contact us at info@kairahealthcare.com.