Privacy Policy

Effective 21 July 2026 · A product of Irida Ltd, Nairobi, Kenya

This policy explains what personal information medo collects when you use our service, how we use it, and the choices you have. medo is operated by Irida Ltd and is compliant with the Kenya Data Protection Act, 2019.

1. What we collect

Account details — name, email, phone number, and the invite code you register with.
Booking details — the tests you order, the address you request collection at, the phlebotomist assigned, and the timing of each visit.
Health data — the lab results your partner lab releases to you through the app.
Payment details — the M-Pesa phone number used to pay and the receipt number returned by Safaricom. We do not store your M-Pesa PIN and never see your bank card numbers.
Product usage — during the private beta we log which pages you visit and which actions you take (e.g. booking completed, result viewed) so we can fix bugs faster. This telemetry never contains the actual content of your results.

2. How we use it

To fulfil the bookings you make (assigning a phlebotomist, releasing results, taking payment).
To keep you signed in and secure your account.
To send transactional notifications (booking confirmations, results ready, phlebotomist assigned).
To answer support requests and act on the feedback you send us through the in-app widget.
To improve the service by studying which parts of the flow work and which don't.

3. Who we share it with

The partner laboratory that processes your samples — they receive the tests ordered and are the source of your results. Phlebotomists are employed by the lab, not by medo.
Safaricom to process M-Pesa payments.
Our infrastructure providers (Supabase, Vercel, Resend, Sentry) who store, host, deliver email, and record errors on our behalf. They are contractually bound to protect your data.
We do not sell your personal or health data to anyone, ever.

4. How long we keep it

Lab results and appointment records are retained for the duration of your account so you can review your history. When you close your account we delete personal identifiers and retain only the anonymised booking records required for accounting and audit.

5. Your rights

Under the Kenya Data Protection Act you have the right to access the personal data we hold about you, correct it, request its deletion, and lodge a complaint with the Office of the Data Protection Commissioner. To exercise these rights, email us at privacy@medo.co.ke.

6. Security

Data is encrypted in transit (HTTPS) and at rest on our infrastructure. Access to your records is enforced by database- level row policies — a partner lab or another user cannot read rows that don't belong to them. Result documents are stored in a private bucket accessed only through time-limited signed URLs.

7. Changes to this policy

We may update this policy as the service evolves. We'll flag material changes in the app and update the effective date above.

Contact

Irida Ltd · Nairobi, Kenya · privacy@medo.co.ke