Privacy notice

Effective 1 November 2026.

This notice explains how Xcobean Systems (Kenya) Limited ("Xcobean", "we", "us"), of Nairobi, Kenya, handles personal data in connection with JiraniCore, a software service for clinics, pharmacies and hospitals. We handle personal data in line with the Kenya Data Protection Act, 2019 (the "Act") and its regulations.

There are two different situations, and your rights and our role differ in each:

1. This website and our sales contact: people who visit this site, request a demo or write to us. Here Xcobean is the data controller.
2. Health data inside the JiraniCore service: patient and staff data that a clinic, pharmacy or hospital (the "facility") puts into JiraniCore. Here the facility is the data controller and Xcobean is the data processor, acting only on the facility's documented instructions under a data processing agreement.

1. Website visitors and enquiries (Xcobean as controller)

What we collect

• Details you enter in the demo request form: your name, facility name and type, county or town, phone number, email address, number of branches and any message.
• Details you send us by email or phone, and our notes of those conversations.
• Basic technical data that our servers record when you load a page, such as IP address, browser type and time of request, kept in standard server logs for security and troubleshooting.

We do not ask for patient information on this website. Please do not enter any.

Why we use it and our lawful basis

• To respond to your request, arrange a demo and follow up about JiraniCore. Basis: your consent (given when you tick the box on the form) and steps taken at your request before a contract.
• To prepare quotations and, where you become a customer, to manage the contract, billing and support. Basis: performance of a contract and our legitimate interest in running our business.
• To keep this website and our systems secure and to prevent abuse and spam. Basis: our legitimate interest in security, and legal obligations where they apply.

We do not sell your personal data. We do not use it for automated decisions that significantly affect you.

Where your enquiry goes

A demo request is saved in Xcobean's own systems and recorded in our customer relationship management (CRM) system so that our sales team can reply. It is seen only by Xcobean staff who need it for that purpose and by service providers that help us run those systems (see section 6).

How long we keep it

Enquiries that do not lead to a contract are kept for up to 24 months after the last contact, then deleted or anonymised. If you become a customer, contact and contract records are kept for the life of the contract and for as long afterwards as tax, accounting and other laws require (generally up to seven years). Server logs are kept for a short period, normally no more than 90 days. You may ask us to remove your enquiry sooner (see section 7).

2. Health data inside JiraniCore (facility as controller, Xcobean as processor)

When a facility uses JiraniCore, it decides what patient and staff data to record and why. Xcobean processes that data only to provide, secure, support and improve the operation of the service for that facility, and only on the facility's documented instructions set out in the data processing agreement and the order form.

• Categories may include patient identification and contact details, visit and clinical records, prescriptions and dispensing records, laboratory and billing records, and staff user details. This is largely sensitive personal data (health data) under the Act.
• Facility responsibilities: the facility is responsible for its lawful basis, for informing its patients, for obtaining any consent it needs, for deciding who on its staff may access which records, and for answering patients' requests. If you are a patient and want to see, correct or delete your records, please contact the facility first.
• Our commitments as processor: we process the data only on documented instructions; we require everyone with access to be bound by confidentiality; we apply the security measures in section 5; we help the facility respond to data subject requests and to security incidents; we notify the facility without undue delay after becoming aware of a personal data breach affecting its data; we use sub-processors only under written terms with equivalent protections; and at the end of the contract we return or delete the facility's data as set out in the terms and the agreement.
• No other use: we do not use a facility's patient data for advertising, and we do not sell it. We do not access patient records except as needed to provide support the facility asks for, to keep the service secure, or where the law requires.

If a patient writes to us directly about data held in JiraniCore, we will pass the request to the relevant facility, which decides how to respond, unless the law requires otherwise.

3. Sensitive (health) data

The Act treats health data as sensitive personal data and allows it to be processed only where a lawful basis applies and with stronger protections. In JiraniCore, access is limited by role and recorded; data is protected in transit and at rest as described in section 5; and exports and deletions follow the facility's instructions. Xcobean staff access to facility data is limited to what is necessary and is controlled and logged.

4. Cookies and similar technologies

This website does not set advertising or analytics cookies, and it does not load third-party trackers. It uses no cookies other than, at most, those strictly necessary to deliver the pages you request. If we later add any other cookies or measurement tools, we will update this notice first and ask for your consent where the law requires it. Signed-in areas of the JiraniCore service use strictly necessary cookies or tokens to keep you logged in and secure.

5. Security

We use measures appropriate to the risk, including encryption of data in transit, encryption of stored data, role-based access controls, authentication safeguards, logging and monitoring, separation of customer data, regular backups, and vulnerability and patch management. Staff with access are bound by confidentiality. No system is completely secure, so we also maintain a process for detecting, assessing and reporting incidents, including notifying the Office of the Data Protection Commissioner and affected parties within the periods the Act requires.

6. Sub-processors and service providers

We use carefully selected providers for things such as hosting and infrastructure, email and messaging, customer relationship management and support tooling. Each is bound by written terms that require them to protect personal data and to use it only for our instructions. Facilities that are our customers are told about changes to sub-processors that handle their data. A current list of sub-processors is available on request from privacy@xcobean.com.

7. Transfers outside Kenya

We transfer personal data outside Kenya only where sections 48 to 50 of the Act allow: where appropriate safeguards are in place (for example, a contract requiring equivalent protection, or recipients in a country with adequate data protection laws), and, for sensitive data, only where the Act's additional conditions are met, such as the data subject's consent or another basis the Act recognises. Facilities may give instructions about where their data is processed in their agreement with us.

8. Your rights

Under the Act, you have the right to:

• be informed about how your personal data is used;
• access your personal data;
• object to the processing of all or part of it, including for direct marketing;
• have inaccurate or misleading data corrected (rectification);
• have data that is no longer needed, or was obtained unlawfully, erased or deleted;
• ask us to restrict processing in the circumstances the Act allows;
• receive your data in a structured, commonly used, machine-readable format and have it transmitted to another controller where this applies (portability); and
• withdraw consent at any time. Withdrawing does not affect processing done before you withdrew.

To use these rights in relation to data we hold as controller, write to privacy@xcobean.com. We may need to confirm your identity first. We aim to respond within the time limits set by the Act, and no later than 30 days. For data held in JiraniCore on behalf of a facility, please contact that facility, or us and we will refer you to it.

If you are not satisfied with how we have handled your data, you may complain to the Office of the Data Protection Commissioner of Kenya (www.odpc.go.ke). We would appreciate the chance to resolve your concern first.

9. Children

This website is for people who run or work in health facilities and is not directed at children. We do not knowingly collect personal data from children through the website. If you believe a child has sent us personal data, please tell us and we will delete it. Facilities that record children's data in JiraniCore, as health facilities commonly do, are responsible for obtaining any parental or guardian consent the Act requires, and we process that data only on their instructions.

10. Changes to this notice

We may update this notice from time to time. The effective date at the top shows the latest version. If a change is significant, we will take reasonable steps to tell customers and, where the law requires, to ask for consent again.

11. Contact

Xcobean Systems (Kenya) Limited, Nairobi, Kenya.
Privacy questions and requests: privacy@xcobean.com
Sales and general: sales@xcobean.com