Privacy Policy

Last Updated: August 27, 2026

Pre-Launch Notice: Docplan is currently in beta. We are launching in Kenya first, with expansion to Tanzania, Oman, UAE, and USA planned for 2026. Select your country above to view the relevant privacy policy.

You can download a copy of your account data anytime from Account Settings → General → Download your data. You can also exercise other data rights by contacting our Privacy Officer at legal@docplan.app. We are committed to responding within the legally required timeframes.

Docplan ("we," "us," or "our") is committed to protecting your privacy and the confidentiality of your health information. This Privacy Policy explains how we collect, use, disclose, and safeguard your information when you use our healthcare appointment scheduling platform.

This policy is written to meet the Kenya Data Protection Act, 2019. We are registering with the Office of the Data Protection Commissioner as a data controller (for your Docplan account) and as a data processor (for clinic charts we store for healthcare organizations).

Kenya Data Protection Notice

This notice describes how your personal and health information may be used and disclosed in accordance with the Kenya Data Protection Act, 2019.

Healthcare providers using Docplan are required by law to protect your personal data. Docplan processes your information in accordance with the Kenya Data Protection Act, 2019. We are preparing registration with the Office of the Data Protection Commissioner of Kenya as a data controller for Docplan accounts and as a data processor for clinic charts we host for healthcare organizations. This notice will be updated with our registration numbers once those certificates are issued.

1. Information We Collect

Personal and Health Information

When you use Docplan, we may collect and process the following types of information:

  • Personal identifiers (name, email address, phone number, date of birth, sex)
  • Appointment details (date, time, healthcare provider, organization, services)
  • Clinic patient records created by a healthcare organization that treats you (including a medical record number, demographics, and visit check-in history)
  • Visit encounter details (status, source, reason for visit, queue events). Staff-only notes stay with the clinic and are not included in your self-service data export
  • Communication preferences
  • Invoices written by a clinic that treats you (line names, amounts, and payments the clinic records). Online card collection through Docplan is not live.

Technical Information

We automatically collect certain technical information:

  • Device information (browser type, operating system)
  • IP address and general location
  • Usage data (pages viewed, features used)
  • Cookies and similar technologies (see Cookies)

Consent Records and Audit Trail

To comply with healthcare regulations and maintain legal proof of your consent, we automatically record the following when you create an account or accept our Terms of Service or Privacy Policy:

  • Date and time of acceptance
  • IP address at the time of signup or acceptance
  • Version of the policy you accepted (identified by date)
  • Consent type (Terms of Service, Privacy Policy, or other consents)

Purpose: These records serve as legal documentation that you have reviewed and agreed to our policies, and they help us comply with healthcare regulations including HIPAA (USA), Kenya Data Protection Act, and other applicable laws.

Retention: Consent records stay on your account while it is open. When you delete your account, those consent rows are removed with it. We keep a deletion audit log (that the account was closed, and limited identifiers needed to show that) so we can respond to regulators if asked.

Your Rights: You can request to view your consent history while your account is open by contacting legal@docplan.app.

2. How We Use Your Information

Healthcare Services

We use your information for:

  • Appointment Management: Facilitating your appointments with healthcare providers
  • In-clinic operations: Check-in, waiting queues, and visit history for organizations that treat you
  • Clinic invoices: A healthcare organization may write a bill for your visit, record what you paid (cash, M-Pesa, card at the till, and similar), and show you that receipt in your account or on paper. Online payment through Docplan is not live.
  • Platform Improvement: Improving our platform, quality assurance, and customer support

For Kenya, we rely on: the contract to provide your account and booking tools; a healthcare organization’s instructions (and their lawful basis) when we store clinic charts and visit records for them; and your consent where we ask for it (for example SMS notifications and optional cookies). Sex and health-related visit details are sensitive personal data under the Act.

Communications

  • Sending appointment confirmations and reminders
  • Notifying you of reschedules or cancellations
  • Requesting feedback about your healthcare experience
  • Providing customer support

Email Security Notice: Email communications may not be fully encrypted in transit or storage. We minimize the amount of health information included in emails. For maximum security, we recommend accessing your appointment information through your secure Docplan account.

3. How We Share Your Information

With Your Healthcare Providers

We share your information with the healthcare organizations and providers you book appointments with to facilitate your care.

Service Providers

We may share information with trusted third-party service providers who assist us in operating our platform, including:

  • Fly.io (application hosting and managed Postgres; primary region Johannesburg, South Africa)
  • Tigris (object storage for files such as profile photos)
  • Resend (transactional email)
  • Africa's Talking and Twilio (SMS, depending on destination country)
  • Sentry (error monitoring; configured not to send default personal data)
  • Google (optional sign-in)
  • Payment processors (for billing) - Coming soon in Q1 2026

All service providers are required to maintain data protection compliance and protect your information.

Legal Requirements

We may disclose your information when required by law, such as:

  • In response to court orders or legal processes
  • To comply with regulatory requirements
  • To protect public health and safety
  • To prevent or investigate potential fraud or violations of law

We Will NOT Share Your Information

We will never sell, rent, or share your health information for marketing purposes without your explicit written authorization.

Cookies

Cookies are small text files stored on your device. We use them so Docplan can function securely and, if you allow, to understand how the product is used.

Categories

  • Essential — required for sign-in, security (including CSRF protection), and core site preferences. These are always on because the service cannot work without them.
  • Analytics — optional. Help us measure reliability and improve features. We only enable non-essential analytics cookies after you choose Accept all (or an equivalent analytics opt-in).
  • Marketing — optional. Reserved for future advertising or remarketing tools. We do not currently set marketing cookies; if we introduce them later, they will respect your stored choice.

Your choices

When you first visit, a banner lets you choose Accept all or Essential only. Your choice is stored in your browser (local storage) so we can remember it on later visits.

You can change your mind anytime: . You can also clear site data in your browser settings to reset the prompt.

4. Your Privacy Rights

You have the following rights regarding your personal and health information:

Right to Access

You have the right to view and obtain a copy of your personal information maintained by Docplan.

Right to Correction

You may request corrections to your personal information if you believe it is incorrect or incomplete. For Kenya, we aim to respond to access, correction, restriction, and related requests within 21 days (or tell you if we need more time, as the Act allows).

Right to Erasure

You may request deletion of your Docplan account and the personal data we control, subject to legal retention (for example consent and security logs). Deleting your account does not by itself delete clinic charts held for organizations that treated you. Requests that concern a clinic’s medical record should be directed to that organization, or to us at legal@docplan.app and we will help route them.

Right to Restrict Processing

You may request limitations on how we use or disclose your personal information.

Right to Data Portability

You may download a copy of your account data in a structured, commonly used format (ZIP with JSON) from Account Settings → General → Download your data, or contact legal@docplan.app.

Right to Object

You may object to certain types of data processing, including direct marketing.

Right to Opt Out of Email Notifications

You can disable email notifications at any time in your account settings (Preferences) while still maintaining access to your appointment information through your secure account. Security-related emails (such as password resets and email confirmations) and one-time invitations always send. You can separately control appointment updates, reminders, and review request emails.

To exercise any of these rights, please contact our Privacy Officer at legal@docplan.app or through your account settings.

5. How We Protect Your Information

We implement industry-standard security measures to protect your personal and health information, including:

  • Encryption: Data is encrypted in transit (SSL/TLS) and at rest
  • Access Controls: Strict authentication and authorization protocols
  • Monitoring: Continuous security monitoring and logging
  • Regular Audits: Periodic security assessments and compliance reviews
  • Employee Training: Staff are trained on data protection and security best practices
  • Vendor Agreements: All vendors handling personal data sign data protection agreements

While we take extensive measures to protect your information, no system is completely secure. We encourage you to use strong passwords and protect your account credentials.

6. Data Retention

Your Docplan account and clinic records are not the same thing

Docplan is the data controller for your login, profile, preferences, and platform activity. Healthcare organizations that treat you on Docplan are the data controllers of clinic charts created at their practice (including medical record numbers, visit history, and staff notes). We process those clinic records on the organization’s behalf so they can deliver and document care.

When you delete your account

Deleting your Docplan account removes your login, profile, contact details, and access to the platform. We also remove email and phone numbers copied onto clinic charts so organizations cannot reach you through Docplan.

Clinic charts (such as your name, date of birth, and patient ID) and visit history at organizations that treated you may be retained by those organizations for care and legal purposes. That is not a Docplan marketing profile; it is the clinic’s medical record. You can download a copy of data we hold about you from Account Settings → General → Download your data before you delete your account.

When an organization is deleted

If a healthcare organization schedules deletion of its Docplan workspace, it has 7 days to cancel. After that period, we permanently delete that organization’s clinic charts, visits, and related clinical data from Docplan. Organizations should export any records they are legally required to keep before deletion completes. We may retain limited consent, security, and deletion logs as required by law.

7. International Data Transfers

Docplan is a Kenya-first product. The live application and primary database run on Fly.io in Johannesburg, South Africa. Database replicas and file storage may also process data in other regions used by our providers (including the United Kingdom and the United States). Email, SMS, error monitoring, and optional Google sign-in are provided by the vendors listed above, some of which are outside Kenya.

These transfers are necessary to operate the service. We rely on contractual safeguards with those providers as required by the Kenya Data Protection Act, 2019.

8. Children's Privacy

Under the Kenya Data Protection Act, a child is anyone under 18. You must be 18 to create your own Docplan account. A parent or guardian may create and manage an account on behalf of a child. Healthcare organizations may also create a clinic patient chart for a child when a parent or guardian is present for care; that organization is the data controller of that chart.

9. Changes to This Privacy Policy

We may update this Privacy Policy from time to time to reflect changes in our practices, technology, legal requirements, or other factors. We will notify you of material changes by:

  • Posting the updated policy on our website with a new "Last Updated" date
  • Sending you an email notification if you have an account with us
  • Displaying a prominent notice on our platform

We encourage you to review this Privacy Policy periodically. For material changes we will notify account holders by email or an in-product notice. Contact us if you do not agree with an updated policy.

10. Data Breach Notification

If a personal-data breach occurs, we will notify the Office of the Data Protection Commissioner of Kenya within 72 hours of becoming aware of it where feasible, and we will notify affected people without undue delay when the breach is likely to result in a high risk to their rights. Contact legal@docplan.app.

11. Governing Law

This Privacy Policy shall be governed by and construed in accordance with the laws of the Republic of Kenya. Any disputes arising from this policy shall be subject to the exclusive jurisdiction of the Kenyan courts.

12. Contact Us

If you have questions about this Privacy Policy, want to exercise your privacy rights, or have concerns about how your information is handled, please contact us:

Privacy Officer - Kenya

Email: legal@docplan.app

Support: support@docplan.app

Website: https://docplan.app

You also have the right to file a complaint with the Office of the Data Protection Commissioner of Kenya if you believe your privacy rights have been violated.

13. Acknowledgment

By using Docplan, you acknowledge that you have read and understood this Privacy Policy and agree to its terms. If you do not agree with this policy, please do not use our services.