PRIVACY · DATA PROTECTION
CareWeave may handle sensitive information while supporting hospital revenue workflows. This policy explains what we process, why we process it and the limits around its use.
The short version. Customer data is used for the agreed workflow. We do not sell customer health data or use it for advertising, and important decisions remain reviewable by authorized people.
When a hospital, clinic or other healthcare organization uses CareWeave, that organization normally determines why patient and workforce data is processed. CareWeave processes that data on the customer's instructions.
CareWeave may separately control limited information needed to operate its own service, including account, security, support and business-contact records.
The information depends on the workflow. It may include patient identifiers, encounter and service details, coverage and authorization information, supporting clinical records, claim information, payer responses, payments and the people working the matter.
We may also process account, device, activity and support information needed to operate and secure CareWeave.
Customer data is used to support the agreed revenue workflow: bring relevant information together, identify missing or inconsistent information, organize evidence, route work and follow the matter toward resolution.
We do not sell customer health data or use it for advertising. CareWeave does not replace the people or systems responsible for clinical decisions or payer adjudication.
Health information is sensitive personal data. Processing should be limited to the information needed for the agreed workflow and accessible only to authorized people and systems.
CareWeave may use AI to investigate a matter, organize evidence, explain an exception or prepare a next action. Source information, user activity and generated reasoning should remain distinguishable, and consequential actions remain reviewable by authorized staff.
We may use service providers to host, secure or operate CareWeave. Where they process personal data for us, they are subject to appropriate confidentiality, security and data-protection terms.
Personal data is transferred outside Kenya only where permitted by applicable law and the required safeguards or other lawful conditions are in place.
We use technical and organizational safeguards appropriate to the information and workflow, including controls intended to restrict unauthorized access and keep important activity traceable.
If CareWeave becomes aware of a personal-data breach while acting as a processor, we notify the affected controller without delay and, where reasonably practicable, within the period required by Kenyan law. We also provide information reasonably needed for investigation and notification.
Customer data is retained according to customer instructions, contractual requirements and applicable law. Different records may require different retention periods.
When processing ends, customer data is handled according to the applicable agreement and legal requirements.
Kenyan data-protection law provides rights relating to personal data, including rights to be informed, access data, object to processing, and request correction or deletion where applicable.
If your information reached CareWeave through a healthcare organization, contact that organization first. It normally controls the underlying record and can verify your identity and request. CareWeave will support the organization where required.
Questions about information CareWeave controls directly can be raised using the contact details provided with the service or applicable customer agreement.
Customer agreements and data-processing terms may contain additional commitments for a specific deployment. Where applicable, those terms govern that customer relationship.
Kenya ODPC