Legal

Privacy Policy

Last updated: January 2025 ยท Applies to all Play4Health services

1. Introduction

Play4Health ("we," "our," or "us") is committed to protecting the privacy of patients, caregivers, healthcare professionals, and organisational users who interact with our platform. This Privacy Policy explains how we collect, use, store, and share personal and operational data across our services.

Play4Health is operated by Play for Earth, headquartered in Nairobi, Kenya. Where patient or caregiver data is processed as part of a pharmaceutical company's patient support programme, the deploying organisation acts as data controller and Play4Health acts as data processor.

2. Data We Collect

We collect the following categories of data depending on how you interact with the platform:

  • Account data: Name, email address, organisation, and role, provided at registration by programme administrators
  • Patient and caregiver data: Anonymised or pseudonymised identifiers, timestamped photographs submitted as dose confirmations or device returns, engagement streaks, and caregiver linkage records
  • Device return data: Photographs, timestamps, and location metadata associated with medical device returns at pharmacy or collection points
  • Usage data: Platform activity, challenge completions, login frequency, and session metadata
  • Communication data: Messages sent through contact forms or email correspondence

We do not collect clinical data, diagnoses, prescriptions, or any data that constitutes a medical record. We do not process data that identifies patients by name unless explicitly provided by the deploying organisation as part of programme configuration.

3. How We Use Your Data

  • To provide and operate the Play4Health platform and its verification engine
  • To generate programme dashboards and PSP compliance reports
  • To produce device return and EPR evidence records for ESG, CSRD, and regulatory reporting
  • To improve platform performance and develop new features
  • To communicate service updates, onboarding support, and account information
  • To comply with legal obligations and regulatory requirements

4. Data Sharing

We do not sell personal data. We may share data with:

  • The deploying organisation: Patient and caregiver engagement data is accessible to the authorised programme administrators of the client organisation running the relevant patient support programme
  • Service providers: Cloud infrastructure, analytics, and communication tools operating under data processing agreements with appropriate safeguards
  • Legal authorities: Where required by applicable law, regulation, or court order

Each client programme runs in an isolated multi-tenant environment. Data from one programme is never accessible to, or shared with, another client organisation.

5. Patient Data and Special Category Data

Where the platform processes data that may be considered health-related or special category data under applicable data protection law (including GDPR or equivalent national frameworks), the deploying pharmaceutical or healthcare organisation is responsible for ensuring that an appropriate legal basis exists for such processing, including obtaining any required patient consents, before deploying Play4Health as part of their programme.

Play4Health processes this data solely on the documented instructions of the deploying organisation and does not use it for any independent purpose.

6. Data Retention

Verified action data, including photographs, timestamps, and engagement records, is retained for 24 months by default. Account data is retained for the duration of the active programme and deleted within 90 days of programme closure upon written request. Aggregated, anonymised data may be retained indefinitely for benchmarking and platform improvement purposes.

7. Your Rights

Depending on your jurisdiction, you may have the right to access, correct, delete, or export your personal data. Patients and caregivers whose data is processed as part of a pharmaceutical programme should direct data rights requests to the deploying organisation in the first instance, as they act as data controller for that programme.

For all other requests, contact us at clement@play4health.org. We will respond within 30 days.

8. Security

We implement industry-standard technical and organisational measures to protect data, including encryption in transit and at rest, access controls, and regular security reviews. Each client environment is logically isolated. No system is perfectly secure; we encourage programme administrators to protect account credentials and follow access management best practices.

10. International Data Transfers

Play4Health is operated from Kenya. Data may be processed by cloud infrastructure providers in other jurisdictions. Where data originating from the European Economic Area or other regulated regions is processed, we ensure appropriate transfer mechanisms are in place consistent with applicable data protection law.

11. Changes to This Policy

We may update this Privacy Policy periodically. We will notify you of material changes via email or platform notification. Continued use of the Services after changes constitutes acceptance of the revised Policy.

12. Contact

For privacy-related questions or requests, contact us at clement@play4health.org or visit our contact page.