Effective 11 July 2026

Privacy Policy

Kawenge Health Services (“KHS”, “we”, “our”) is committed to protecting the privacy of every patient who uses our telehealth, mobile clinic and related services in Papua New Guinea. This Privacy Policy explains what information we collect, how we use it, how we keep it safe, and the rights you have over it. It is written in line with Papua New Guinea’s Cybercrime Code Act 2016, the general common-law duty of medical confidentiality, and international good-practice principles of medical ethics.

1. Who we are

Kawenge Health Services is a private healthcare provider based in Port Moresby, Papua New Guinea. You can contact us at info@kawengehealth.com.

2. Information we collect

• Identity and contact details you provide when registering (name, date of birth, sex, phone, email, address, province, country).
• Government identification (NID or passport type + number, and any ID document you upload).
• Medical information you share with us: symptoms, medical history, vitals, blood test results, radiology reports, referrals and doctor notes.
• Booking details: consultation type, chosen date/time, communication channel (WhatsApp/Zoom/Teams), province, location (for K90/K70 in-person eligibility only).
• Payment records: card transaction references, uploaded bank-transfer receipts, invoices.
• Technical data: IP address, device type, browser, log-in timestamps.

3. Why we collect it and legal basis

We collect this information to provide the healthcare service you have asked us for, to comply with medical record-keeping obligations, to bill you correctly, to prevent fraud, and to protect the integrity of our systems. Our legal basis is your explicit consent given when you register and each time you make a booking, and, where relevant, our legitimate interests in delivering safe medical care and complying with applicable PNG law.

4. Confidentiality of medical data (patient autonomy)

Your medical information is confidential. You decide who can see it. By default it is accessed only by the attending doctor and clinical staff necessary to deliver your care, and by authorised administrative staff for billing and scheduling. We will never share it with third parties for marketing, and we will not share it with your employer, insurer, family member, or any other party without your specific consent, unless required by a court order or PNG law.

5. How we store and protect data

• All patient data is stored encrypted at rest in a managed cloud database. Backups are encrypted.
• Access to your record is restricted by role-based access control and audit logging.
• Uploaded documents (ID, receipts, medical files) are stored in private storage buckets accessible only to you and your attending clinicians.
• Data in transit is protected by HTTPS/TLS.
• Passwords are hashed. You can enable Google sign-in for stronger authentication.

6. How long we keep your data

We keep medical records for the period required by generally accepted clinical practice (typically at least 7 years from the date of last consultation, longer for paediatric patients). Billing records are kept for 7 years for tax and audit purposes. You may request earlier deletion of non-medical account data at any time.

7. Your rights

• Access — you can request a copy of the data we hold about you.
• Correction — you can update inaccurate bio-data at any time in your patient portal.
• Restriction — you can tell us to stop using your data for anything beyond delivering your care.
• Withdrawal of consent — you can withdraw consent to future processing at any time.
• Deletion — you can request deletion of your account and any non-medical data.
• Complaint — you can raise a concern with us directly at info@kawengehealth.com.

8. Cookies

We use only essential cookies and browser storage necessary to keep you signed in and to remember your booking progress. We do not run advertising cookies.

9. Third parties

To deliver the service we use trusted third-party processors for hosting, database, email delivery (sender domain notify.kawengehealth.com) and, where you agree, video conferencing (WhatsApp/Zoom/Microsoft Teams). Each is bound by the same confidentiality obligations.

10. Data breaches

If we suffer a data breach that materially affects your data, we will notify you and the relevant PNG authorities without undue delay, describe the incident, and tell you what we are doing about it.

11. Changes

If this policy changes materially, we will notify you by email and ask you to accept the new version before continuing to use the service.

This document is maintained by Kawenge Health Services. It is app-owner content and does not constitute an independent certification or legal advice.