Privacy notice
How KankMed handles your information, under the Nigeria Data Protection Act 2023.
Last updated: 17 October 2026.
This notice describes what KankMed collects, why, where it is kept and what you can ask us to do with it. It covers patients, doctors and staff using KankMed Connect.
What we collect, and why
| Information | Why we hold it |
|---|---|
| Your phone number and name | To sign you in and to identify you to the clinician you are matched with. |
| Your state and the landmark you type | To match you with a clinician who can reach you. |
| What you describe about your symptoms | To pass to the clinician before the consultation. |
| Your home-visit location | To let the assigned clinician find the visit and to support safety and meeting review. Live movement is used only while the visit is active. When the clinician starts and the patient confirms the visit, one appointment-scoped arrival snapshot may be saved with the consultation. |
| Consultation records and prescriptions | Your clinical record, and because a prescription has to be checked by whoever dispenses it. |
| Payments and payouts | To take payment for a consultation and pay the clinician. |
| A clinician's licence and credential documents | To verify that a clinician is who they say they are before they can see patients. |
| Staff and clinician sign-in factors, session records and private access events | To verify identity, revoke access and investigate misuse. Passphrases are hashed, authenticator secrets are encrypted, and audit records avoid raw clinical content. |
| A doctor's NIN, legal name, date of birth and verification consent | To compare the doctor application with an authorised NIMC identity record. NIN identity checks are separate from professional licence approval. |
| A clinician's bank details | To pay them. Nothing else. |
How it is protected
- Credential documents and bank details are encrypted with AES-256-GCM before they are written down. The key is held as a platform secret, separate from the database.
- A temporary credential-document copy is sent over HTTPS to a private KankMed quarantine in AWS London. AWS encrypts it with a dedicated KankMed-managed key. AWS GuardDuty processes it solely for malware scanning; the KankMed application cannot retrieve it before a clean result. It is deleted after a final result, with a one-day deletion rule as the failure backstop.
- Bank account numbers are masked everywhere by default. Seeing a full number is a deliberate, separate action that requires a recent re-authentication and is written to the audit log every time.
- Precise home-visit location is excluded from staff screens and ordinary Owner Desk lists. An owner reveal is limited to one assigned visit, requires recent multi-factor authentication, clears from the page after five minutes and is written to the audit log without recording the coordinates there.
- Visit maps do not contact Google automatically. If you choose Open map with Google, the exact coordinates on that visit and your internet address are sent to Google so it can draw the map.
- In-app audio calls are relay-only and pass through KankMed's private call relay hosted by AWS in London. AWS processes the encrypted relay traffic only to carry the call. Patient and clinician devices are not connected directly and do not receive each other's internet address. Short-lived credentials are used for the call relay, and audio remains protected by WebRTC encryption in transit.
- Sign-in codes expire after five minutes. We store a verifier instead of the clear-text code and remove it when the code is consumed or invalidated.
- Staff and clinician access requires phone verification, an owner-approved passphrase and an authenticator. Private sessions expire after inactivity and account suspension revokes access.
- Registered clinician phone numbers stay masked in staff and owner lists. The owner or individually authorized staff reveal a number for operational contact through an audited action. Doctor contact permission is separate from finance permission, and withdrawing it revokes old staff sessions.
- Covered private reads and staff actions are written to an append-only audit log. IP addresses in that log are stored as one-way hashes, not as addresses.
- The site is served over HTTPS only.
Document and prescription encryption is server-side encryption at rest. Authorized platform services decrypt records to provide care. This is not end-to-end encryption against the platform. Local audit protections prevent ordinary application edits and deletes. A separately administered immutable audit archive is not yet active.
Where it is kept
KankMed's database and encrypted document vault are stored on an encrypted volume in London, United Kingdom. In-app call traffic is relayed through KankMed's private AWS call relay in London. Temporary credential-document security-scan copies are also processed in a private AWS quarantine in London and deleted as described above. If you are in Nigeria, your information is therefore transferred outside Nigeria to be stored. We do this because it is where our infrastructure runs; the protections described above apply wherever it is held.
Who can see it
- The clinician you are matched with sees what you tell them and your consultation record.
- The KankMed owner can reveal one assigned home visit's precise safety and arrival evidence after fresh multi-factor authentication. Every reveal is audited.
- KankMed operations staff see only what their role needs. They do not receive precise patient or clinician location. Access to the payment ledger and to clinician phone reveals is granted individually by the owner through separate permissions and is withdrawn when someone is suspended or access is revoked.
- Our service providers — the SMS and WhatsApp networks that carry your sign-in code and prescription messages; AWS in London, which hosts KankMed's private call relay and the temporary private malware-scanning quarantine described above; Fly.io, our application host; Paystack, which processes checkout, payment verification and refund evidence; and Google Maps only when you deliberately open a visit map.
- New owner and clinical passphrase checks use Have I Been Pwned's Pwned Passwords service. Only the first five characters of a locally calculated password lookup hash are sent, with padded replies. Your passphrase, full hash, name, phone number and account identifier are not sent to that service. Existing sign-in checks remain local. A failed or unavailable check stops new credential enrollment.
- We do not sell your information, and we do not use it for advertising.
Doctor NIN verification
When you submit your NIN with consent, KankMed encrypts it with AES-256-GCM before storage. Routine doctor and owner screens show only the final four digits. Operations staff and patients receive no NIN data. An owner reveal requires fresh multi-factor authentication, is audited without the number, and clears from the screen after one minute.
When enabled for KankMed's authorised account, The selected authorised provider (Dojah or Prembly) receives your NIN over HTTPS and retrieves the identity record from NIMC. KankMed compares the returned name and date of birth with your application. We retain the matching result and check reference, not the provider's photograph, address or full response. If automated lookup is unavailable, the owner uses an authorised NIMC verification service and records its source, reference and matching details.
The encrypted NIN record and consent are held while needed for clinician onboarding, identity review and fraud prevention. To request correction, deletion or withdrawal of consent, contact privacy@kankmed.com. A new verification requires fresh consent. A NIN result does not confirm professional registration or approve a doctor to practise.
How long we keep it
Clinical records and prescriptions are kept for as long as medical record-keeping requires. Sign-in codes stop authorizing access after five minutes. Used verifiers are removed when consumed. Continuous live movement is not retained as a route history; the home-visit pin and the two arrival snapshots are retained with that consultation for safety and dispute review. Audit records are kept as evidence and are not editable or deletable through the application.
Your rights
Under the Nigeria Data Protection Act 2023 you can ask us to show you what we hold about you, correct it, delete it, or stop using it in a particular way. You can also complain to the Nigeria Data Protection Commission.
You can delete your account yourself in the app or on the website: sign in, tap Account, then Delete my account, and type DELETE to confirm. Your name, phone number, email, profile details, sign-in credentials and phone-call devices are removed, and doctors' listings, licence and NIN details, documents and bank details are removed. Consultation, prescription and payment records are kept, without your name or phone number, as described below. Deletion is blocked while a paid consultation, refund or unpaid doctor payout is still open.
Some requests have limits we will explain rather than ignore: we cannot delete a clinical record we are required to keep, and we cannot alter an audit entry.
Contact
Write to privacy@kankmed.com. Tell us what you want and the phone number you use with KankMed, and we will respond within 30 days.
KankMed operates under KANK & KEMO ENTERPRISES. See About KankMed.
Changes
If this notice changes in a way that affects you, we will say so here and date it.
← Back to KankMed