Yetu Health Privacy Policy

Effective Date: 5 May 2026

Last Updated: 5 May 2026

1. Who We Are

For purposes of this Privacy Policy, “Yetu Health”, “we”, “us” or “our” refers to Yetu Health and the entity legally responsible for operating the Yetu Health platform.

Yetu Health operates as a technology-enabled healthcare platform. Depending on the service you use, healthcare services may be provided by independent healthcare professionals, hospitals, pharmacies, laboratories or other healthcare providers listed on the platform.

Yetu Health Contact Details

• Legal Entity: Yetu Health
• Trading Name: YetuHealth
• Country: Uganda
• Address: Haruna Tower, Ntinda, Kampala, Uganda
• Email: info@yetuhealth.com
• Data Protection Officer: Joseph
• DPO Email: info@yetuhealth.com

2. Our Commitment to Privacy

We process personal information in accordance with applicable Ugandan data protection and privacy requirements, including the Data Protection and Privacy Act, 2019 and the Data Protection and Privacy Regulations, 2021.

Uganda's health-sector privacy guidance also recognises the particular importance of protecting health information and maintaining confidentiality within digital health systems.

We seek to ensure that personal information is:

• collected for legitimate and specified purposes;
• processed fairly and lawfully;
• limited to information reasonably necessary for the relevant purpose;
• kept accurate and, where necessary, updated;
• protected against unauthorised access, disclosure, alteration, loss or destruction; and
• retained only for as long as reasonably necessary, subject to legal, medical, financial, regulatory and legitimate business requirements.

3. Information We Collect

Depending on how you use Yetu Health, we may collect different categories of information.

3.1 Account and identity information

This may include:

• full name;
• date of birth or age;
• gender where required for healthcare purposes;
• telephone number;
• email address;
• username and account credentials;
• profile information;
• identification or verification information where legally or operationally necessary.

3.2 Health and medical information

Where you use healthcare services through Yetu Health, we may process information such as:

• symptoms and health complaints;
• medical history;
• diagnoses;
• treatment information;
• prescriptions;
• laboratory requests and results;
• medical documents uploaded by you;
• consultation information;
• healthcare provider notes and records;
• allergies;
• medications;
• information relating to appointments and healthcare services;
• information necessary to provide emergency or home-based services.

Health status and medical records are specifically recognised as specially protected information under Uganda's Data Protection and Privacy Act.

3.3 Location information

Where you enable location services, Yetu Health may collect approximate or precise location information to support services such as:

• finding healthcare providers near you;
• displaying nearby pharmacies, laboratories or healthcare facilities;
• arranging home-based services;
• supporting delivery services;
• facilitating emergency or ambulance services;
• improving service availability and geographic coverage.

You may disable device location permissions through your device settings. Certain location-dependent services may not function correctly if location access is disabled.

3.4 Transaction and payment information

When you make or receive payments through Yetu Health, we may process information relating to:

• transactions;
• payment amounts;
• invoices;
• payment status;
• refunds;
• transaction references;
• payment provider information.

Where payment processing is performed by a third-party payment provider, payment-card or financial credentials may be processed directly by that provider rather than stored by Yetu Health.

3.5 Device and technical information

We may automatically collect information such as:

• device type;
• operating system;
• application version;
• IP address;
• browser information;
• device identifiers;
• crash reports;
• security logs;
• approximate geographic information;
• network information.

This information helps us operate, secure, troubleshoot and improve Yetu Health.

3.6 Communications

If you contact us through customer support, telephone, email, chat or other communication channels, we may retain information necessary to respond to your request, investigate complaints and maintain appropriate service records.

4. How We Use Your Information

We may use personal information to:

1. create and manage your Yetu Health account;
2. provide healthcare-related services requested by you;
3. connect you with appropriate healthcare providers;
4. facilitate appointments and consultations;
5. facilitate video consultations;
6. facilitate pharmacy, laboratory and other healthcare services;
7. process healthcare orders and requests;
8. facilitate payments, refunds and billing;
9. communicate with you regarding your account and services;
10. send service-related notifications;
11. provide customer support;
12. verify healthcare providers and users where appropriate;
13. prevent fraud, abuse and unauthorised activity;
14. protect the security of the platform;
15. investigate disputes and complaints;
16. comply with legal and regulatory obligations;
17. maintain appropriate healthcare, financial and operational records;
18. improve the functionality, reliability and safety of Yetu Health;
19. perform aggregated or de-identified analytics; and
20. develop and improve our services.

We will not use your health information for unrelated purposes simply because we have access to it.

5. Legal Basis for Processing

Depending on the circumstances, Yetu Health may process personal information where:

• you have provided consent;
• processing is necessary to provide a service you have requested;
• processing is necessary for medical or healthcare purposes;
• processing is necessary to comply with a legal or regulatory obligation;
• processing is necessary to protect a person's vital interests or respond to an emergency;
• processing is necessary for legitimate operational, security or fraud-prevention purposes, where permitted by applicable law; or
• another lawful basis recognised under applicable law applies.

Uganda's Data Protection and Privacy Act generally requires prior consent for collection or processing, while recognising circumstances in which processing may occur without consent, including contractual performance, medical purposes and legal obligations.

Where consent is required, we will seek it in an appropriate and understandable manner.

6. Health Information and Medical Confidentiality

Healthcare information is particularly sensitive.

Yetu Health will apply appropriate administrative, technical and organisational safeguards to protect health information.

Access to health information is intended to be limited according to the person's role and legitimate need. For example:

• patients may access information associated with their account;
• healthcare providers may access information necessary to provide healthcare services;
• pharmacies may receive information necessary to fulfil relevant pharmacy orders;
• laboratories may receive information necessary to perform requested laboratory services;
• authorised Yetu Health personnel may access information where necessary for service delivery, support, security, compliance or legitimate operational purposes.

Healthcare providers using Yetu Health may also have their own professional confidentiality obligations and privacy policies. Yetu Health does not authorise healthcare providers to use patient information for unrelated purposes.

7. Sharing Your Information

We may share relevant information with appropriate parties where necessary to operate Yetu Health or provide requested services. These parties may include:

Healthcare providers

Doctors, nurses, hospitals, clinics, pharmacies, laboratories and other authorised healthcare providers may receive information necessary to provide the service requested by you.

Service providers

We may use third-party companies that provide services such as:

• cloud hosting;
• infrastructure;
• communications;
• SMS;
• email;
• push notifications;
• video communications;
• payment processing;
• analytics;
• security;
• technical support.

These providers may only process information as necessary to provide their contracted services and subject to appropriate contractual and security requirements.

Legal and regulatory authorities

We may disclose information where required or authorised by applicable law, court order, regulatory requirement or lawful government request.

Emergency situations

Where reasonably necessary to protect a person's life, health or safety, information may be disclosed to an appropriate person or organisation, subject to applicable law.

Business transactions

If Yetu Health is involved in a merger, acquisition, restructuring, financing, sale of assets or similar transaction, personal information may be transferred as part of that transaction, subject to applicable privacy and confidentiality obligations.

8. What We Do Not Do

Yetu Health does not sell your medical records or personal health information as a commercial product.

We do not permit personal health information to be used for unrelated advertising purposes merely because it is available to us.

Where analytics, research or reporting activities are conducted, we will seek to use aggregated, anonymised or de-identified information where reasonably appropriate.

9. Marketing Communications

We may send you service-related communications that are necessary to operate your account or deliver requested services. Examples include:

• appointment reminders;
• consultation notifications;
• order updates;
• payment confirmations;
• prescription-related notifications;
• security alerts;
• account notifications.

Where permitted and where consent is required, we may also send promotional or marketing communications.

You may opt out of non-essential marketing communications using the unsubscribe mechanism provided or by contacting us. Opting out of marketing will not prevent us from sending important service, security, transaction or healthcare-related communications.

10. Cookies and Similar Technologies

Our website and digital services may use cookies, device identifiers, analytics technologies and similar mechanisms to:

• keep services functioning;
• remember preferences;
• understand how services are used;
• improve performance;
• detect security issues;
• measure service effectiveness.

Where required, we will obtain appropriate consent for non-essential cookies or similar technologies.

11. Data Security

Yetu Health uses reasonable technical, organisational and administrative safeguards designed to protect personal information. These measures may include:

• encryption in transit;
• access controls;
• authentication mechanisms;
• role-based access;
• security monitoring;
• audit logging;
• secure hosting practices;
• backup and recovery procedures;
• vulnerability management;
• staff confidentiality obligations;
• access restrictions based on legitimate business or healthcare need.

However, no electronic system, network or method of transmission can be guaranteed to be completely secure. Accordingly, while we take security seriously, we cannot guarantee absolute security of information transmitted to or stored by Yetu Health.

12. Data Breaches

If Yetu Health becomes aware of a personal-data security incident, we will assess and respond to the incident in accordance with applicable law and our internal incident-response procedures.

Where notification is legally required, we will notify the relevant authority and/or affected individuals in accordance with applicable requirements.

Uganda's Data Protection and Privacy Regulations require notification of data security breaches to the relevant authority and prescribe information to be included in such notifications.

13. Data Retention

We retain personal information only for as long as reasonably necessary for the purposes for which it was collected, unless a longer retention period is required or permitted by law.

Because Yetu Health operates in the healthcare sector, certain information may need to be retained after an account is closed because of:

• healthcare recordkeeping requirements;
• legal obligations;
• financial and tax requirements;
• dispute resolution;
• fraud prevention;
• regulatory requirements;
• legitimate business purposes;
• protection of legal rights.

Closing your Yetu Health account therefore does not necessarily mean that all information associated with the account will be immediately destroyed.

Where information no longer needs to be retained, we will seek to delete, anonymise or securely dispose of it in accordance with our retention procedures.

14. Account Deletion

You may request deletion of your Yetu Health account through the available account-deletion mechanism or by contacting us.

When an account deletion request is received, Yetu Health will process the request in accordance with applicable law.

Some information may be retained where necessary or legally required, including healthcare, financial, transaction, audit, security or regulatory records. Where information must be retained, we will restrict its use to the purposes for which retention is required or otherwise legally permitted.

15. Your Data Protection Rights

Subject to applicable law and any lawful limitations, you may have rights including:

• the right to know whether we hold personal information about you;
• the right to access personal information;
• the right to request correction of inaccurate information;
• the right to request deletion where legally applicable;
• the right to object to certain processing;
• the right to request restriction of certain processing;
• the right to withdraw consent where processing is based on consent;
• the right to complain about the processing of your personal information;
• other rights provided under applicable Ugandan law.

The Data Protection and Privacy Act provides data-subject rights concerning access, correction, prevention of processing and other protections.

Some requests may be subject to legal limitations. For example, Yetu Health may not be able to immediately delete information that must legally be retained.

16. How to Exercise Your Rights

To exercise a privacy right or raise a privacy concern, contact:

Data Protection Officer / Privacy Team
Email: info@yetuhealth.com
Address: Haruna Tower, Ntinda, Kampala, Uganda

To protect users against unauthorised disclosure, we may need to verify your identity before completing certain requests. We will respond to valid requests within the timeframe required by applicable law.

17. Children's Information

Yetu Health services are not intended to encourage children to independently create accounts or obtain healthcare services without appropriate adult involvement.

Where healthcare services are provided to a child, we may process the child's information where legally permitted and with the involvement or consent of a parent, guardian or other authorised person where required.

Uganda's Data Protection and Privacy Act contains specific protections concerning personal information relating to children.

Parents or authorised guardians who believe that a child's information has been processed improperly should contact us.

18. Healthcare Providers

Yetu Health may verify healthcare providers before or during their participation on the platform. Provider information may include:

• professional name;
• professional qualifications;
• registration information;
• professional licence information;
• healthcare facility information;
• areas of practice;
• service information;
• availability;
• professional profile information.

Some provider information may be displayed publicly or to users where necessary to enable users to select and access healthcare services.

Yetu Health may suspend, restrict or remove provider access where there are reasonable concerns regarding compliance, safety, professional status, fraud or misuse of the platform.

19. Location Services

Yetu Health may use location information to provide location-dependent healthcare services. For example, location may be used to identify nearby:

• healthcare providers;
• pharmacies;
• laboratories;
• hospitals;
• home-service providers;
• emergency services.

Location information will not be treated as permission to continuously track you unless the relevant feature expressly requires such functionality and you have been informed accordingly.

You may control location permissions through your device settings.

20. Video Consultations and Communications

Certain Yetu Health services may allow communication between patients and healthcare providers through video, audio, messaging or other electronic communication technologies. Depending on the service, information associated with these interactions may include:

• appointment information;
• participant identity;
• technical connection information;
• messages;
• consultation-related records.

Yetu Health will not record video or audio consultations unless recording is specifically implemented, appropriately disclosed and legally permitted. If a future service records consultations, the relevant users will be informed before recording occurs where required by law.

21. Third-Party Services and Links

Yetu Health may integrate with or link to third-party services. These may include payment providers, communication providers, healthcare providers, pharmacies, laboratories and other service providers.

Third-party services may have their own privacy policies and terms. Yetu Health is not responsible for the privacy practices of third parties operating independently from Yetu Health. Users should review the relevant third party's privacy policy before providing information directly to that third party.

22. International Data Transfers

Some Yetu Health technology or service providers may process information outside Uganda.

Where personal information is transferred outside Uganda, Yetu Health will take reasonable steps to ensure that the transfer and subsequent processing comply with applicable Ugandan data protection requirements and that appropriate safeguards are in place. This may include contractual, technical, organisational or other safeguards appropriate to the circumstances.

Uganda's Data Protection and Privacy Regulations specifically address processing personal data outside Uganda.

23. Anonymised and Aggregated Information

Yetu Health may create information that has been aggregated, anonymised or de-identified so that it cannot reasonably be used to identify an individual. Such information may be used for purposes including:

• service improvement;
• operational analysis;
• healthcare service planning;
• statistical analysis;
• research;
• reporting;
• business planning;
• understanding platform usage.

We will take reasonable steps to prevent such information from being used to identify individual users.

24. Fraud, Security and Abuse Prevention

Yetu Health may process certain information to detect and prevent:

• fraudulent transactions;
• fake accounts;
• impersonation;
• unauthorised access;
• payment abuse;
• healthcare-service abuse;
• platform manipulation;
• security attacks;
• other unlawful or harmful activity.

This may include technical information, transaction information, account activity and relevant operational records.

25. Automated Decision-Making

Yetu Health may use automated systems to assist with operational functions such as:

• service availability;
• location-based discovery;
• fraud detection;
• notifications;
• technical monitoring;
• matching users with available services.

Where an automated decision has significant effects on an individual and applicable law provides specific rights concerning that decision, Yetu Health will provide appropriate information and mechanisms required by law.

26. Your Responsibilities

You are responsible for:

• keeping your account credentials confidential;
• providing accurate information;
• notifying us if you believe your account has been compromised;
• using Yetu Health only for lawful purposes;
• not accessing another person's health information without authorisation;
• not sharing another person's private information without lawful authority.

You should immediately notify Yetu Health if you suspect unauthorised access to your account.

27. Changes to This Privacy Policy

We may update this Privacy Policy from time to time to reflect:

• changes in our services;
• new features;
• changes in technology;
• changes in applicable law;
• regulatory requirements;
• changes in our data-processing practices.

When we make material changes, we may notify users through the Yetu Health application, website, email or other appropriate communication channels. The updated policy will indicate the date on which it was last revised.

28. Governing Law

This Privacy Policy is primarily governed by the laws of the Republic of Uganda, including applicable data protection, privacy, healthcare and electronic communications laws and regulations.

Where mandatory laws of another jurisdiction apply to a particular user or transaction, those laws may also apply to the extent required.

29. Questions and Complaints

We encourage users to contact Yetu Health first so that we can investigate and address privacy concerns.

For privacy questions, requests or complaints:

Yetu Health Privacy Team / Data Protection Officer
Email: info@yetuhealth.com
Telephone: +256 784 999 424
Postal Address: Haruna Tower, Ntinda, Kampala, Uganda

If you are dissatisfied with our response, you may have the right to lodge a complaint with the relevant data protection supervisory authority in Uganda.

30. Important Healthcare Disclaimer

Yetu Health is a technology platform that facilitates access to healthcare services.

Unless expressly stated otherwise, Yetu Health does not itself replace the professional judgment of an independent healthcare provider. Healthcare providers using the Yetu Health platform remain responsible for the healthcare services, advice, diagnosis, treatment and professional decisions they provide.

Users should seek appropriate emergency medical assistance where necessary. Yetu Health should not be relied upon as a replacement for emergency medical services where immediate physical intervention is required.

31. Contact

For questions concerning this Privacy Policy or the handling of your personal information, please contact:

Yetu Health
Legal Entity: Yetu Health
Data Protection Officer: Joseph
Email: info@yetuhealth.com
Telephone: +256 784 999 424
Address: Haruna Tower, Ntinda, Kampala, Uganda