Privacy Policy

1. Introduction and scope

We understand that you care about your personal privacy, and we take that seriously. This Privacy Notice describes how Neotech Limited, doing business as LIVIA Health (“LIVIA”), uses and shares personal data collected through LIVIA Pharmacy, LIVIA MD, LIVIA Hospital, the LIVIA Health App, LIVIA Lab and LIVIA Imaging. Privacy is an ongoing responsibility, so we will update this Privacy Notice from time to time as we adopt new personal data practices or privacy policies.

We do not knowingly attempt to solicit or receive information from children. In this notice, “personal data” means information relating to an identified or identifiable individual, and “you” means consumers who use our Services.

2. Personal data we collect

Our goal is to limit the information we collect to what is needed to support our business. The personal information we collect depends on how you interact with us, the choices you make and the products and features you use. We do not sell personal information to anyone and only share it with third parties who help deliver Livia Health services.

Information you submit

The personal information we collect can include:

Personal identifiers, such as name, title, address (private, work) and telephone number (private, work)
Device and online identifiers and related information, such as telephone number, email addresses, business email and business phone number
Internet, application and network activity, such as cookie IDs and browser visits
Government identifiers, such as national identification numbers
Demographic information, such as age and date of birth
Financial information, such as credit and debit card numbers and claims information
Health and health insurance information, such as prescription numbers and health insurance identification numbers
Purchase history information, such as products you have bought
Biometric information, such as facial recognition
Location information, such as geo-location information
Sensory information, such as digital photos
Employment information, such as occupation, title and professional memberships
Job application data, such as background checks, work performance, previous employers and referees

Sensitive data

In some cases we may handle special categories of personal data, which may be considered sensitive. We collect data about health, medical records, medical diagnosis, prescriptions, treatment information and facial recognition. Before we handle sensitive personal data about you, we require your consent. We will not handle any sensitive personal data that you have not permitted us to handle or have not provided to us. Only a limited number of our personnel have access to your sensitive personal data.

Information we collect indirectly

Public sources. Personal data may be obtained from public registers (such as internet searches).

Social and professional networking sites. If you register or log in to our websites using a social media account (for example Google), we will collect the information needed for registration or login that you permitted your social media provider to share with us. This may include your name and email address and, depending on your privacy settings, additional details. Please review the privacy controls on that service to choose how much information is shared with us.

Business clients. Our business clients may engage us to perform professional services that involve sharing personal data they control.

Recruitment services. We may obtain personal data about candidates from employment agencies and other parties, including former employers.

Data processors

The data we collect is transferred to servers in the United Kingdom operated by our cloud computing provider, Amazon Web Services (AWS). Some personal data may be transferred to other vendors who provide services to Neotech, including the principal vendors below:

Name of processor	Function	Location
Amazon Web Services (AWS)	Hosting, database, VPN, gateway, DNS, Chime	United Kingdom
Mandrill	SMTP for transactional emails	United States
Africa’s Talking	Promotional and transactional SMS	Kenya
Twilio	Promotional and transactional SMS	United Kingdom
Google Analytics and Firebase	Tracking and activity monitoring, push notifications, face recognition	United States
Google Cloud APIs	Location coordinates, Google Maps, places search	United States
M-PESA	Payment transactions	Kenya
Flutterwave	Credit/debit card payment transactions	Kenya

By accepting this Privacy Notice, using the Services or providing us with your personal data, you acknowledge and consent to your personal data being transferred and processed as described in this Policy.

Information we collect automatically

LIVIA’s website collects certain information automatically and stores it in log files. This may include internet protocol (IP) addresses, the general location from which your device accesses the internet, browser type, operating system and other usage information. We use this information to design our site to better suit our users’ needs.

3. Cookies and tracking technologies

Our website and Services use cookies to help personalise your online experience. Cookies are small data files that we transfer to your device to collect information about your use of our websites. Session cookies stay on your device only until you stop browsing; persistent cookies stay until they expire or are deleted.

You can accept or decline cookies. Most web browsers accept cookies by default, but you can change your browser settings to decline them.

4. How and why we use personal data

We use your personal data to:

(a) Provide our Services to you, such as:

Validating, processing, verifying and submitting claims to insurance companies
Managing prescriptions, lab and imaging requests
Managing drug deliveries
Creating pre-authorisations of valid policies, including benefits and exclusions
Consultations with doctors
Providing security for the Services and obtaining analytics about app and ad performance
Marketing, developing and improving our products and services
Providing customised services and support, including monitoring, investigating and responding to your enquiries and concerns
Testing, research, analysis and product development, including improving our websites

(b) Google Cloud Platform. Livia’s use of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

(c) Customer support. If you contact us with a question, our support team may view your data to solve your problem and may ask follow-up questions.

(d) Product development. To improve our products and services, we need to understand how our Services are used and analyse personal data. We integrate privacy by design into these processes.

5. Lawful reasons for processing personal data

We may rely on the following lawful reasons when we collect and use personal data:

Contract. To perform our contractual obligations to, or enter into a contract with, the relevant individuals.
Consent. Your freely given consent at the time you provided your personal data.
Legitimate interests. Where processing is fair, reasonable and balanced, including delivering services to clients, monitoring our IT systems, preventing fraud or criminal activity and meeting our corporate social responsibility commitments.
Legal obligations. To meet our legal and regulatory obligations.
Public interest. To perform a specific task in the public interest or in the exercise of official authority vested in us.
Vital interests. To protect the vital interests of the individual or another person.

6. When we share personal data

Service providers. Contractors, data processors and other third parties, such as insurance companies, that support our organisation. We require them to keep your information confidential, comply with applicable laws and use it only to provide services to us.
Corporate affiliates. Our partners, affiliates and associated organisations.
Other third parties. Where required to comply with a court order, government investigation or similar legal process, or where we believe in good faith that disclosure is necessary to protect our rights, your safety or the safety of others, investigate fraud or respond to a government request.
Corporate transactions. In a bankruptcy, merger, acquisition, reorganisation or sale of assets, personal information may be transferred as part of the transaction.

7. Data subject rights

Subject to legal and contractual exceptions, the Data Protection Act, 2019 gives you the following rights:

To be informed that we are collecting personal data about you.
To access personal data we hold about you and ask how we process it.
To ask us to correct inaccurate or incomplete personal data.
To ask us to erase your personal data, noting that we may retain information where the law requires or allows.
To object to and withdraw consent for processing. We may continue processing where we have a legitimate or legal reason.
To request restricted processing, noting that we may be entitled or obliged to continue processing.
To request transfer of your personal data in an electronic format.
To ask us to review decisions made solely by automated processing, including profiling, that produced legal or similarly significant effects.
To object to our use of your personal data for direct marketing, including profiling.

To exercise any of these rights, contact us at dpo@liviaapp.com.

We may need specific information from you to confirm your identity before acting on a request. This protects your data from being disclosed to anyone without a right to receive it. We try to respond to all legitimate requests within a reasonable time and will keep you updated if a request takes longer. You have the right to lodge a complaint with the Office of the Data Protection Commissioner if you have concerns about how Livia processes your personal data.

8. External websites

Our websites may contain links to sites not governed by this Privacy Notice. Please review those sites’ privacy notices before submitting personal data. We are not responsible for the content, security or privacy practices of other sites.

9. Data breach

If Neotech becomes aware of a security breach that has resulted or may result in unauthorised access to, use or disclosure of personal information of Livia Health users, Neotech will promptly investigate and notify the ODPC within 72 hours of becoming aware of it, unless the breach is unlikely to result in a risk to the rights and freedoms of individuals.

10. Data security

Livia protects personal data with security measures consistent with industry standards, including background checks on employees and encryption of data in transit and at rest. Our data is hosted by Amazon Web Services, which maintains multiple security certifications. We have technical and organisational policies and procedures to protect personal data, including sensitive data, from loss, misuse, alteration or destruction. Access is limited to those who need it, and they must keep the information confidential. We may apply pseudonymisation, de-identification and anonymisation techniques, and we train our employees on confidentiality, privacy and security.

11. Data retention

We retain personal data only as long as reasonably necessary for the purposes we collected it for, including legal, regulatory, tax, accounting or reporting requirements. We may retain data longer in the event of a complaint or likely litigation.

To decide retention periods, we consider the amount, nature and sensitivity of the data, the risk of harm from unauthorised use or disclosure, the purposes of processing and whether they can be achieved by other means, and applicable legal, regulatory, tax and accounting requirements.

12. Changes to this Privacy Policy

This Privacy Policy is effective from the date stated at the top of this page. We may change it from time to time. To the extent permitted by law, our use of your information is governed by the Privacy Policy in effect when we collected it. Please check this page regularly.

13. Acceptance of this policy

By accessing and using the website and Services and submitting your information, you agree to this Policy. If you do not agree, please do not use the website and Services.

14. Online pharmacy and health certification

Neotech is registered with the Pharmacy and Poisons Board, PPB/N/1624, to provide prescription-based services through the Livia Health app and the associated website, liviahealth.com.

15. How to contact Livia

If you have questions, concerns or complaints, or want to exercise your rights, contact us at support@liviahealth.com or dpo@liviaapp.com. You also have the right to lodge a complaint about Livia’s data processing with the Office of the Data Protection Commissioner.