Privacy Policy

Defolt Labs Limited is a software lab in Dar es Salaam, Tanzania. We design, build, and run software, including our own products, the Defolt Retail System (DRS) and the Defolt Health System (DHS), and custom platforms for other businesses.

Defolt Labs is registered as a Data Processor with the Personal Data Protection Commission (PDPC) of Tanzania under the Personal Data Protection Act, No. 11 of 2022, registration number 0-000-007-324 (valid 11-04-2026 to 11-04-2031). This policy is governed by Tanzanian law and the PDPA.

• This website, defoltlabs.com.
• DRS: retail software. A shop that runs DRS controls its own shop, staff and customer data; Defolt Labs holds only the account and billing details described below.
• DHS: clinic software for dental, eye, general, maternity and polyclinic practices. A clinic that uses DHS controls its patients' data; Defolt Labs processes that data on the clinic's behalf.

Under the PDPA, the role we play depends on the product:

• DRS and DHS customer data: the shop or clinic decides why and how their business, staff, customer or patient data is processed. They are the Data Controller. Defolt Labs acts as a Data Processor, handling that data only to run the service for them.
• Your account and billing with us: the contact and payment details you give Defolt Labs directly (to open an account, subscribe, or get support) are held by Defolt Labs as controller of that limited set of data.
• This website: Defolt Labs is the controller for the contact form and the basic technical data described below.

Website

• What you submit in the contact form: your name, email, optional company, project type, and message.
• Basic technical data your browser sends (IP address, browser and device type, pages visited), used for security and to keep the site working. We do not use it for advertising or for tracking you across other websites.

DRS (retail)

• Account and billing details you provide: owner or billing contact name, email, phone, and subscription payment history.
• Anything you send us for support (messages, logs, or screenshots you choose to attach).

DHS (clinics)

• On the clinic's behalf, DHS processes patient and clinical data the clinic enters, such as patient contact details, appointments, clinical records and treatment, prescriptions, and billing.
• Staff account details the clinic sets up (name, role, contact).

• To deliver and run the service you or your clinic/shop asked for.
• To take payment and keep billing and accounting records.
• To provide support and fix problems.
• To keep the service secure and prevent abuse.
• To meet our legal obligations under Tanzanian law.

We do not sell or rent your data, we do not use it for targeted advertising, and we do not build profiles of you from other websites.

• Data in transit is encrypted (TLS).
• Patient data in DHS is encrypted at rest.
• Each clinic's or shop's data is isolated per tenant at the database level, by a security policy on every row that fails closed, so one customer cannot see another's data.
• Access is scoped by role, so records are only visible to the right people.
• Changes are written to an audit trail that can only be added to, and shows if it has been altered.
• We keep health data out of our system logs and event messages.

We do not claim any external security certification (for example ISO, SOC 2, HIPAA, or a GDPR certification). Our compliance basis is registration under the Tanzanian PDPA. No system is perfectly secure, so please also protect your own accounts with strong passwords.

We share the minimum necessary with a small set of providers so the products work:

• Payment processors: licensed Tanzanian payment providers, for subscription billing and payments (receives payer name, phone, reference and amount).
• SMS gateways: licensed telecommunications providers, for SMS messages such as receipts and appointment reminders (receives the phone number and message).
• Cloud/hosting providers that run the services, under contract not to access your data.
• Google: only if you choose "Sign in with Google" (we receive your name and email from Google).
• Regulators, courts, or authorities where required by Tanzanian law.

You may ask to access, correct, or delete the personal data we hold about you, and you may complain to the Personal Data Protection Commission (pdpc.go.tz) if you believe your rights have been infringed.

To make a request, email info@defoltlabs.com with the subject "Data request" and enough detail to identify your account. We will respond within the time the PDPA requires.

Important: when your request is about patient data in a DHS clinic, or shop data in a DRS install, that data belongs to the clinic or shop (they are the controller). Please contact them directly; we will support them in responding, but we cannot act on that data without their instruction.

We keep personal data only as long as needed to provide the service and to meet legal, accounting, and tax obligations, after which it is deleted or anonymised. Specific retention periods for billing records, clinical data, and website logs are being finalised and will be stated here.

Defolt Labs Limited
P.O. Box 23463, Dar es Salaam, Tanzania
PDPC Data Processor registration: 0-000-007-324
Email: info@defoltlabs.com
Phone: +255 797 140 800

See also our Terms of Service.