KoroERP Hub Privacy Policy

App and provider

This policy applies specifically to KoroERP Hub, the mobile app identified by Android package com.koroworks.hub and also called Koro Hub on some screens. KoroWorks provides the app and is the privacy contact for this policy. KoroERP Hub connects you with merchants, healthcare and wellness providers, and other organisations using Koro services. Those organisations may be independently responsible for the records they hold. This app-specific policy is available at https://koroworks.com/privacy/koroerp-hub.

Information and device permissions

We collect the account details you provide, such as your name, email address, phone number, and account identifiers; shopping, order, booking, and payment-reference information; and messages, support requests, and other content you submit. Payment providers process payment credentials under their own privacy notices. Technical information such as IP addresses, request logs, and app or device details may be processed to operate and secure the service. Sensitive health information is described separately below.

Features that need device access request the relevant permission. You can deny or revoke permissions in device settings, although the related feature may then be unavailable. The app does not request device-health permissions. Account and transaction information you submit is sent to the configured Koro services and the merchant or provider involved in that service, rather than remaining only on your phone.

Health records

The current KoroERP Hub release does not integrate with Health Connect or Apple Health. It does not request device-health permissions, read wearable measurements, or upload device-health readings.

The device-based My Vitals viewer and its BMI calculator are no longer available. Existing care-provider records remain available through the healthcare features.

When you use healthcare or wellness features, KoroERP Hub accesses information associated with your care-provider account, such as healthcare bookings, appointments, released health notes, telemedicine session details, existing monitoring programmes, readings, and consent records. These are sensitive personal health data. The app does not collect measurements from device-health services.

Healthcare records are retrieved from the configured care-provider service for your signed-in account, subject to access controls. Device-health reading and sharing are no longer available.

Your healthcare provider supplies the records displayed in the app. Existing readings uploaded by earlier versions may remain in the healthcare service, including their measurement values, units, times and source metadata. Removing device sync does not automatically delete those records.

Health data is used to display your records and trends, support appointments and remote monitoring, and enable your authorised care team to review readings and monitoring alerts. Uploaded readings are stored in the healthcare backend used by your provider, which may be Koro-hosted or provider-managed. Access is limited to you, authorised care-provider personnel, and service providers supporting the delivery and security of these features, subject to applicable access controls and legal obligations. Hosted app connections use HTTPS to protect data in transit. Health data is not made public to merchants, other tenants, or unrelated app users.

If your care provider enables Ask about my care and you use it, your messages and relevant appointment details, care bills, prescriptions, and released health notes are sent to the configured AI service to generate a response about your own records. Depending on your provider's setup, processing may involve an external model provider. Questions and responses may be recorded by the healthcare service for usage and audit purposes. This optional assistant does not replace professional medical advice and is not an emergency service.

Health data, including readings retained from earlier versions, is used only for the health and care purposes you requested and applicable legal obligations. We do not sell this data or use it for advertising, marketing profiling, credit or insurance eligibility decisions, or training general-purpose AI models. Removing device sync does not relax these restrictions.

You can decline or withdraw monitoring consent in My Health Monitoring. This release cannot enable device sharing or upload device readings. Withdrawal does not automatically delete previously uploaded readings or records held by your healthcare provider. You can remove permissions granted to earlier versions through your device settings.

Uploaded health readings and care records are retained for the monitoring and care purposes described here and for applicable clinical, legal, security, and audit obligations. Your provider's medical-record retention requirements may prevent immediate deletion, including after account closure; a general account-deletion timeline does not override those requirements. To request access, correction, export, or deletion of KoroERP Hub health data, contact your care provider or support@koroworks.com. We will explain any applicable retention restriction and coordinate with the provider responsible for the records.

Other uses and sharing

Non-health information is used to manage your account, deliver purchases and bookings, process payments, communicate about your requests, provide support, and prevent fraud or misuse. It is shared with the merchant or provider you interact with and with hosting, payment, messaging, and other service providers needed to operate those features. Information may also be disclosed where required by law. We do not sell your personal data. The health-data purposes and restrictions above continue to apply to retained healthcare records.

Storage, security, and transfers

Information is stored in the services supporting your account and the organisation you interact with, which may be Koro-hosted or provider-managed. Hosted connections use HTTPS. Access controls limit records to authorised users and service personnel. No storage or transmission method is completely secure. Data may be processed outside your country depending on hosting and service providers, subject to applicable data-protection requirements. Contact us for questions about the organisation responsible for a specific record.

Retention and deletion requests

We retain account and transaction information while needed to provide your services, resolve disputes, prevent fraud, and meet legal obligations. To request account deletion or access, correction, export, or deletion of associated data, email support@koroworks.com from your registered address and identify your KoroERP Hub account and request. Do not send passwords, health records, or payment credentials in the email. We may need to verify your identity. We coordinate with merchants or care providers where they control the records; clinical records, legally required transaction records, security logs, and backup copies may be retained as required. We will explain applicable exceptions. Uninstalling the app or revoking a permission does not itself delete server-side records.

Your choices and rights

You can manage device permissions, choose whether to use the optional care assistant, and withdraw monitoring consent. Depending on applicable law, you may also request access, correction, portability, restriction, objection, or deletion. Contact support@koroworks.com or your care provider for health-record requests. Withdrawing optional consent does not undo lawful processing already completed.

Children and dependent records

KoroERP Hub is not intended for independent use by children under 16. If a parent, guardian, or care provider supplies information about a dependent, they must have the authority and consent required by applicable law. If you believe a child has provided information without appropriate authorisation, contact support@koroworks.com so we can investigate with the organisation responsible for the records.

Changes to this policy

We may update this app-specific policy when features, processing practices, or legal requirements change. The last-updated date identifies the current version. Where required, we will provide notice and seek permission before new processing begins; a policy update alone does not grant device-health permission.

Privacy contact

For KoroERP Hub privacy questions or data requests, contact KoroWorks in Nairobi, Kenya. Include the app name so we can route your request correctly.

https://koroworks.com/privacy/koroerp-hub