Privacy Policy

Overview

This Privacy Policy explains what information Dura Health ("Dura", "we", "us") collects, how we use it, and the choices you have. It applies to Dura Lite and any other Dura product, as well as this website.

Dura is a clinical documentation tool used by licensed healthcare providers. Most of the sensitive information Dura processes — consultation audio and transcripts — belongs to patients, is processed on their consent, and is controlled by the clinician and facility using Dura, not by an individual patient directly interacting with us.

What We Collect

During a consultation (via Dura Lite)

Consultation audio — processed in real time to generate a transcript. Raw audio is never stored; see "Data Retention" below.
Transcript and structured clinical data — the SOAP note, symptoms, and clinical details generated from the consultation, retained only with patient consent.

From doctors and clinics

Name, clinic or hospital affiliation, county, and the EHR/HIMS system in use, when you join the waitlist or become a pilot user.
Basic usage data (e.g. login activity, feature usage) needed to operate and improve the product.

From this website

Waitlist form submissions (collected via Microsoft Forms).
Standard technical data such as browser type and IP address, to the extent basic web hosting requires it.

Legal Basis for Processing

We process personal data under the Kenya Data Protection Act, 2019 ("Kenya DPA"). Our legal basis depends on the data in question:

Patient consultation data: explicit patient consent, obtained by the clinician before any audio is processed. No consent, no processing — this is a hard stop in the product.
Doctor and clinic data: legitimate interest in operating the pilot and product, and contractual necessity once a formal agreement is in place.
Website/waitlist data: consent, given when you submit the waitlist form.

Data Retention

Raw audio is never retained. Audio is processed transiently to produce a transcript and is not stored afterward, under any circumstance.

Transcripts and structured clinical notes are retained only with patient consent, encrypted, and kept for as long as needed to support the clinical record and the doctor's ongoing care of that patient, or as required by applicable Kenyan health records regulations.

Waitlist and contact information is retained until you ask us to delete it, or until it's no longer needed for the purpose it was collected for.

How We Protect Data

All data in transit and at rest is encrypted.
Every interaction with clinical data is logged in an append-only audit trail.
Access to clinical data is restricted to what's operationally necessary — Dura's own team does not browse patient data.
Data is hosted with in-country residency in mind, consistent with Kenya DPA requirements.

We do not sell patient, doctor, or clinic data, ever, under any circumstance.

We use a small number of infrastructure and AI service providers (for speech recognition and language processing) to operate Dura. These providers process data only as needed to deliver the service, under agreements consistent with Kenya DPA requirements, and do not use Dura's data to train their own general-purpose models.

Your Rights

Under the Kenya DPA, you have the right to access, correct, or request deletion of your personal data, and to object to certain kinds of processing. For patient data specifically, these requests are typically handled through the treating clinician or facility, since they hold the primary care relationship; we support and honour requests routed through them.

To exercise any of these rights directly with us, email hello@durahealth.fyi.

Changes to This Policy

We'll update this page if our practices change, and update the "last updated" date accordingly. Material changes affecting how patient data is handled will be communicated to participating clinics directly, not just posted quietly here.

Contact

Questions about this policy or how your data is handled: hello@durahealth.fyi, or write to us in Nairobi, Kenya.