Privacy Policy
Last updated 5 October 2026
Kennaa Tech PLC (“we”) makes Dambal, software that pharmacies and drug stores in Ethiopia use to run their shops. This policy explains what personal data passes through it, why, where it is kept, and what you can ask us to do about it. It is written to be read rather than to be survived.
Two different relationships
Most of the personal data in Dambal is not ours. A pharmacy decides to record its customers and staff; we only hold that record for it. In the language of Ethiopia’s Personal Data Protection Proclamation 1321/2024, the pharmacy is the data controller and we are its data processor. For that data, ask the pharmacy first: they decide what is kept and for how long. Our obligations to them are in the Data Processing Agreement.
For the people who sign up and use Dambal — the owner, the pharmacist, the cashier — we are the controller, because we decide to hold their account in order to provide the service.
What we hold
About people with an account
- Name, and an email address or a phone number, which is how you sign in
- Your password, stored only as an irreversible hash — we cannot read it
- Your language and calendar preference
- Sessions: when you signed in, roughly what device you used (the browser’s user-agent string), and when it was last active
- A record of significant actions taken in the shop, and by whom
About a pharmacy’s customers, entered by the pharmacy
- Name, and optionally a phone number, address and TIN
- What they bought, what they owe, and what they have paid
- Any note the pharmacy chooses to write about them
About a pharmacy’s staff, entered by the pharmacy
- Name, and optionally a phone number
- Role, and an agreed salary where the pharmacy records one
What we deliberately do not hold
Dambal does not store prescriptions. It does not record a patient’s name, age, sex, phone number or card number, the prescribing doctor, a diagnosis, or an image of a prescription. A product can be marked as needing a prescription, and a sale records that one was needed and that the seller confirmed seeing it — nothing about the person holding it. The paper stays in the pharmacy’s own file, where it already was.
We do this on purpose. Health data about an identified person is the most sensitive category a system like this could keep, and the shop does not need us to keep it.
We also do not sell personal data, share it for advertising, or use it to train machine learning models.
Why we hold it, and on what basis
- To provide the service you asked for — the pharmacy cannot sell, track stock or close its day without these records. This is performance of our contract with the pharmacy.
- To keep accounts secure — sessions, sign-in attempt limits and activity records exist so that an account cannot be quietly taken over, and so a shop can see who did what. This is our legitimate interest and the pharmacy’s.
- To contact you about the service — password resets and staff invitations. These are necessary to the service, not marketing.
Where it is stored
The application and its database run on servers in Jakarta, Indonesia (Hostinger International Limited). Email is sent through Resend, in the United States. The full list, with what each one does, is on the sub-processors page.
We are telling you this plainly because you are entitled to know where your records physically are. Proclamation 1321/2024 contains a requirement to store personal data collected in Ethiopia on servers in Ethiopia. We are working to move hosting into Ethiopia and will update this page, and tell affected pharmacies, when that is done.
How long we keep it
A pharmacy’s records are kept for as long as it uses Dambal, because they are its books. Dambal never edits or deletes a posted record: a mistake is corrected with a new entry, so the history of what was recorded stays intact and the shop’s accounts hold together.
If a pharmacy stops using Dambal, it can export its data, and we will delete or irreversibly anonymise its records on request. Where a record must be kept to meet another legal obligation, we keep only that record and only for as long as the law requires.
Who can see it
- The people at that pharmacy, limited by the role it gives each of them
- The sub-processors listed, only to do the job described
- Our staff, only where it is needed to support or repair the service. A support session that enters a pharmacy’s data is recorded, time-limited, and visible to the pharmacy.
- A public authority, where the law requires it of us
How it is protected
- Everything is served over HTTPS; nothing is sent in the clear
- Passwords are hashed with Argon2; neither we nor an attacker with the database can read them
- Every record belongs to one business and every query is restricted to that business
- Repeated wrong passwords are throttled, and administrator accounts require a second factor
- Backups are taken so that a failure does not become a loss
Your rights
Under Proclamation 1321/2024 you may ask us to:
- tell you what personal data we hold about you, and give you a copy
- correct it where it is wrong
- delete it, where we are not required to keep it
- restrict or object to how it is used
- withdraw consent, where consent is what we relied on
Write to kennaatechplc@gmail.com. We answer within 30 days. If the data was entered by a pharmacy about you — as its customer or its staff — we will pass your request to that pharmacy, because it is theirs to decide. You may also complain to the Ethiopian Communications Authority.
If something goes wrong
If personal data is exposed or lost, we will notify the relevant authority within 72 hours of becoming aware of it, and tell affected pharmacies without undue delay.
Children
Dambal is for people working in a pharmacy and is not directed at children. We do not knowingly create accounts for anyone under 18.
Changes
When this policy changes we will update the date at the top, and tell pharmacies directly where the change is significant.
Contact
Kennaa Tech PLC
Anfo 105 Adebabay, Girshe Tulu Building, 4th Floor
Addis Ababa, Ethiopia
kennaatechplc@gmail.com
+251 941 312 184 · +251 983 289 982