Purpose-limited data use
Child and growth information is collected to create, analyze, store, and share the growth record within the defined product workflow.
Privacy and security
Control, protection, and traceability by design.
NeoScan’s SRS defines privacy and security requirements for sensitive child health information under the Kenya Data Protection Act 2019 and Kenya Health Act.
Privacy principles
What the design is meant to protect.
Parent control
A parent or guardian must give explicit, revocable consent before data or chart images are shared with a clinic.
Role boundaries
Parents see their own children. Providers see consented clinic records. Administrators review clinic registrations and audit logs.
Traceable access
Record creation, viewing, editing, manual overrides, and sharing are designed to leave immutable activity records.
Protection online and offline
Encryption is specified for the cloud database, local offline storage, and data moving between the app and backend.
Kenyan legal context
The SRS names KDPA 2019 and the Kenya Health Act as the governing framework, not United States HIPAA.
Consent-controlled sharing
A clinic does not receive access automatically.
The proposed app shows a consent screen before a child’s history or scans are shared with a registered clinic.
- Identify the clinic
A unique clinic access token connects the request to a registered practice.
- Explain the data
The parent sees what will be shared and why.
- Record the choice
Consent is logged with a timestamp.
- Allow revocation
The parent can stop clinic access to future data.
Growth history
Verified measurements, chart scans, reference views, and review flags.
Existing access
The design allows a parent to revoke access to new data at any time.
Encryption and transport
Protection at each movement and resting point.
End-to-end architecture requirements
These controls are specified in the SRS and still require implementation, testing, and compliance review.
On the phoneAES-256 encrypted SQLite for queued scans and profiles.
Secure tokensiOS Keychain or Android Keystore for JWT and refresh tokens.
In transitHTTPS with TLS 1.3 between mobile app and FastAPI.
In the databaseAES-256 at rest for protected health information in PostgreSQL.
Authentication
Security changes with the user’s role.
Initial access uses email and password with secure password hashing. The SRS then defines additional protections for subsequent sessions.
Session protection: The application session is specified to end after 10 minutes of inactivity. API JWT access expires after 15 minutes of inactivity.
- Parent / Guardian
Biometric unlock or a six-digit PIN after initial registration.
- Clinical Provider
Required SMS-based six-digit MFA code during login.
- Failed login controls
Temporary 15-minute lock after five consecutive failed attempts, with email notification.
- Password recovery
Single-use email token that expires after 30 minutes.
ActionOVERRIDE
TimeUTC timestamp
UserUnique authenticated ID
ChangeBefore and after field values
SourceDevice IP address
Audit logging
Important actions cannot disappear quietly.
Every growth-record create, read, update, manual override, or share action is specified to create a write-once log entry.
No user role—including system administrators—is meant to modify or delete those entries.
Data location and sharing
Specific constraints for child health data.
Cloud records
PostgreSQL stores WHO reference tables, patient records, growth scans, anomaly logs, referrals, consent-related data, and audit trails.
Temporary offline records
Encrypted local SQLite stores are used only while a scan or profile waits to synchronize.
Third-party sharing
Explicit parental consent is required before a clinic or pediatrician receives a child’s record.
Cross-border handling
The SRS states that data is not stored or transmitted outside Kenya without explicit consent and a lawful basis under KDPA.
Questions
Privacy design in plain language.
No. The role model limits providers to patients explicitly shared with their clinic through consent.
Yes. The design allows consent to be revoked, immediately ending the clinic’s access to new data.
No. It summarizes the controls required by the SRS. Formal implementation review and legal assessment are still needed.
Privacy or project enquiry