DATA GOVERNANCE & SECURITY
Built on practical protection, not legal assumption.
Laws can be ignored. Enforcement is uncertain. Kushé's patient data protection is built on five overlapping practical layers — technology controls that prevent unauthorized access regardless of intent, human accountability structures, and architectural decisions that limit exposure at every point.
Kushé does not sell, share, license, or transfer individual patient records — identified or de-identified — to any third party for any commercial purpose. Analytics subscribers access aggregate, population-level statistics only. No patient-level record or identifier is ever included in any external report, export, or API response. Patient data is owned by the client institution, hosted in Africa on AWS Cape Town,
Individual Identifed Records
Accessible only to authorized clinicians at the treating facility, client institution administrators, and MoH data liaisons, where formally agreed. Never sold. Never transferred. Never used commercially.
Encrypted at every layer
Local device database encrypted with SQLCipher. Data in transit via TLS 1.3. Data at rest via AES-256. MDM remote wipe on lost or stolen devices.
Never sold, Never licensed.
What Kushé will never do.
Never sell individual patient records to any party for any purpose. Include patient-level data in any commercial product. Use patient data to train AI models without explicit consent. Allow data to be used for advertising, marketing, or profiling.
De-identified Individual records
Available for research under a signed Data Use Agreement, IRB approval, explicit client consent, and MoH approval. Not included in the standard analytics subscription. The SCOGS quarterly export follows this framework under the existing USF IRB protocol.
Immutable audit trail
Every record access, export, and clinical action is logged permanently. No user — including administrators — can delete audit entries.
Patient rights
Every patient can request a copy of their record and review who has accessed it. The record belongs to the patient.