Privacy Policy

1. Who we are

The KP Field Tracker application ("the App") is operated by the office of the Surveillance Officer, District Health Office (DHO), Mansehra, Khyber Pakhtunkhwa, Pakistan, in support of vector-borne disease (VBD) surveillance, expanded programme on immunisation (EPI), maternal & neonatal child health (MNCH), and other district public-health programmes. The application is administered by Dr. Abdul Rahman, District Surveillance Officer, on behalf of these programmes.

For privacy questions, contact: arkm071@gmail.com.

2. Who the App is for

The App is a professional tool intended for trained government health workers (Malaria Supervisors, Lady Health Supervisors, Rural Health Centre incharges, hospital surveillance focal persons, and DHO administrators). It is not a consumer health application. Access requires an admin-provisioned account; there is no public registration.

3. Data we collect

3.1 From end users (health workers)

• Account Name, work email, phone number, employee role, assigned union council and facility — provided by district administrators when an account is created.
• Authentication Encrypted password hash (handled by Google Firebase Authentication; we never see plaintext).
• Activity Timestamps of submissions and edits, app version, device platform — for audit and quality assurance.
• Location GPS coordinates of the user’s device at the moment a field report is submitted, used to geo-tag inspection sites. Background location is not collected.

3.2 Entered by users about cases (patient data)

Where the App is used to record dengue or malaria cases, trained health workers may enter the following about a confirmed or suspected patient, in line with Pakistan Field Epidemiology and Laboratory Training Programme (FELTP) line-list standards:

• Patient name and (optional) father's name
• Computerised National Identity Card (CNIC) number — entered by the health worker, used solely for case de-duplication and follow-up. Stored as plain text inside the secure Firestore database; never displayed publicly; never used for identity verification of the patient.
• Age, sex, contact phone number
• Address, union council, mohallah
• GPS coordinates of the patient's residence (entered by the field investigator)
• Symptom checklist, onset date, lab results (NS1, IgM, IgG, PCR), classification, outcome
• Photo of the local contact's CNIC and witness signature, where required by surveillance SOP

Patient data is collected by health workers acting under their professional duty as defined by the KPK Department of Health. Patient consent is obtained verbally by the field investigator at the time of interview, in accordance with district public-health practice.

4. How we use the data

• To monitor and respond to vector-borne disease outbreaks across District Mansehra.
• To produce daily, weekly and monthly surveillance reports for the District Health Officer, the Provincial Programme, and (where required) the Federal Ministry of Health.
• To audit the timeliness and completeness of field reports.
• To direct vector-control teams (IRS spraying, larval surveillance, fogging) to specific high-risk locations.

We do not use the data for advertising, marketing, profiling, or any commercial purpose. The App contains no advertisements and no analytics SDKs that share data with third parties.

5. Where the data is stored

All data is stored in Google Firebase / Cloud Firestore, a managed Google Cloud service. Data is encrypted in transit (HTTPS / TLS 1.2+) and encrypted at rest by Google's infrastructure. The Firebase project is administered by the App owner; access is restricted to authenticated users whose role permits it, enforced by Firestore security rules at the database layer.

6. Who can see the data

• The user themselves — for the records they have submitted.
• District administrators (DHO Mansehra) — for aggregated district-wide reporting and audit.
• Provincial / national health authorities — for aggregated, de-identified surveillance summaries shared during outbreak response.
• Google — only as the infrastructure provider, under its standard Firebase data-processing terms.

We do not sell data to anyone. We do not share identifiable patient data with any third party other than the public-health authorities listed above.

7. Data retention

Surveillance records are retained for the duration required by Pakistan public-health regulations and World Health Organization (WHO) Dengue Surveillance Guidelines (2009) — typically a minimum of three (3) years from the close of a case investigation. After the retention period, identifiable data may be archived in aggregate de-identified form for historical trend analysis.

8. Your rights

• Access — you may request a copy of the personal data the App holds about you.
• Correction — you may request correction of inaccurate data through your district administrator.
• Deletion — you may request deletion of your user account; surveillance records you submitted may be retained in aggregate form for the legal retention period.
• Account deactivation — administrators may deactivate your account when you change role or leave the programme.

Requests should be sent to arkm071@gmail.com with the subject "Privacy request".

9. Children

The App is for use by professional adult health workers only. It is not directed at children and we do not knowingly collect data from children as App users. Where a patient under the age of 18 is the subject of a case investigation, their data is handled under the same protections described above, recorded by the responsible health worker.

10. Security

We protect data through:

• HTTPS / TLS encryption for all network traffic.
• Firebase Authentication for user identity.
• Firestore Security Rules enforced at the database layer (defence in depth — UI gates and database gates).
• Soft-delete with audit trail for any record modification.
• Admin-provisioned accounts only; no public registration.

No internet-connected system is perfectly secure; users should report any suspected misuse of credentials immediately to their district administrator.

11. Changes to this policy

We may update this policy from time to time as the App evolves. The "Last updated" date at the top of the page reflects the most recent revision. Material changes will be communicated to administrators and field staff through the same channels used for routine programme updates.

12. Contact

Dr. Abdul Rahman
District Surveillance Officer, DHO Mansehra
Khyber Pakhtunkhwa, Pakistan
Email: arkm071@gmail.com

© 2026 District Health Office, Mansehra. This privacy policy is published for the KP Field Tracker Android application (pk.gov.kp.health.surveillance).