Privacy Policy

AfyaApp processes personal data in accordance with, among others:

• The Constitution of Kenya, 2010 — Article 31, the right to privacy.
• The Data Protection Act, No. 24 of 2019 and the Data Protection (General) Regulations, 2021 — health data is sensitive personal data under Section 2.
• The Health Act, No. 21 of 2017 — Sections 8–13 on confidentiality of patient information and lawful disclosure.
• The Social Health Insurance Act, No. 16 of 2023 — SHA membership data.
• The Computer Misuse and Cybercrimes Act, No. 5 of 2018.

Our lawful bases under Sections 30 and 45 of the Data Protection Act are: your consent, performance of the service you asked for, compliance with a legal obligation, provision of health care by a licensed practitioner under a duty of confidentiality, and protection of the vital interests of a data subject in an emergency.

The patient is the data subject. Each registered health facility is a data controller for the clinical records it creates. AfyaApp is a data processor for those records, and a controller only for the account, authentication and security data needed to operate the platform.

• Identity data: full name, National ID number, birth certificate number for patients under 18, date of birth, gender.
• Contact data: email address and phone number used for sign-in codes and account recovery.
• Health data: diagnoses, prescriptions, lab results, uploaded medical documents, blood group, weight and height.
• Insurance data: Social Health Authority (SHA) membership number.
• Facility data: hospital name, registration and licence details, and the name and licence number of the practitioner making an entry.
• Profile media: an optional profile photograph, stored privately.
• Technical and audit data: sign-in events, consent grants and revocations, and emergency (break-glass) access logs with the reason given.

• To create and secure your account, including one-time codes sent to your email.
• To let you and the facilities you authorise view an accurate, continuous medical history.
• To let licensed facilities record diagnoses, prescriptions, lab results and documents.
• To link your care to your SHA cover where you provide a membership number.
• To verify that a facility is licensed before it can create clinical records.
• To keep audit logs so that access to your records can be reviewed.

We do not sell personal data, and we do not use your health data for advertising or profiling.

• You, the patient, at any time from your portal.
• A health facility that created the record.
• A health facility to which you have granted consent — consent is specific, informed, and revocable at any time from the patient portal.
• A practitioner invoking emergency (break-glass) access under Section 11 of the Health Act, 2017. This is time-limited, requires a stated reason, and is permanently logged and visible to you.
• Platform administrators, strictly for verification, security and abuse review.

Revoking consent stops future access; it does not delete records already lawfully created.

We use a small number of service providers strictly to run the platform: cloud database, authentication and encrypted file storage; a transactional email provider to deliver one-time sign-in and password reset codes; and Google, only where you choose to sign in with a Google account. These providers act on our instructions and are bound by confidentiality and data protection obligations. We do not share health data with advertisers, insurers or employers.

Some infrastructure providers may process data outside Kenya. Where this happens it is carried out in line with Sections 48 and 49 of the Data Protection Act, 2019 — on the basis of appropriate safeguards, contractual protections, and confirmation that the data will receive an adequate level of protection.

• All traffic is transmitted over encrypted (HTTPS/TLS) connections.
• Records are held in access-controlled databases with row-level access rules enforced per account.
• Medical documents and profile photos are kept in private storage reachable only through short-lived signed links.
• Sign-in requires a password plus a one-time code sent to your registered email, valid for 15 minutes.
• Passwords and one-time codes are stored only in hashed form.
• Emergency access and consent changes are permanently logged.

Health records are retained in line with Kenyan health records retention practice — adult records for at least 6 years from the last entry, and records of minors until at least 6 years after they turn 18 — unless a longer period is required by law. Clinical entries are append-only: corrections are made by adding a corrective entry rather than erasing history. Account, authentication and audit data is kept for as long as the account is active and for a reasonable period afterwards for security and legal purposes. One-time codes are deleted or expired within 15 minutes.

Under Part V of the Data Protection Act, 2019 you have the right to:

• be informed of how your personal data is used;
• access the personal data we hold about you;
• request correction of inaccurate or misleading data;
• object to processing, or request deletion of data we are not legally required to keep;
• request a copy of your data in a portable format;
• withdraw consent given to a facility at any time;
• lodge a complaint with the Office of the Data Protection Commissioner (ODPC).

To exercise a right, use the support channel shown in your portal. We respond within the timelines set by the Data Protection (Complaints Handling) Regulations.

Accounts for patients under 18 must be opened and operated by a parent or legal guardian, and a birth certificate number is required. Consent for processing a child's health data is given by the guardian, in line with Section 33 of the Data Protection Act, 2019.

AfyaApp uses only the storage needed to run the service: a session token to keep you signed in, and — on the installable app — an offline cache so your own records remain readable during poor connectivity. Cached data is stored on your device and cleared when you sign out or uninstall the app. We do not use advertising or cross-site tracking cookies.

Where a breach poses a real risk of harm, we will notify the Office of the Data Protection Commissioner within 72 hours of becoming aware of it, and notify affected data subjects without undue delay, as required by Section 43 of the Data Protection Act, 2019.

This policy may be updated to reflect changes in Kenyan law or in the service. Material changes will be notified in the app. For privacy requests, security reports or questions about this policy, contact the app owner through the support channel shown in your portal. You may also complain to the Office of the Data Protection Commissioner, Kenya.