Terms & Conditions

AfyaApp is operated in Kenya and is designed to be used in accordance with, among others:

• The Constitution of Kenya, 2010 — Article 31 (right to privacy) and Article 43 (right to the highest attainable standard of health).
• The Health Act, No. 21 of 2017 — Sections 8–13 on health information, confidentiality of patient records and the conditions for disclosure.
• The Data Protection Act, No. 24 of 2019 and the Data Protection (General) Regulations, 2021 — processing of health data as sensitive personal data.
• The Social Health Insurance Act, No. 16 of 2023 — Social Health Authority (SHA) membership and claims data.
• The Computer Misuse and Cybercrimes Act, No. 5 of 2018 — unauthorised access to records.
• Kenya Medical Practitioners and Dentists Council (KMPDC) and Nursing Council of Kenya professional conduct rules for practitioners entering clinical data.

The patient is the data subject. The registered health facility that creates clinical entries is a data controller for the records it creates. AfyaApp acts as a data processor providing the technical platform, and as a controller only for account and security data needed to run the service.

• Patients aged 18 and above register with a valid Kenyan National ID number.
• For patients below 18 years, a birth certificate number is required and the account must be opened and operated by a parent or legal guardian.
• Health facilities must be licensed in Kenya and must submit a valid licence for verification before they can create clinical records.
• You are responsible for keeping your password and one-time codes confidential. Sharing login credentials is a breach of these terms.

Under the Health Act, 2017, the information contained in a health record belongs to the patient, while the record itself is held in trust by the health facility that created it. Clinical entries — diagnoses, prescriptions, lab results and uploaded documents — are append-only. They cannot be silently deleted, so the medical history remains a reliable clinical and legal record. Corrections are made by adding a corrective entry, and every entry carries the attending practitioner's name and licence number.

A patient who believes a record is inaccurate may request rectification through the facility that created it, and may escalate to the Office of the Data Protection Commissioner (ODPC).

• A health facility may only view a patient's records where the patient has granted consent on AfyaApp, where the facility created the record, or under the emergency provision in clause 6.
• Consent is specific, informed and may be revoked by the patient at any time from the patient portal.
• Revoking consent does not delete records already lawfully created, and does not undo lawful disclosures already made.

Section 11 of the Health Act, 2017 permits disclosure of health information without the patient's consent where it is necessary to prevent a serious threat to the health or life of the patient or another person. AfyaApp implements this as a break-glass action which:

• requires the practitioner to state a reason before access is granted;
• grants time-limited access only;
• is permanently logged with the facility, the user, the reason and the timestamp;
• is visible to the patient and to platform administrators for review.

Misuse of break-glass access may amount to an offence under Kenyan law and will result in suspension of the facility's account.

• Records are transmitted over encrypted connections and stored in access-controlled databases and private file storage.
• Access is enforced per-account: a facility can only reach the records it is entitled to under clause 5 or 6.
• Health records are retained in line with Kenyan health records retention practice — adult records for at least 6 years from the last entry, and records of minors until at least 6 years after they turn 18 — unless a longer period is required by law.
• Where personal data is stored or processed outside Kenya, it is done in line with Section 48 and 49 of the Data Protection Act, 2019.

Under Part V of the Data Protection Act, 2019 you may request to:

• be informed of the use of your personal data;
• access your personal data held on AfyaApp;
• have inaccurate or misleading data corrected;
• object to processing, or request deletion of data that is no longer required by law to be kept;
• lodge a complaint with the Office of the Data Protection Commissioner.

Where you add a Social Health Authority membership number, it is used only to link your visits, prescriptions and lab results to your cover. AfyaApp is not the SHA, does not decide benefits or claims, and does not guarantee that a claim will be honoured.

• Do not access, copy or share another person's health record without lawful basis.
• Do not upload false, defamatory or unlawful content.
• Do not attempt to bypass access controls, scrape data, or interfere with the platform.

AfyaApp is a records platform. It does not provide diagnosis or treatment and must not be relied on in a medical emergency. In an emergency, call your nearest health facility or emergency service immediately.

The service is provided on an "as available" basis. To the extent permitted by Kenyan law, AfyaApp is not liable for clinical decisions made by practitioners, for data entered incorrectly by a facility, or for loss arising from connectivity failures. Nothing in these terms excludes liability that cannot be excluded by law.

Accounts may be suspended where these terms are breached, where a facility's licence is not verified or lapses, or where access logs indicate misuse. Medical records are retained as required under clause 7 even after an account is closed.

These terms may be updated to reflect changes in Kenyan law or in the service. Material changes will be notified in the app, and continued use after the effective date is acceptance of the updated terms.

These terms are governed by the laws of Kenya and disputes are subject to the jurisdiction of the Kenyan courts. For privacy requests, security reports or questions about these terms, contact the app owner through the support channel shown in your portal.