Draft, pending legal review. Highlighted items are still to be confirmed.
This policy explains how Kas-Annex Medical Center ("Afyatel", "we") collects, uses, shares and protects your personal data when you use the Afyatel mobile app. We handle your data under the Kenya Data Protection Act, 2019 and its regulations. Health data is "sensitive personal data" under that Act, and we treat it with the highest level of care.
In short: we use your information to connect you with healthcare providers and to run the services you ask for. We never sell your data and never use your health information for advertising.
1. Who we are
The data controller is Kas-Annex Medical Center, Ground Floor, Commons Apartments, Mwiki Road, Roysambu, Kasarani, Nairobi, Kenya, registered with the Office of the Data Protection Commissioner (ODPC) under registration number ODPC REG. NO.. Contact our data protection officer at support.afyatel@gmail.com.
Healthcare providers on Afyatel (doctors, clinical officers, nurses, pharmacists, laboratories) are independent licensed professionals. When they create clinical records about you (consultation notes, prescriptions, lab results) they are also responsible for those records under their professional duty of confidentiality.
2. Who can use Afyatel
Afyatel is for people aged 18 and over. A parent or guardian may use their own account to seek care for a child; that information is held on the parent's account. If we learn we have collected data from someone under 18 without a guardian, we will delete it.
3. The data we collect
| Category | Examples | Where it comes from |
|---|---|---|
| Account details | Name, email, phone number, photo, role (patient or provider), country / region | You, at sign-up |
| Profile details | Date of birth, sex, partial ID number, emergency contact name and phone | You |
| Health information | Weight, height, BMI, blood group, allergies, long-term conditions (for example HIV, TB, diabetes, hypertension), vital signs, medicines and dose history, consultation notes, diagnoses (including whether a diagnosis is a notifiable disease), prescriptions, lab orders and results, wellness group membership | You, and the providers you consult |
| Messages and files | Chats with providers, group and support chats, photos, videos and documents you attach, prescriptions you upload, and locations you choose to send in a chat | You and the people you chat with |
| Payments | M-Pesa phone number, amount, what it was for, M-Pesa receipt number and status. We never see your M-Pesa PIN. If you choose to pay through SHA or an insurer: the scheme or insurer and your member number | You and Safaricom |
| Location | Your device location while the app is open, if you allow it; the address and map pin you set for a home visit, lab sample collection or medicine delivery; a point you choose on the map to search from | Your device, you |
| Community content | Posts, comments, likes, reviews, ratings, feedback | You |
| Provider details | Licence number, cadre, regulatory board, certificate, specialty, years of experience, facility and address, fees, availability, payout details. Ambulance services: operating permit number, service name, emergency phone and base location | Providers |
| Technical | Push notification token; counts of ad views and taps (not linked to your health data) | Your device |
We do not collect your contacts, SMS, call logs, other installed apps, or your location in the background, and the app contains no third-party analytics or advertising trackers.
4. Why we use it, and our legal basis
| Purpose | Legal basis (Data Protection Act 2019) |
|---|---|
| Create and secure your account | Performance of our contract with you |
| Connect you with providers, book consultations, chat, and share your health record with the providers you choose | Your explicit consent, and processing by or under the responsibility of a healthcare provider bound by confidentiality (s.46) |
| Medication reminders and adherence tracking | Your explicit consent (you can switch reminders off) |
| Process M-Pesa payments, provider payouts and receipts; record that a booking or order is to be billed to SHA or your insurer | Contract; legal obligation (tax and financial records) |
| Verify that providers are licensed | Legitimate interest in patient safety; legal obligation |
| Show nearby providers | Consent (device location permission) |
| Send a nurse, lab courier or delivery rider to the place you pin | Your explicit consent (you set the pin for each request); contract |
| Report notifiable diseases to public health authorities, as monthly counts by condition, facility and sub-county that do not name you | Legal obligation (Public Health Act, Cap. 242) |
| Send important service notices, such as an outbreak alert | Legitimate interest in public health and the safety of our users |
| Run the community feed and groups, and moderate content | Contract; legitimate interest in a safe community |
| Customer support and service messages | Contract; legitimate interest |
| Show house ads for health businesses | Legitimate interest. Ads are not chosen using your health data or profile |
| Meet legal duties and handle disputes | Legal obligation; legal claims |
You can withdraw consent at any time in the app or by writing to us. Withdrawing consent does not affect processing already done, and some features (for example consultations) cannot work without it.
5. Who we share it with
Providers you choose. When you book, message or pay a provider, that provider can see your profile and health record so they can care for you. Pharmacies see the prescriptions sent to them, the delivery address and map pin you set (which they may pass to their delivery rider), and how you chose to pay. Laboratories see the tests ordered for you and the place you set for sample collection; your results go to you and to the provider who ordered the test. If you choose to pay through SHA or an insurer, the provider you booked sees the scheme and member number you entered so that they can bill it.
Service providers who work for us, under written contracts that require them to protect your data and use it only on our instructions:
| Service provider | What they do | Location |
|---|---|---|
| Supabase Inc. | Database, sign-in, file storage and server functions | United States |
| Safaricom PLC (M-Pesa Daraja) | Processes M-Pesa payments (receives phone number and amount) | Kenya |
| Africa's Talking | Sends SMS notifications when a push notification cannot be delivered (receives phone number and message) | Kenya |
| Expo (650 Industries Inc.) | Delivers push notifications (receives device token and notification text) | United States |
| Google LLC (Google Maps) | Displays maps and places near you | United States / global |
| Resend (Plus Five Five, Inc.) | Sends sign-in codes and account emails (receives your email address and the message) | United States |
Authorities, when the law requires it: for example a court order, a regulator such as KMPDC or the Pharmacy and Poisons Board, the Ministry of Health for notifiable-disease reporting (counts only, without your name), or to protect someone's life in an emergency.
We do not sell your personal data, and we do not share it with advertisers or employers. We do not send your data to insurers ourselves.
6. Transfers outside Kenya
Our main database is hosted by Supabase in the United States, and some other service providers also process data outside Kenya (see the table above). We only transfer data where the Data Protection Act allows it: with appropriate safeguards in our contracts, and, for health data, with your explicit consent, which you give at sign-up. You can ask us for details of the safeguards.
Because Afyatel supports health care for people in Kenya, we also keep an accurate, up-to-date copy of your data in a data centre in Kenya (Kenyan data centre provider), as the Data Protection (General) Regulations, 2021 require.
7. How long we keep it
| Data | How long |
|---|---|
| Account and profile | Until you delete your account, then removed within 30 days |
| Clinical records written by providers (notes, prescriptions, lab results) | For the period required by Kenyan health records law and professional rules, currently X years: confirm with legal adviser, then deleted |
| Payment records | 5 years, as required by the Tax Procedures Act, 2015 |
| Chats and attachments | Until you delete your account, then deleted |
| Prescriptions you upload to a pharmacy | Kept with the order as the pharmacy's dispensing record, for the period pharmacy law requires |
| Posts and comments | Deleted when you delete your account |
| Backups | Overwritten within 7 days |
8. How we protect it
- All data is encrypted in transit (TLS) and at rest by our hosting provider.
- Row-level security rules in our database make sure a patient's record is visible only to them, to providers they have booked or messaged, and to authorised Afyatel staff.
- Staff access is limited to what their role needs, and is logged.
- Payment PINs are entered only on your phone's M-Pesa prompt; we never see or store them.
- If a breach puts your data at risk, we will notify the ODPC within 72 hours and tell you without delay, as the Act requires.
9. Your rights
Under the Data Protection Act you have the right to:
- be told how your data is used (this policy);
- access your personal data and get a copy of it;
- correct data that is wrong or incomplete;
- delete your data (subject to the retention rules in section 7);
- object to processing, or withdraw your consent;
- receive your data in a portable format (data portability);
- complain to the Office of the Data Protection Commissioner (www.odpc.go.ke).
To use these rights, email support.afyatel@gmail.com or use the in-app options. We reply within 14 days (Data Protection (General) Regulations, 2021). To delete your account, go to Profile → Privacy & legal → Delete account, or follow the steps at https://afyatel.africa/delete-account.html.
10. Permissions on your phone
- Location (only while the app is open): to show providers near you, to pin where a home visit, sample collection or delivery should come, and for providers to pin their facility. You can say no and still search by name or pick a point on the map.
- Photos and files: only the items you pick, to share with your provider, attach a prescription or post. The app does not use your camera or microphone.
- Notifications: appointment, chat and medication reminders. You can turn them off in Settings.
11. Medical disclaimer
Afyatel is a platform that connects you with independent licensed providers. It is not a medical device and does not diagnose or treat. It is not an emergency service. In an emergency, call 999 or 112.
12. Changes to this policy
We will tell you in the app before any important change takes effect. The date at the top shows the latest version.
13. Contact us
Kas-Annex Medical Center, Ground Floor, Commons Apartments, Mwiki Road, Roysambu, Kasarani, Nairobi, Kenya. Data protection officer: support.afyatel@gmail.com. Support: support.afyatel@gmail.com.