Privacy Policy
Compliance with the Kenya Data Protection Act, 2019 and safeguarding learner records.
Last reviewed: October 2026 • Effective for all registered learners and institutional partners.
1. Legislative Framework & Scope
Afya1 Academy (operated by Zorvica Innovations Limited) processes personal data in strict compliance with the Kenya Data Protection Act, 2019 (KDPA) and regulations issued by the Office of the Data Protection Commissioner (ODPC).
This Privacy Policy applies to all learners, training applicants, corporate team sponsors, and educators utilizing the Afya1 Academy platform, public website, and associated Student Information System (SIS).
2. Lawful Basis for Processing
We collect and process personal data exclusively under lawful bases defined by Section 30 of the KDPA: performance of a training contract, compliance with legal obligations, legitimate interest in professional credentialing, and explicit consent provided through unticked checkboxes.
Data collected includes full legal names, national identification numbers (where required for regulatory licensing), telephone numbers, email addresses, academic background, and attendance/examination logs.
3. Data Security & Retention
Academic transcripts and issued certificate hashes are maintained in encrypted records to enable lifetime credential verification by employers and regulatory councils.
Financial transaction identifiers from M-Pesa are retained for statutory accounting periods. We never store credit card numbers or PIN codes.
4. Your Data Subject Rights
Under Section 26 of the KDPA, learners have the right to be informed, access personal data, object to processing, request correction of false data, and request deletion where retention is no longer legally mandated.
To exercise your rights or contact our Data Protection Officer, email privacy@afya1digital.com with your student registration number.