Privacy Policy

1. Introduction

Zorvica Innovations Limited, trading as Afya1 Digital Health ("Afya1," "we," "us"), is the data controller for personal data collected through the Afya1 platform ("Platform"). This Privacy Policy explains what data we collect, why we collect it, how it is protected, and the rights you have over it.

Afya1 operates in compliance with the Kenya Data Protection Act, 2019, and applies the principles of the General Data Protection Regulation (GDPR) as an international best practice, given the sensitivity of the health information handled on the platform.

2. Information We Collect

From Patients

• Identity and contact details: name, phone number, email address, date of birth, and address.
• Health information: symptoms, consultation notes, prescriptions, and records relevant to the booked care.
• Payment information: processed by our payment partners; Afya1 does not store full card numbers.
• Location data: for home visits and hospital bedside care bookings, and to match nearby providers.

From Providers

• Identity and licensing documents: national ID, professional licence or registration number, and academic and training certificates.
• Background screening results obtained through our screening partner.
• Bank or M-Pesa payout details.
• Session activity: GPS check-in/check-out timestamps, shift activity logs, and session notes.

Automatically Collected

• Device, browser, and app usage information for security and to improve the platform.

3. How We Use Your Information

• To create and manage your account and verify provider credentials.
• To facilitate bookings, process payments, and hold funds in escrow.
• To enable GPS check-in, activity logging, and family updates during Hospital Bedside Care and Home Visit sessions.
• To operate the rating and review system.
• To communicate booking confirmations, reminders, and account notifications via SMS, email, or push notifications.
• To investigate disputes, misconduct reports, and safety concerns.
• To comply with legal, regulatory, and tax obligations.

4. Legal Basis for Processing

We process personal data on the basis of your consent (given at registration and reaffirmed at each booking), the necessity of processing to perform our contract with you, and our legitimate interests in operating a safe, trustworthy platform, alongside our legal obligations to regulators including the Office of the Data Protection Commissioner, the Kenya Medical Practitioners and Dentists Council, and the Kenya Nursing Council.

5. How We Protect Your Data

6. Data Retention

We retain account and booking data for as long as your account is active and as long as needed to meet legal and regulatory requirements. Provider application and verification documents are retained for five years after account closure, in accordance with applicable regulatory requirements. You may request an earlier deletion, as described in Section 8.

7. Who We Share Data With

We share personal data only where necessary with:

• Our background screening partner to verify provider suitability.
• Our payment processors (including M-Pesa/Safaricom Daraja and our card payment gateway) to process transactions.
• Relevant regulatory bodies for licence and registration verification.
• Law enforcement or courts, where required by law.

We do not sell personal data to third-party vendors.

8. Your Rights

Under the Kenya Data Protection Act, you have the right to:

• Access the personal data we hold about you.
• Correct inaccurate data.
• Request the deletion of your data and closure of your account, subject to legal retention requirements.
• Object to or restrict certain processing.
• Request a copy of your data in a portable format.

To exercise any of these rights, please contact us using the details provided in Section 12.

9. Cookies and Tracking Technologies

Our website uses cookies and similar tracking technologies to keep you signed in, remember your preferences, understand how the platform is used, and maintain security. Our mobile application uses comparable device-level identifiers for the same purpose. You can control cookies through your browser settings; disabling certain cookies may limit some website functionalities.

10. Data Breach Notification

In the event of a data breach affecting your personal data, Afya1 will notify the Office of the Data Protection Commissioner within 72 hours, as required by law, and will notify affected users if the breach is likely to result in a risk to their rights and freedoms.

11. International Data Transfers

Some of our infrastructure and service providers (for example, cloud hosting and payment processing) may store or process data outside Kenya. In such cases, we take steps to ensure that the receiving party provides an adequate level of protection for your data, consistent with the requirements of the Kenya Data Protection Act, 2019, including through contractual safeguards with our service providers.

12. Children's Data

The Platform is not intended for direct use by individuals under 18 years of age. When care is booked on behalf of a minor or dependent, the registering adult is responsible for the accuracy of the information provided and confirms that they have the authority to do so.

13. Changes to This Policy

We may update this Privacy Policy from time to time. Material changes will be communicated through the platform or by email, with the effective date updated accordingly.

14. Contact Us and Data Protection Officer

Zorvica Innovations Limited, trading as Afya1 Digital Health, Kisumu, Kenya, has designated a Data Protection Officer responsible for overseeing our data protection obligations.
For privacy queries, to exercise your data rights, or to contact our Data Protection Officer, please email privacy@afya1digital.com.