Legal

1. Who we are

SasaAfya BioMed Limited (“SasaAfya,” “we,” “us”) is a Kenyan health technology company that provides connected health devices and a digital platform linking patients, caregivers, doctors, and clinics for the monitoring and management of chronic conditions. This policy explains what personal data we collect across our apps and website, why we collect it, how we protect it, and the rights you have over it under Kenyan law.

[Registered office address to be inserted once confirmed.]

2. The law this policy is built on

This policy is written to comply with the Constitution of Kenya, 2010 (Article 31, the right to privacy), the Data Protection Act, 2019, the Digital Health Act, 2023 and its 2024 Health Information Management Regulations, and the Office of the Data Protection Commissioner's Guidance Note on the Processing of Health Data. Under this framework, health data is classified as sensitive personal data, alongside categories like biometric data and genetic data, and is subject to stricter rules than ordinary personal data.

3. Data we collect

From all users: full name, phone number, email address, and a password or authentication credential. If you sign in with Google, we receive your name, email address, and profile photo from Google under its own terms.

From patients: health readings from your SasaAfya devices (glucose, blood pressure, ketone, and continuous glucose readings), your prescription history, appointment records, messages exchanged with your care team, and billing and payment records, including M-Pesa transaction details when you pay through the app. If you submit an insurance claim, we also hold your insurer's name and policy number. We also record usage data about your device itself, such as how often it's used and how many test strips or consumables it has gone through, so we can anticipate when you'll need a resupply.

From caregivers: your relationship to the patient or patients you support, and the health data of the patient(s) you are linked to, shared only where the patient (or someone legally authorized to consent on their behalf) has agreed to that link.

From doctors and clinics: professional documents submitted during onboarding, including medical license documentation and clinic registration or business documents, a profile photo, and, for clinics, the physical location of your facility, which you provide by searching for or pinning your address during onboarding.

Automatically: device/session identifiers needed to keep you securely signed in. Our web application uses a secure, encrypted session cookie for this purpose. We do not currently use analytics, advertising, or tracking cookies on our apps or website.

4. Why we collect it, and our lawful basis

We process health data because doing so is necessary to provide you with monitoring, telemedicine, and care coordination services, which is the specific health-sector basis the Data Protection Act permits for health data processed by or on behalf of a healthcare provider. Where we rely on your consent, for example, linking a caregiver to your account, that consent is freely given, specific, informed, and can be withdrawn at any time by contacting us or adjusting your in-app settings. We keep a record of consent given for the sharing of health data, as required under Kenyan guidance for the health sector.

We are clear that data protection consent (permission to process and share your data) is separate from medical consent (your agreement to a specific treatment or procedure). Giving one does not automatically give the other, and we seek each separately where required.

We also use the frequency and pattern of your device readings for an operational purpose distinct from clinical monitoring: estimating how many test strips or other consumables your device has used, so we, or your clinic, can tell when you are due for a resupply and arrange replacement before you run out. This use is limited to consumption and usage patterns; it does not involve reviewing the clinical content of a reading (for example, the glucose value itself) for this purpose.

5. Who we share it with

We share data with the doctor or clinic you are enrolled with, so they can review your readings and provide care. We share data with caregivers you have linked to your account, and only to the extent you've authorized. We use the following processors to operate our services: [cloud hosting/storage provider name] for secure data storage, Google, for account sign-in if you choose that option, and Safaricom's M-Pesa payment rails for processing payments; SasaAfya does not receive or store your M-Pesa PIN. We do not sell personal data, and we do not share health data with third parties for marketing or research purposes without your separate, explicit consent.

We may disclose data where required by law, including to the Office of the Data Protection Commissioner, a court, or another authority with lawful power to compel it.

6. Where your data is stored

Your data is stored with our cloud infrastructure provider [outside Kenya / region to be confirmed]. Because Kenyan law restricts transferring personal data outside the country unless the receiving location has adequate data protection safeguards or an appropriate legal agreement is in place, we [maintain / are putting in place] contractual protections with our hosting provider to meet this requirement.

7. How long we keep it

We keep personal data only as long as necessary for the purpose it was collected for, and not indefinitely. [SasaAfya's specific retention period, e.g., for how long after a patient stops using the service, or after death, data is retained, to be inserted here.]

8. Your rights

Under Kenyan law, you have the right to be told how your data is used, to access the personal data we hold about you, to request correction of inaccurate data, to request deletion of your data where there is no lawful reason for us to keep it, to object to certain processing, and to withdraw consent at any time. To exercise any of these rights, contact us at [privacy contact email/phone].

9. Keeping your data safe

We apply access controls so only authorized personnel and your care team can view your data, encryption of stored documents and files, and secure, encrypted storage of your sign-in credentials on your device. We are working toward full compliance with Kenya's data protection-by-design requirements as our platform matures.

10. If something goes wrong

If we become aware of a data breach affecting your personal data, we will notify the Office of the Data Protection Commissioner within 72 hours, as Kenyan law requires, and notify you directly within a reasonable period if your data was affected and you can be identified.

11. Children's data

[Our policy on minors' data is being finalized and will be published here before this document goes live.]

12. Our regulatory status

[SasaAfya's Office of the Data Protection Commissioner registration status will be confirmed and published here.]

13. Changes to this policy

We may update this policy as our services change. We'll post the updated version here with a new “last updated” date, and where changes are significant, we'll notify you directly.

14. Contact us

For any question about this policy or your data, contact: [privacy contact email], [physical/postal address].

1. Acceptance of these terms

By creating an account, using a SasaAfya device, or accessing any SasaAfya app or website, you agree to these Terms of Service and to our Privacy Policy. If you are creating or managing an account on behalf of a minor, as a parent, legal guardian, or authorized caregiver, you agree to these terms on that person's behalf and are responsible for that account's use.

2. What SasaAfya is

SasaAfya BioMed Limited (“SasaAfya,” “we,” “us”) is a Kenyan technology company. We provide connected health monitoring devices and a software platform that lets patients share health readings with doctors and clinics, communicate with their care team, and coordinate care remotely.

SasaAfya is a technology platform, not a healthcare provider. Doctors and clinics who use SasaAfya are independent practitioners and institutions responsible for their own clinical judgment, diagnoses, treatment decisions, and prescriptions. SasaAfya does not practice medicine, does not employ the doctors or clinics you interact with through the platform unless specifically stated otherwise, and is not a party to the clinical relationship between you and your care provider.

3. Accounts and eligibility

SasaAfya supports four types of account: patient, caregiver, doctor, and clinic. Doctor and clinic accounts require verification of professional credentials or facility registration before they can access patient data.

Where a patient is a minor too young to hold a smartphone or manage their own care independently, their account and data are accessed solely through a verified parent or legal guardian's caregiver account. A parent or legal guardian may authorize an older minor, generally from around age 15, to hold and operate their own account directly once the guardian judges the minor capable of managing their own device and data. In that case, the guardian who authorized the account remains responsible for that authorization, even though the minor operates the account day to day.

You are responsible for keeping your login credentials secure and for all activity under your account.

4. Medical disclaimer

SasaAfya devices and software are intended to support ongoing monitoring and communication with your care team. They are not a substitute for professional medical judgment, and they are not designed for use in a medical emergency.

If you are experiencing a medical emergency, a reading you believe is life-threatening, or symptoms that need immediate attention, contact local emergency services or go to the nearest hospital immediately. Do not wait for a response through the SasaAfya app.

Any advice, consultation, or prescription you receive through SasaAfya comes from the independent doctor or clinic you are connected with, not from SasaAfya itself. SasaAfya is not responsible for the clinical accuracy of any diagnosis, treatment decision, or prescription made by a doctor or clinic using our platform.

5. Devices

SasaAfya's health monitoring devices, including glucometers and blood pressure monitors, are registered and certified for use in Kenya under the Kenya Pharmacy and Poisons Board, and hold FDA 510(k) clearance and CE IVDR certification.

You agree to use SasaAfya devices as instructed in the accompanying product materials, and to inform your care team of any device malfunction or unexpected reading.

6. Payments and billing

Device purchases and any subscription fees are billed through the payment method you provide, including M-Pesa. SasaAfya does not store your M-Pesa PIN. [Refund and cancellation policy, e.g. window for returns, subscription cancellation terms, to be confirmed and inserted before publishing.]

If you submit a claim through your health insurer using information from SasaAfya, that claim is subject to your insurer's own terms, and SasaAfya is not responsible for your insurer's coverage decisions.

7. Prescriptions

SasaAfya's platform allows a doctor to record and share prescription information with you. Dispensing of any medication remains subject to the applicable pharmacy's own verification process and Kenyan pharmaceutical law. SasaAfya does not dispense medication directly.

8. Caregiver access

If you are a patient, you may authorize one or more caregivers to view your health data and communicate with your care team on your behalf. You can review and revoke caregiver access at any time in your account settings. If you are a caregiver, your access is limited to the patients who have authorized you, or, for a minor in your care, to the extent of your legal guardianship.

9. Acceptable use

You agree not to use SasaAfya to impersonate another person, to access another user's account or data without authorization, to submit false medical or professional credential information, to reverse-engineer or interfere with the platform's operation, or to use the platform for any unlawful purpose.

10. Intellectual property

The SasaAfya name, logo, software, and device designs are the property of SasaAfya BioMed Limited. Nothing in these terms grants you rights to our intellectual property beyond what's needed to use the service as intended.

11. Data protection

Our collection, use, and protection of your personal and health data is governed by our Privacy Policy, which is incorporated into these terms by reference and reflects our obligations under Kenya's Data Protection Act, 2019 and Digital Health Act, 2023.

12. Disclaimers and limitation of liability

SasaAfya's platform and devices are provided on an “as available” basis. To the fullest extent permitted under Kenyan law, SasaAfya is not liable for indirect, incidental, or consequential damages arising from your use of the platform, including damages arising from a third-party doctor or clinic's clinical decisions, a delay or failure in data transmission due to network conditions outside our control, or your failure to seek emergency care when needed. Nothing in this section limits liability that cannot lawfully be excluded, including liability for death or personal injury caused by our own negligence.

13. Indemnification

You agree to indemnify SasaAfya against claims arising from your misuse of the platform, your violation of these terms, or false information you provide, including false professional credentials submitted by a doctor or clinic account.

14. Suspension and termination

We may suspend or terminate an account that violates these terms, provides false credential information, or poses a risk to other users' safety or data. You may close your account at any time; certain health records may be retained after closure as described in our Privacy Policy.

15. Governing law and disputes

These terms are governed by the laws of Kenya. Any dispute arising from these terms or your use of SasaAfya will first be addressed through good-faith negotiation, and if unresolved, through the courts of Kenya or another dispute resolution mechanism SasaAfya designates, such as arbitration.

16. Changes to these terms

We may update these terms as our services evolve. Continued use of SasaAfya after an update means you accept the revised terms. Where changes are significant, we will notify you directly.

17. Contact

Questions about these terms can be directed to [legal/support contact email].