Privacy Policy

In this Privacy Policy, the following terms shall have the meanings set out below unless the context otherwise requires:

• "Personal Data" means any information relating to an identified or identifiable natural person, including but not limited to names, email addresses, phone numbers, identification documents, professional license numbers, biometric data, location data, and financial information.
• "Processing" means any operation or set of operations performed on Personal Data, whether or not by automated means, such as collection, recording, organisation, structuring, storage, adaptation or alteration, retrieval, consultation, use, disclosure by transmission, dissemination or otherwise making available, alignment or combination, restriction, erasure, or destruction.
• "Data Controller" refers to Africa Medics as the entity that determines the purposes and means of processing Personal Data.
• "Data Processor" refers to any third party that processes Personal Data on behalf of Africa Medics.
• "Clinician" means any healthcare professional, including but not limited to medical doctors, dentists, clinical officers, nurses, midwives, pharmacists, pharmaceutical technologists, laboratory technicians, radiographers, physiotherapists, occupational therapists, nutritionists, public health officers, and community health workers who register on or use the Platform.
• "Facility" means any hospital, clinic, medical centre, diagnostic laboratory, pharmacy, health centre, or other healthcare institution that registers on or uses the Platform to post job openings or hire clinicians.
• "Agency" means any healthcare staffing agency, recruitment firm, or workforce management company that uses the Platform to manage clinician rosters, fill job openings, or facilitate healthcare staffing.
• "Sensitive Personal Data" means data revealing racial or ethnic origin, political opinions, religious or philosophical beliefs, trade union membership, genetic data, biometric data for uniquely identifying a natural person, data concerning health, or data concerning a natural person's sex life or sexual orientation.

We collect information that you provide directly, information collected automatically through your use of the Platform, and information obtained from third-party sources.

2.1 Information You Provide Directly

• Account Registration Data: Full legal name (first name and last name), email address, phone number (including M-Pesa mobile number), password (stored in hashed format), county or region of residence, and user role (Clinician, Facility, or Agency).
• Professional Profile Data (Clinicians): Professional title, medical specialty or cadre, professional regulatory body (e.g., KMPDC, Nursing Council of Kenya, Clinical Officers Council, Pharmacy & Poisons Board, Kenya Medical Laboratory Technicians and Technologists Board), registration or license number, years of experience, educational qualifications, curriculum vitae (CV), passport-sized photograph, and preferred engagement type (Locum, Permanent, or Locum-to-Perm).
• Facility Profile Data: Facility name, facility type (hospital, clinic, diagnostic lab, pharmacy, health centre), physical address, county, contact person name, official email, phone number, and KRA PIN or business registration number.
• Agency Profile Data: Agency name, company registration number, physical address, county, contact person name, official email, phone number, and areas of staffing specialisation.
• Job Posting Data: Job title, description, required profession and specialty, county and location, engagement type, shift start and end dates, shift times (day/night/both), compensation amount (KES), and number of available positions.
• Application and Shift Data: Job applications submitted, shift assignments accepted, shift completion confirmations, attendance records, performance notes, and any feedback or ratings provided.
• Communications Data: Messages sent and received through the Platform's in-app messaging system, support requests, feedback forms, and any other correspondence with Africa Medics or other Platform users.
• Financial and Payment Data: M-Pesa mobile number for payout purposes, bank account details (if provided), payment history, invoices, and payout confirmation receipts.

2.2 Information Collected Automatically

• Device and Browser Information: IP address, browser type and version, operating system, device type (desktop, mobile, tablet), screen resolution, unique device identifiers, and mobile network information.
• Usage Data: Pages visited, features used, search queries entered, buttons clicked, time spent on pages, navigation paths, login and logout timestamps, error logs, and interaction patterns with the Platform.
• Location Data: Approximate geographic location derived from your IP address, and precise GPS location if you explicitly grant location permissions through your device or browser settings.
• Cookies and Similar Technologies: Session cookies, persistent cookies, local storage data, and other tracking technologies as described in Section 9 of this Policy.

2.3 Information from Third-Party Sources

• Professional Regulatory Bodies: We may verify your professional credentials by cross-referencing information you provide with publicly available databases maintained by KMPDC, the Nursing Council of Kenya, the Clinical Officers Council, the Pharmacy & Poisons Board, and other healthcare regulatory authorities in Kenya and East Africa.
• Payment Service Providers: Transaction confirmation data from Safaricom M-Pesa, bank transfer confirmations, and payment gateway records from our integrated payment processing partners.
• Analytics Providers: Aggregated and anonymised usage analytics from third-party analytics platforms to help us understand user behaviour and improve the Platform experience.

We process your Personal Data for the following purposes:

• Account Creation and Management: To create, maintain, and administer your user account on the Platform; to authenticate your identity when you log in; and to manage your profile settings and preferences.
• Service Delivery: To match clinicians with suitable job openings based on profession, specialty, location, and engagement preferences; to facilitate job applications, shift assignments, and shift confirmations; and to enable communication between clinicians and facilities through the Platform.
• Payment Processing: To process payroll and payout transactions via M-Pesa or bank transfer; to generate invoices and payment receipts; and to maintain accurate financial records for accounting and tax purposes.
• Professional Verification: To verify clinician credentials, licenses, and regulatory standing with official healthcare regulatory bodies in Kenya and East Africa, ensuring patient safety and regulatory compliance.
• Platform Improvement and Analytics: To analyse usage patterns and trends; to identify and fix technical issues, bugs, and errors; to develop new features and functionality; to optimise Platform performance and user experience; and to conduct A/B testing and usability research.
• Communications: To send transactional emails and notifications (such as account confirmations, shift alerts, payment confirmations, and system updates); to send marketing communications and promotional offers (with your consent where required by law); and to respond to your support requests and enquiries.
• Safety and Security: To detect, prevent, and respond to fraud, abuse, security incidents, and other harmful activity; to enforce our Terms of Service and community standards; and to protect the rights, property, and safety of Africa Medics, our users, and the public.
• Legal and Regulatory Compliance: To comply with applicable laws, regulations, and legal processes in Kenya and other jurisdictions where we operate; to respond to lawful requests from law enforcement and government authorities; and to establish, exercise, or defend legal claims.
• Research and Statistical Analysis: To conduct anonymised and aggregated research on healthcare workforce trends, staffing patterns, and market dynamics in East Africa, contributing to the improvement of healthcare delivery in the region.

We process your Personal Data on the following legal bases, as applicable under the Kenya Data Protection Act, 2019 and other applicable data protection laws:

• Consent: Where you have given us explicit consent to process your data for specific purposes, such as receiving marketing communications, enabling location tracking, or sharing your profile with potential employers. You may withdraw your consent at any time by contacting us or adjusting your account settings.
• Contractual Necessity: Where processing is necessary for the performance of our contract with you, including the creation and management of your account, the facilitation of job matching and shift assignments, and the processing of payments.
• Legal Obligation: Where processing is necessary for compliance with a legal obligation to which Africa Medics is subject, including tax reporting, regulatory filings, and response to court orders or regulatory demands.
• Legitimate Interests: Where processing is necessary for the legitimate interests of Africa Medics or a third party, provided that such interests are not overridden by your fundamental rights and freedoms. Our legitimate interests include preventing fraud, ensuring platform security, improving our services, and conducting business analytics.
• Vital Interests: Where processing is necessary to protect the vital interests of a data subject or another natural person, such as in emergency healthcare situations.
• Public Interest: Where processing is necessary for the performance of a task carried out in the public interest, particularly in relation to healthcare workforce management and patient safety.

We do not sell your Personal Data to third parties. We may share your information in the following circumstances:

• With Healthcare Facilities and Agencies: When you apply for a job or accept a shift assignment, we share relevant profile information (such as your name, professional qualifications, regulatory status, and contact details) with the hiring facility or managing agency to facilitate the staffing process.
• With Clinicians: When a facility posts a job opening, limited facility information (such as facility name, location, and job description) is made visible to clinicians who may apply.
• With Service Providers: We engage trusted third-party service providers who perform services on our behalf, including cloud hosting and infrastructure providers, payment processing partners (including Safaricom M-Pesa), email and SMS delivery services, analytics and monitoring tools, and customer support platforms. These service providers are contractually obligated to process your data only as instructed by us and to implement appropriate security measures.
• With Regulatory Authorities: We may share clinician credential information with healthcare regulatory bodies (such as KMPDC, NCK, and PPB) for the purpose of verifying professional licenses and ensuring compliance with healthcare regulations.
• For Legal and Safety Reasons: We may disclose your information if we believe in good faith that such disclosure is necessary to comply with applicable law or respond to valid legal process (such as a court order or subpoena); to protect the safety, rights, or property of Africa Medics, our users, or the public; to detect, prevent, or address fraud, security, or technical issues; or to enforce our Terms of Service or other agreements.
• In Business Transfers: In the event of a merger, acquisition, reorganisation, sale of assets, or bankruptcy, your Personal Data may be transferred to the acquiring entity or successor, subject to the terms of this Privacy Policy.
• With Your Consent: We may share your information with third parties when you have given us explicit consent to do so.

We retain your Personal Data for as long as necessary to fulfil the purposes for which it was collected, including to satisfy any legal, accounting, or reporting requirements. Specific retention periods include:

• Active Account Data: Retained for the duration of your account's active status, plus 24 months following account closure or deactivation to allow for account reactivation or dispute resolution.
• Financial and Payment Records: Retained for a minimum of seven (7) years from the date of the transaction, in accordance with the Kenya Income Tax Act and other applicable financial reporting requirements.
• Professional Verification Records: Retained for the duration of your account's active status, plus 36 months following account closure, to maintain audit trails and support regulatory compliance.
• Communications and Messaging Data: Retained for 24 months from the date of the communication, unless required for longer retention for legal or compliance purposes.
• Usage and Analytics Data: Anonymised and aggregated analytics data may be retained indefinitely for research and statistical purposes. Identifiable usage logs are retained for 12 months.
• Legal and Compliance Records: Retained for as long as necessary to comply with legal obligations or to establish, exercise, or defend legal claims, which may extend beyond the standard retention periods described above.

Upon expiry of the applicable retention period, your Personal Data will be securely deleted or irreversibly anonymised.

We implement industry-standard technical and organisational security measures to protect your Personal Data against unauthorised access, alteration, disclosure, or destruction. These measures include:

• Encryption: All data transmitted between your device and our servers is encrypted using TLS 1.2 or higher (HTTPS). Sensitive data at rest, including passwords and financial information, is encrypted using AES-256 encryption.
• Access Controls: Role-based access controls (RBAC) ensure that only authorised personnel can access Personal Data. Administrative access to production systems requires multi-factor authentication (MFA).
• Password Security: User passwords are hashed using bcrypt with industry-standard salt rounds. We never store passwords in plain text and do not have the ability to retrieve your original password.
• Infrastructure Security: Our Platform is hosted on secure, ISO 27001-certified cloud infrastructure with regular security audits, penetration testing, and vulnerability assessments.
• Network Security: Firewalls, intrusion detection and prevention systems (IDS/IPS), and DDoS protection mechanisms are deployed to safeguard our network infrastructure.
• Employee Security: All Africa Medics employees and contractors who have access to Personal Data are subject to confidentiality obligations and receive regular data protection training.
• Incident Response: We maintain a comprehensive data breach response plan that includes procedures for identifying, containing, and mitigating data breaches; notifying affected individuals and relevant authorities within the timelines required by applicable law; and conducting post-incident reviews to prevent recurrence.

While we take all reasonable precautions to protect your data, no method of electronic transmission or storage is 100% secure. We cannot guarantee absolute security, and you acknowledge that you transmit data to us at your own risk.

Under the Kenya Data Protection Act, 2019 and other applicable data protection laws, you have the following rights in relation to your Personal Data:

• Right of Access: You have the right to request confirmation of whether we process your Personal Data and, if so, to obtain a copy of that data along with information about how it is processed.
• Right to Rectification: You have the right to request the correction of inaccurate or incomplete Personal Data. You can update most of your profile information directly through your dashboard settings.
• Right to Erasure (Right to be Forgotten): You have the right to request the deletion of your Personal Data, subject to certain legal exceptions (such as our obligation to retain financial records for tax purposes).
• Right to Restriction of Processing: You have the right to request the restriction of processing of your Personal Data in certain circumstances, such as when you contest the accuracy of the data or when you object to processing based on legitimate interests.
• Right to Data Portability: You have the right to receive your Personal Data in a structured, commonly used, and machine-readable format and to request the transmission of that data to another data controller.
• Right to Object: You have the right to object to the processing of your Personal Data on grounds relating to your particular situation, where the processing is based on legitimate interests or public interest. You also have the right to object at any time to the processing of your Personal Data for direct marketing purposes.
• Right to Withdraw Consent: Where we process your data based on your consent, you have the right to withdraw that consent at any time. Withdrawal of consent does not affect the lawfulness of processing carried out before the withdrawal.
• Right to Lodge a Complaint: You have the right to lodge a complaint with the Office of the Data Protection Commissioner (ODPC) in Kenya if you believe that your data protection rights have been violated.

To exercise any of these rights, please contact us using the contact details provided in Section 18 of this Policy. We will respond to your request within 30 days of receiving it.

Our Platform uses cookies and similar tracking technologies to enhance your browsing experience, analyse usage patterns, and deliver relevant content. The types of cookies we use include:

• Strictly Necessary Cookies: These cookies are essential for the operation of the Platform. They enable core functionality such as authentication, session management, and security features. These cookies cannot be disabled without affecting the functionality of the Platform.
• Performance and Analytics Cookies: These cookies collect anonymised information about how visitors use the Platform, such as which pages are visited most frequently, how long users spend on each page, and whether users encounter error messages. This information helps us improve the Platform's performance and user experience.
• Functionality Cookies: These cookies allow the Platform to remember choices you make (such as your preferred language, region, or display settings) and provide enhanced, more personalised features.
• Marketing Cookies: These cookies are used to track visitors across websites to deliver advertising that is relevant and engaging. We currently do not deploy third-party marketing cookies, but we reserve the right to do so in the future with appropriate notice and consent mechanisms.

You can manage your cookie preferences through your browser settings. Most browsers allow you to block or delete cookies, although doing so may affect the functionality of the Platform. For more information about cookies and how to manage them, visit www.aboutcookies.org.

Africa Medics is headquartered in Nairobi, Kenya, and our primary data processing operations are conducted within Kenya. However, as we expand our services across East Africa (including Uganda, Tanzania, Rwanda, Burundi, and South Sudan) and use cloud infrastructure providers with global operations, your Personal Data may be transferred to, stored, or processed in countries outside of Kenya.

Where we transfer your Personal Data to a country outside Kenya, we will ensure that appropriate safeguards are in place, including:

• Ensuring the receiving country provides an adequate level of data protection as determined by the Office of the Data Protection Commissioner (ODPC).
• Implementing Standard Contractual Clauses (SCCs) or other approved contractual mechanisms to ensure appropriate data protection standards.
• Obtaining your explicit consent for the transfer where required by applicable law.
• Implementing additional technical and organisational measures to ensure the security of your data during and after the transfer.

The Africa Medics Platform is designed for use by licensed healthcare professionals, healthcare facilities, and staffing agencies. Our Platform is not directed at, and we do not knowingly collect Personal Data from, children under the age of 18 years.

If we become aware that we have inadvertently collected Personal Data from a child under 18, we will take immediate steps to delete such data from our systems. If you believe that a child under 18 has provided us with Personal Data, please contact us immediately using the contact details provided in Section 18.

Our Platform may contain links to third-party websites, services, or applications that are not operated by Africa Medics. These may include links to healthcare regulatory body websites, payment service provider portals, social media platforms, and other external resources.

We are not responsible for the privacy practices, security measures, or content of these third-party services. We encourage you to review the privacy policies of any third-party services you access through links on our Platform before providing them with your Personal Data.

Africa Medics uses Safaricom's M-Pesa mobile money platform as the primary payment channel for clinician payouts. In connection with M-Pesa transactions, we process the following data:

• Your M-Pesa-registered phone number (used as your payout destination).
• Transaction amounts, dates, and reference numbers for each payout.
• M-Pesa transaction confirmation receipts and status codes.

We do not store your M-Pesa PIN or access credentials. All payment transactions are processed through secure, encrypted channels in compliance with Safaricom's M-Pesa API security standards and the Central Bank of Kenya's payment system regulations.

Your M-Pesa transaction data is shared with Safaricom only to the extent necessary to process your payout. We retain payment records for a minimum of seven (7) years in compliance with Kenya's tax and financial reporting laws.

As a platform that facilitates healthcare staffing, we are committed to ensuring compliance with applicable healthcare regulations in Kenya and East Africa. This includes:

• Verifying the professional credentials and licensing status of clinicians who register on the Platform, using data provided by the clinician and, where available, cross-referencing with official regulatory databases.
• Maintaining records of clinician qualifications, regulatory body affiliations, and license numbers as required by the Kenya Medical Practitioners and Dentists Council (KMPDC), the Nursing Council of Kenya (NCK), the Clinical Officers Council (COC), the Pharmacy and Poisons Board (PPB), and the Kenya Medical Laboratory Technicians and Technologists Board (KMLTTB).
• Cooperating with healthcare regulatory authorities in connection with investigations, audits, or compliance inquiries related to clinicians registered on the Platform.
• Ensuring that patient safety standards are upheld by facilitating the deployment of only appropriately credentialed and licensed healthcare professionals.

Africa Medics has appointed a Data Protection Officer (DPO) to oversee compliance with this Privacy Policy and applicable data protection laws. The DPO is responsible for:

• Monitoring compliance with the Kenya Data Protection Act, 2019 and other applicable data protection legislation.
• Advising Africa Medics on data protection impact assessments (DPIAs) and other privacy-related matters.
• Serving as the primary point of contact for data subjects and the Office of the Data Protection Commissioner (ODPC).
• Managing and responding to data subject access requests and other rights-related enquiries.

You may contact our Data Protection Officer at:

We may update this Privacy Policy from time to time to reflect changes in our data processing practices, legal requirements, or business operations. When we make material changes to this Policy, we will:

• Post the updated Privacy Policy on this page with a revised "Last Updated" date at the top.
• Notify you by email or through a prominent notice on the Platform at least 14 days before the changes take effect, where the changes materially affect the way we process your Personal Data.
• Where required by applicable law, obtain your consent to the updated Privacy Policy before continuing to process your Personal Data under the new terms.

We encourage you to review this Privacy Policy periodically to stay informed about how we protect your data. Your continued use of the Platform after the effective date of an updated Privacy Policy constitutes your acceptance of the updated terms.

This Privacy Policy shall be governed by and construed in accordance with the laws of the Republic of Kenya, including the Data Protection Act, 2019 and the Constitution of Kenya, 2010 (particularly Article 31, which guarantees the right to privacy).

Any disputes arising out of or in connection with this Privacy Policy shall be resolved as follows:

• Informal Resolution: We encourage you to contact us first to attempt to resolve any privacy-related complaints or disputes informally. We will make every reasonable effort to address your concerns promptly and fairly.
• Mediation: If informal resolution is not successful, either party may refer the dispute to mediation under the rules of the Chartered Institute of Arbitrators (Kenya Branch).
• Regulatory Complaint: You have the right to lodge a complaint with the Office of the Data Protection Commissioner (ODPC) at any time, regardless of whether you have pursued informal resolution or mediation.
• Jurisdiction: Any legal proceedings arising from this Privacy Policy shall be brought exclusively before the courts of Kenya, with venue in Nairobi.

If you have any questions, concerns, or requests regarding this Privacy Policy or our data processing practices, please contact us using the following details: