1. Who controls your data
AfyaIndex Kenya operates this service and determines how account, usage, support, and subscription data is processed. Privacy questions and rights requests may be sent to privacy@afyaindex.com.
2. Data we collect
- Account data: name, email address, telephone number, role, and authentication details.
- Professional or organisation data: profession, company details, PPB licence details, and institution seat information when supplied.
- Workspace data: bookmarks, search history, settings, discrepancy reports, and saved activity.
- Transaction data: plan, amount, payment status, and gateway reference. AfyaIndex does not store your M-Pesa PIN.
- Technical data: IP address, device/session identifiers, security logs, browser information, and a device cookie used to enforce guest limits.
3. Why we process it
We process data to create and secure accounts, provide the clinical workspace, remember user choices, prevent abuse, process subscriptions, respond to support, maintain audit trails, and improve service reliability. Depending on the activity, the legal basis is performance of a contract, compliance with law, consent, or our legitimate interest in operating and protecting the service.
4. Clinical searches
Medicine searches and bookmarks can reveal health interests even when they do not describe a diagnosis. Do not enter patient names, identification numbers, medical record numbers, or other patient-identifying information into free-text fields. AfyaIndex is a reference platform and is not intended to be a patient record system.
5. Who receives data
We disclose only what is needed to service providers supporting hosting, email, SMS, authentication, analytics, and payment processing; to an institution administering its seats; or to authorities where legally required. Providers act under contractual or legal safeguards. We do not sell personal data.
6. International processing
Some infrastructure providers may process data outside Kenya. Where this occurs, we use contractual, organisational, and technical safeguards appropriate to the transfer and the sensitivity of the information.
7. Retention and security
We retain data only for the service purpose, dispute handling, security, backup cycles, and applicable financial or legal recordkeeping periods. You can clear search history in your account. We use access controls, password hashing, HTTPS, audit logging, backups, and least-privilege administration, but no internet service can promise absolute security.
8. Your rights
Subject to Kenyan law, you may request information about processing, access your personal data, object to processing, ask for correction or deletion, withdraw consent where consent is the basis, and request restriction or portability where applicable. We may need to verify identity before acting. You may also raise a concern with Kenya’s Office of the Data Protection Commissioner.
9. Children and changes
The service is not directed to children. Students who are minors should use it only under appropriate institutional or guardian supervision. Material changes to this notice will be dated and, where appropriate, communicated in the service.