Privacy Policy

AfyaForce Limited ("AfyaForce", "we", "us", "our") is the data controller for personal data processed through the AfyaForce Platform. We are registered in Kenya and operate in accordance with the Kenya Data Protection Act 2019.

From Healthcare Providers

• Identity data: Full name, date of birth, national ID / passport number
• Professional data: License number, certifications, employment history, specialties
• Contact data: Email address, phone number, physical address
• Financial data: M-Pesa number, bank account details, KRA PIN for tax purposes
• Location data: GPS coordinates when clocking in/out of shifts
• Usage data: Shift history, ratings, app interactions, device information

From Facilities

• Organisation data: Facility name, registration number, operating licences
• Contact data: Names and contact details of authorised users
• Billing data: Payment methods, invoicing details, spend history
• Operational data: Shift postings, provider reviews, department structure

• To verify your identity and professional credentials
• To match providers with suitable shifts based on location, availability, and skills
• To process payments and payouts via M-Pesa and bank transfer
• To send shift notifications, confirmations, and reminders
• To comply with legal obligations including tax reporting (NHIF, PAYE, KRA)
• To improve the Platform through anonymised analytics
• To investigate complaints, disputes, and safety incidents

We process your personal data on the following legal bases: (a) contract performance — to provide the services you have signed up for; (b) legitimate interests — to improve our Platform and prevent fraud; (c) legal obligation — to comply with Kenyan tax, employment, and healthcare regulations; and (d) consent — where you have given specific consent, such as for marketing communications.

We share your data with: (a) Facilities — when you apply for or accept a shift, your professional profile and credentials are visible to that facility; (b) Payment processors — M-Pesa (Safaricom) and banking partners for payment processing; (c) Regulatory bodies — the Nursing Council of Kenya or other licensing authorities where required by law; (d) Cloud infrastructure providers — our data is stored on secure servers. We do not sell your personal data to third parties for marketing purposes.

We retain your personal data for as long as your account is active, plus 7 years thereafter to comply with Kenyan tax and employment laws. GPS location data is retained for 90 days. You may request deletion of non-legally-required data at any time.

Under the Kenya Data Protection Act 2019, you have the right to: access your personal data; correct inaccurate data; request deletion of your data (subject to legal retention requirements); object to processing for direct marketing; and withdraw consent where processing is based on consent. To exercise these rights, contact us at privacy@afyaforce.com.

We implement industry-standard security measures including AES-256 encryption for data at rest, TLS 1.3 for data in transit, multi-factor authentication for all account access, and regular third-party security audits. In the event of a data breach that affects your rights, we will notify you and the Office of the Data Protection Commissioner within 72 hours.

Data Protection Officer: privacy@afyaforce.com AfyaForce Limited.