Privacy Policy

1. Who We Are

Sahili Mind Technologies Limited ("Sahili Mind", "we", "our", or "us") is a company incorporated in Kenya (Registration No. PVT/000000). We operate the Sahili Mind platform — a practice management SaaS for licensed mental health practitioners in Kenya — accessible at app.sahilimind.co.ke and via our mobile applications.

Our registered address is: Sahili Mind Technologies Limited, 14th Floor, Westend Towers, Waiyaki Way, Westlands, Nairobi, Kenya.

Data Protection Officer: dpo@sahilimind.co.ke

2. Data We Collect

2.1 Practitioner Account Data

When you register as a practitioner, we collect:

• Full legal name and professional title
• Email address and phone number (used for login and notifications)
• KCPB licence number and registration details
• Payment information (processed via Safaricom M-Pesa or card processor — Sahili Mind does not store card numbers)
• Professional profile details you choose to enter (qualifications, specialisations, practice location)

2.2 Patient Health Information (PHI)

As a practitioner, you store patient records within Sahili Mind. This may include:

• Patient name, date of birth, identification numbers, contact details
• Clinical notes, assessment responses, diagnoses (ICD-10 codes)
• Appointment history and session records
• Wearable and SMS/USSD check-in data
• Outcome measurement scores
• Insurance information for SHA/NHIF claims

You are the Data Controller for your patients' data. Sahili Mind acts as a Data Processor on your behalf. You are responsible for obtaining valid consent from your patients before entering their data into Sahili Mind, consistent with your obligations under the DPA 2019 and your professional code of ethics.

2.3 Usage and Technical Data

• Log data (IP addresses, browser type, pages visited, timestamps)
• Device information (device type, operating system)
• Aggregated, anonymised usage statistics for product improvement

3. How We Use Your Data

3.1 Lawful Basis

Under the DPA 2019, we process personal data on the following lawful bases:

• Contract performance — to deliver the Sahili Mind service you have subscribed to.
• Legal obligation — to comply with KRA eTIMS requirements, tax laws, and regulatory reporting.
• Legitimate interests — to improve our product, detect fraud, and ensure platform security (always balanced against your rights).
• Consent — for marketing communications (you may withdraw consent at any time).

3.2 Specific Uses

• Providing and maintaining the Sahili Mind platform
• Processing M-Pesa payments and generating KRA eTIMS invoices
• Submitting SHA/NHIF insurance claims on your behalf
• Sending appointment reminders and system notifications via SMS
• Providing customer support
• Sending product updates (practitioners may opt out at any time)

4. Data Storage and Security

4.1 Encryption

All patient health information (PHI) stored in Sahili Mind is encrypted at rest using AES-256-GCM encryption. Data is also encrypted in transit using TLS 1.3.

4.2 Storage Location

Sahili Mind stores data on servers hosted within the African Union region (specifically in data centres located in Kenya and South Africa). We do not transfer patient health data outside the AU without explicit data transfer agreements compliant with DPA 2019 cross-border transfer requirements.

4.3 Access Controls

Access to patient data is controlled by our role-based access control (RBAC) system. Sahili Mind staff access to production data is strictly limited, audited, and requires approval. All data access events are logged in an append-only audit trail.

4.4 Retention

We retain practitioner account data for the duration of your subscription plus 7 years (required by Kenyan tax and professional regulations). You may request deletion of your account after this retention period. Patient records are retained in accordance with your instructions as Data Controller and applicable health record retention regulations (minimum 5 years under Kenya health regulations).

5. Data Sharing

Sahili Mind does not sell your data or your patients' data to third parties under any circumstances.

We share data only in these limited circumstances:

• KRA eTIMS — Invoice data (practitioner details, transaction amounts) is submitted to the Kenya Revenue Authority as required by law.
• SHA / NHIF — Claims data is shared with the Social Health Authority as instructed by you when submitting claims.
• Safaricom — Phone numbers and transaction references are shared with Safaricom M-Pesa for payment processing.
• Africa's Talking — Phone numbers are shared for SMS delivery (appointment reminders, check-in messages). Africa's Talking is bound by a data processing agreement.
• Legal requirements — We may disclose data if required by a valid court order or statutory authority in Kenya.

6. Your Rights Under DPA 2019

As a data subject, you have the right to:

• Access — request a copy of personal data we hold about you
• Rectification — correct inaccurate data
• Erasure — request deletion (subject to retention obligations)
• Data portability — receive your data in a structured, machine-readable format
• Objection — object to processing based on legitimate interests
• Restriction — request restriction of processing in certain circumstances

To exercise any of these rights, email: dpo@sahilimind.co.ke. We will respond within 21 days as required by the DPA 2019.

7. Cookies

The Sahili Mind marketing website uses only essential cookies required for the site to function. We use one analytics cookie (privacy-preserving, anonymised) to understand aggregate traffic. No advertising or tracking cookies are used on this site.

The Sahili Mind application (app.sahilimind.co.ke) uses session cookies required for authentication. These are strictly necessary and cannot be disabled without breaking the service.

8. Children

Sahili Mind is not directed at individuals under 18. We do not knowingly collect personal data from minors without parental or guardian consent. Practitioners who treat minors are responsible for obtaining appropriate consent as per DPA 2019 and their professional obligations.

9. Changes to This Policy

We may update this Privacy Policy from time to time. Material changes will be communicated via email to all registered practitioners at least 14 days before taking effect. Continued use of Sahili Mind after that date constitutes acceptance of the updated policy.

10. Contact

For privacy-related queries or to exercise your rights under DPA 2019:

• Email: dpo@sahilimind.co.ke
• Post: Data Protection Officer, Sahili Mind Technologies Limited, 14th Floor, Westend Towers, Waiyaki Way, Westlands, Nairobi, Kenya

You also have the right to lodge a complaint with the Office of the Data Protection Commissioner (ODPC) if you are not satisfied with our response: www.odpc.go.ke.