Privacy and data protection notice

Organizational draft. Team HEALATHTECH should have a Kenyan data-protection lawyer review this document before relying on it. This is not a formal legal opinion.

This notice explains how Team HEALATHTECH ("we") handles personal data for ChaguoAI. It is written for clients, community health workers, and partners. It is an organizational draft for a Kenyan lawyer to review.

Who is responsible

The data controller is Team HEALATHTECH, operating ChaguoAI.

• Email: team@chaguoai.com
• Physical address: to be completed by the organization
• ODPC registration number: to be added by the organization once confirmed

The Kenya Data Protection Act, 2019 requires data controllers to register with the Office of the Data Protection Commissioner where that duty applies. We will publish the registration number here after the organization confirms it. We are not stating a number we do not have.

What this service is

ChaguoAI supports contraceptive counselling. It is used on WhatsApp and USSD. World Health Organization Medical Eligibility Criteria are applied as rules before any generated language. A community health worker reviews the recommendation and confirms the choice with the client.

ChaguoAI is not a diagnosis, a prescription, or an emergency service. If someone may be pregnant with complications, is bleeding heavily, or is in danger, they should seek a clinic or emergency care and not wait for a chat reply.

What we process

In the counselling flow we process the information the programme needs for eligibility and counselling. That can include:

• intake answers such as age, pregnancy history, medical-history flags, and method preferences
• messages sent during the session
• the channel (WhatsApp or USSD)
• the recommendation packet reviewed by a community health worker, which may include eligibility notes and a discontinuation-risk annotation for the health worker

The exact fields are limited to what the programme collects for eligibility and counselling. We do not ask for a name or phone number on the public consent page. A consent acknowledgement, if recorded, stores only a random id, the time, and the policy version. It does not store a health record.

Health data is sensitive personal data under the Data Protection Act. We treat counselling content as sensitive.

Why we process it

We process this data to:

• provide contraceptive counselling decision support
• let a health worker review and confirm a choice
• follow up where that is needed for safety
• operate, secure, and improve the running of the service

We do not sell personal data. We do not use it for advertising. We do not use client counselling conversations to train public AI models. That is a commitment this product must honor.

We keep data for a stated purpose. We do not reuse counselling records for a new purpose that does not fit that purpose, unless the law allows it or the person agrees.

How software makes suggestions

Eligibility is checked with rules (WHO Medical Eligibility Criteria) before any generated language. A model may annotate discontinuation risk for the health worker only. That annotation does not override eligibility. Generated wording can be wrong or incomplete. A person should not rely on the chat alone. A recommendation is not a decision by software alone: a health worker confirms the choice.

Who sees the data

• The community health worker counselling that person
• Team HEALATHTECH staff who need access to operate the service
• Channel providers required to deliver the message: Twilio for WhatsApp, and Africa's Talking for USSD

Those providers carry the channel. They are not clinical decision makers. We do not name other vendors here.

WhatsApp is a third-party application with its own terms. Using the chat means messages are processed to provide the service. The operator of WhatsApp may handle messages under those terms.

Transfers outside Kenya

Twilio and Africa's Talking may process messages on infrastructure outside Kenya. The Data Protection Act restricts transfers of personal data outside Kenya unless the transfer meets the Act's conditions, including appropriate safeguards where those are required.

Team HEALATHTECH is responsible for putting those arrangements in place and recording them. This notice does not claim that a particular transfer contract is already signed. The organization should complete that record and, if needed, describe it here after legal review.

How long we keep it

Programme records are kept only as long as needed for counselling, safety follow-up, and service operation. The organization will publish the specific retention period once operations confirm it. We are not stating a number of years in this draft.

When the period ends, the organization should delete or de-identify the data, except where a longer hold is required by law or by a clinician's duty to keep a safety record.

How we protect it

We limit staff access to people who need it for their role. We use access controls on the systems that store counselling and programme data. We do not sell data.

This notice does not claim a certification. We do not claim ISO 27001, HIPAA, or any other certification.

No online service can promise perfect security. If you believe your information was exposed, email team@chaguoai.com.

Children

The service is for people seeking contraceptive counselling who can consent for themselves. We do not knowingly collect personal data from children. We do not run a flow aimed at children. If you believe a child has used ChaguoAI, email team@chaguoai.com. We will stop further messages and delete what we are allowed to delete. This notice does not state an age of medical consent, because that is a legal question for a Kenyan lawyer and the clinical context.

Your choices and rights

Under the Data Protection Act you can, subject to the Act:

• ask what personal data we hold about you, and ask for a copy (access)
• ask us to correct data that is wrong or incomplete
• ask us to delete personal data
• object to processing
• withdraw consent

To use these rights, email team@chaguoai.com. We may need enough detail to find the right record without collecting a new health history in that email. Please do not send clinical photographs or a full medical history unless we ask for something specific to locate the record.

Withdrawing consent stops further optional messaging. It does not erase a record a clinician must keep for safety. We will explain what we can delete and what we must keep.

You can also complain to the Office of the Data Protection Commissioner (ODPC) in Kenya. The ODPC is the national regulator for personal data. Its public website is https://www.odpc.go.ke.

Consent page

Before using the counselling flow, a person can open the consent page, read this explanation, and accept a version of it. The address of that page is /consent on this website. The page is meant to be pasted into WhatsApp. Accepting shows the document version, the date and time, and a random acknowledgement id. We do not store a name, phone number, or health record as part of that acceptance.

Changes

If we change this notice, we will update the version and the date on this page. If a change affects how counselling data is used, we will not pretend the old consent covers a new purpose.

Contact

Team HEALATHTECH / ChaguoAI
Email: team@chaguoai.com
Physical address: to be completed by the organization