Ministry of Health

Government of Kenya

Date of Commencement: November 16, 2022

1. Introduction

This Privacy Policy describes the data that is collected by the Government of Kenya, Ministry of Health (MOH), Division of Community Health Services, through the electronic Community Health Information System (eCHIS), and how it is used and shared. The Ministry is committed to protecting the personal data collected and to maintain the trust of users. Users of this application are requested to read and understand this Policy.

2. Scope

This Privacy Policy applies to users of the eCHIS application, including those using the eCHIS application webpages, features and other services within the national and county jurisdictions of the Republic of Kenya. The eCHIS application is a digital solution developed to support quality community health service delivery in the Republic of Kenya by providing client-management with decision support, community-based surveillance, commodity management, performance management and automated data management processes and tools, messaging and eLearning capability. The users of the eCHIS application specifically are:

● Household members – these are individuals and families who receive community health services and whose data is collected by CHPs at household level.

● Community Health promoters (CHPs) – these are the individuals who access and use the eCHIS application in the community to collect data and make notes on community individuals as part of their contractual obligations with the Ministry of Health and county governments to provide quality community health services.

● Community Health Supervisors – these are Community Health Assistants/Officers who supervise Community Health Volunteers and can access the data collected by eCHIS application

● Community Health Managers – These are Sub County, County and National Community Health Coordinators and data managers who have access to data in eCHIS.

This Privacy Policy also governs data collected in connection with the use of the eCHIS application to improve the application.

All those who are subject to this Privacy Policy are referred to as ‘users’.

This Privacy Policy is subject to the laws applicable in the Republic of Kenya regarding data protection.

By using the eCHIS application in all its forms, the user agrees to the collection and use of information in accordance with this Privacy Policy.

3. Interpretation and Definitions

3.1 Interpretation

The following definitions shall have the same meaning regardless of whether they appear in singular or in plural.

3.2 Definitions

For the purposes of this Privacy Policy:

● Account means a unique account created for the user to access eCHIS or parts of the application

● Affiliate means an entity that is controlled or is under common control of the Ministry of Health, Republic of Kenya

● Application means the software program provided by the Ministry of Health downloaded by the user on any electronic device, named eCHIS.

● Ministry (referred to as either "the Ministry ", "We", "Us" or "Our" in this Privacy Policy) refers to the Ministry of Health, Afya House, Cathedral Road, P.O. Box:30016– 00100, Nairobi, Kenya.

● Country refers to The Republic of Kenya

● Device means any electronic gadget that can host eCHIS such as a computer, a cell phone or a digital tablet.

● Personal Data is any information that can be used to identify an individual

● eCHIS refers to a digital tool used in Community Health Service delivery in the Republic of Kenya

● Service Provider - refers to individuals involved in provision of community health services using eCHIS

● Usage Data - refers to data collected automatically, either generated by the use of the eCHIS or from the eCHIS infrastructure (for example, the duration of a page visit)

● User(s) - refers to all individuals who are subject to this Privacy Policy

● Community Health Workers - This is a member of the community selected to serve in a Community Health Unit or a person formally employed by the county government to provide community health services as prescribed in the Kenya Community Health Policy (2020 – 2030)

4. Data Collection

4.1 Personal Data

This is personally identifiable information which may include, but is not limited to user names, email addresses, phone numbers login name and password, profile picture, date of birth, gender, employment information.

Data on users in the community units will be collected for the purposes of providing quality community health services such as Full names (First, middle and last names), Date of birth, gender, details of household members, disability status, etc

4.2 Device and Usage Data

Usage Data is collected automatically when using the eCHIS. Usage Data may include information such as the Device's Internet Protocol address (e.g. IP address), browser type, browser version, the pages of eCHIS that the user will visit, the time and date of visit, the time spent on those pages, unique device identifiers and other diagnostic data.

When a user accesses eCHIS through a mobile device, the system may collect certain information automatically, including, but not limited to, the type of mobile device You use, your mobile device unique ID, the IP address of Your mobile device, your mobile operating system, the type of mobile Internet browser You use, unique device identifiers and other diagnostic data.

The system may also collect information that the browser sends whenever a user visits the eCHIS webpages or when it is accessed through a mobile device.

4.3 Location Data

While using eCHIS, the system may collect, with your prior permission, Information regarding your location. The information may be uploaded to the Ministry’s servers and/or a Service Provider's server or it may be simply stored on the user’s device. The user can enable or disable access to this information at any time, through the user’s device settings.

4.4 Use of Personal Data

The Ministry may use Personal Data for the following purposes:

● To manage user accounts and profile information that is used to create user accounts for eCHIS and user registration for community health units/individuals in the eCHIS. The personal data facilitates user access to different functionalities of eCHIS that are available to account users.

● Service Delivery –The information collected on household members whose data is collected for the purposes of providing quality community health service as undertaken in the performance of employment or contractual obligations with the Ministry.

● Communication – data will be used for communication purposes between the eCHIS users; To contact the user by email, telephone calls, SMS, or other equivalent forms of electronic communication, such as a mobile application's push notifications regarding updates or informative communications related to the functionalities of eCHIS, including the security updates, when necessary or reasonable for their implementation.

● Research – data that is collected may be used for testing and evaluation of the eCHIS for system enhancements to improve user experience, to identify usage trends, to develop new services and features, development of (new) research and analysis.

● To provide and maintain eCHIS, to ensure the application operates optimally including to monitor the usage of eCHIS application.

● To manage user requests: To attend and resolve the requests and forwarded to the Ministry.

● Legal requirements: In pursuant to legal requirements and regulations User information may be used for other purposes, such as data analysis, we may share Your personal information in the following situations:

● With Affiliates: We may share user information with Our affiliates in which case we will require those affiliates to honor this Privacy Policy.

● With user’s consent: We may disclose Your personal information for any other purpose with the user’s consent.

5 Retention of Personal Data

The Ministry will retain users' Personal Data only for as long as is necessary for the purposes set out in this Privacy Policy. We will retain and use users' Personal Data to the extent necessary to comply with our legal obligations (for example, if we are required to retain your data to comply with applicable laws), resolve disputes, and enforce our legal agreements and policies.

The Ministry will also retain Usage Data for internal analysis purposes. Usage Data is generally retained for a short period of time, except when this data is used to strengthen the security or to improve the functionality of eCHIS, or We are legally obligated to retain this data for longer time periods.

6. Transfer of the Personal Data

User information, including Personal Data, is processed at the Ministry of Health, Afya House or any other places where the parties involved in the processing of eCHIS data are located.

The Ministry will take all steps reasonably necessary to ensure that all users data is treated securely and in accordance with this Privacy Policy and no transfer of Personal Data will take place to an organization or a country unless there are adequate controls in place including the security of personal data and other collected information.

7. Deleting Personal Data

Users have the right to delete or request that We assist in deleting the Personal Data that We have collected about them.

A user may update, amend, or delete personal user information at any time by signing in to the personal User Account, and visiting the account settings section that allows you to manage your personal information. A user may also contact Us to request access to, correct, or delete any personal information that you have provided to Us. Please note, however, that We may need to retain certain information when we have a legal obligation or lawful basis to do so.

8. Disclosure of the Personal Data

Circumstances under which personal data may be disclosed include the following:

8.1 Law enforcement

Under certain circumstances, the Ministry may be required to disclose Your Personal Data if required to do so by law or in response to valid requests by public authorities (e.g. a court or a government agency).

8.2 Other legal requirements

The Ministry may disclose Your Personal Data if such action is necessary to:

● Comply with a legal obligation

● Protect and defend the rights or property of the Ministry

● Prevent or investigate possible wrongdoing in connection with the eCHIS

● Protect the personal safety of Users of the eCHIS or the public

● Protect against legal liability

9. Security of Personal Data

The security of users Personal Data is important to Us, but remember that no method of transmission over the Internet, or method of electronic storage is 100% secure. The Ministry will put in place measures that are humanly and technologically possible to ensure the security of data is enforced. While the Ministry will strive to use commercially acceptable means to protect these Personal Data, we cannot guarantee its absolute security.

10. Changes to this Privacy Policy

We may update Our Privacy Policy from time to time. We will notify Users of any changes by posting the new Privacy Policy on this page. We will let users know via email and/or a prominent notice on eCHIS application, prior to the change becoming effective and update the "Last updated" date at the top of this Privacy Policy. You are advised to review this Privacy Policy periodically for any changes. Changes to this Privacy Policy are effective when they are posted on this page.

11. Contact Us

If you have any questions about this Privacy Policy, you can contact us:

● By email: servicedesk@health.go.ke