Privacy Policy

AfyaPonea is a healthcare navigation platform operated in Kenya. We help patients find hospitals, doctors, and healthcare services, compare prices, check SHA/NHIF coverage, and book appointments. Contact us at: support@afyaponea.com Website: afyaponea.com

We collect the following categories of information: A) Information you give us directly: - Your name and phone number when booking an appointment - Your email address when contacting us or signing up - Symptoms or health descriptions when using AfyaAI - Photos of hospital bills, lab results and prescriptions that you send to our scan tools (used for the analysis only, not kept) - Reviews you write about hospitals or doctors - Your KMPDC licence number if you apply as a doctor - Your hospital details if you claim a hospital listing B) Information collected automatically: - Your approximate location (only when you use "Near me" — we never store this) - Pages you visit on AfyaPonea - Device type and browser (for improving the site) - Search queries you make on the platform C) Information we do NOT collect: - Your national ID number - Your SHA/NHIF membership number - Your medical records or diagnosis - Your payment card details (payments go directly via M-Pesa)

We use your information only for the following purposes: - To connect you with hospitals and doctors you search for - To process appointment bookings on your behalf - To power AfyaAI symptom responses (your symptoms are processed by Claude AI and are not stored permanently) - To analyse the bills, lab results and prescriptions you send, and show you the result. They are processed by Claude AI and are not stored - To verify doctor and hospital listings before they go live - To send you booking confirmations via SMS or email - To improve our platform based on how people use it - To contact you if you submitted a claim or doctor application We do NOT use your information for: - Selling to third parties - Insurance underwriting or risk scoring - Targeted advertising - Any purpose you did not consent to

Health data is the most sensitive category of personal data under the Kenya Data Protection Act 2019. We treat it with the highest level of care. - Symptoms you describe to AfyaAI are processed in real time and are not stored in our database after your session ends - Photos and text you send to the bill scanner, lab results and prescription check tools are used only to produce your result. We do not store them and we do not add them to any database - We never share individual health information with any third party without your explicit consent - We never use your health data for advertising or profiling If you are a patient who has booked an appointment, your name and phone number are shared only with the specific hospital you booked with, for the sole purpose of confirming your appointment.

We share your information only in these limited circumstances: - With the hospital or doctor you book an appointment with (name and phone only) - With Supabase (our database provider) who stores data securely on our behalf under strict data processing agreements - With Anthropic (the company behind Claude AI) when you use AfyaAI — your message is sent to their API to generate a response. Anthropic's privacy policy applies to this processing. - With Vercel (our hosting provider) for serving the website - With law enforcement or regulators if required by Kenyan law We do not sell, rent, or trade your personal information to any third party for commercial purposes.

AfyaPonea uses minimal tracking: - We use anonymous analytics to understand which pages are popular and how people use the site. This does not identify you personally. - On hospital pages we count page views, call taps and direction taps as daily totals per hospital. To avoid counting one visitor twice we use a one-way hash that changes every day and is deleted after two days. We do not store your IP address, and we honour your browser's Do Not Track setting. - Photos of bills, lab results and prescriptions, and typed bill details, are sent to our AI provider (Anthropic) only to produce your result. We do not keep the photo after the analysis. Lab results and prescriptions are health information, so only send what you are comfortable sharing, and remember the result is general information that never replaces your doctor. - To help you in an emergency when you have no signal, your phone keeps the last five hospitals you looked at (name, address and phone number) and a short visit counter. This stays on your phone only, is never sent to us, and you can clear it from the offline page or by clearing your browser data - We do not use advertising cookies or tracking pixels - We do not use Facebook Pixel, Google Ads tracking, or similar advertising tools - If you use the "Near me" feature, your browser requests your location — we use this to show nearby hospitals and do not store your coordinates You can disable cookies in your browser settings without affecting your ability to use AfyaPonea.

We keep your data only as long as necessary: - Appointment bookings: kept for 2 years for hospital coordination purposes, then deleted - Doctor applications: kept for 1 year after the application is processed, then deleted - Hospital claim submissions: kept for 2 years, then deleted - AfyaAI conversations: not stored beyond your current session - Bill, lab result and prescription photos: not stored, only processed to produce your result - Analytics data: kept in aggregated, anonymous form indefinitely You can request deletion of your data at any time by emailing support@afyaponea.com.

As a Kenyan resident, you have the following rights: - Right to be informed — you have the right to know what data we hold about you (this policy fulfils that) - Right of access — you can request a copy of all personal data we hold about you - Right to rectification — you can ask us to correct inaccurate data - Right to erasure — you can ask us to delete your data ("right to be forgotten") - Right to object — you can object to us processing your data for certain purposes - Right to data portability — you can request your data in a portable format - Right to withdraw consent — where processing is based on consent, you can withdraw it at any time To exercise any of these rights, email us at support@afyaponea.com. We will respond within 21 days as required by law. You also have the right to lodge a complaint with the Office of the Data Protection Commissioner (ODPC) at odpc.go.ke if you believe we have mishandled your data.

We take the security of your data seriously: - All data is transmitted over encrypted HTTPS connections - Our database (Supabase) uses Row-Level Security — meaning each user can only access their own data - We do not store payment information — M-Pesa payments are handled directly by Safaricom - Our staff do not have access to your health descriptions or bill contents - We use industry-standard security practices and conduct regular reviews Despite these measures, no system is completely secure. If you believe your data has been compromised, contact us immediately at support@afyaponea.com.

AfyaPonea is not directed at children under 13. We do not knowingly collect personal information from children under 13. If you are a parent or guardian and believe your child has provided us with personal information, please contact us at support@afyaponea.com and we will delete it promptly. Parents may use AfyaPonea to book appointments for their children — in this case, the parent's contact information is used and the child's health information is subject to the same protections described in this policy.

AfyaPonea contains links to external websites including hospital websites, sha.go.ke, kmpdc.go.ke, and others. We are not responsible for the privacy practices of these external sites. We recommend reading the privacy policy of any external site you visit from AfyaPonea.

We may update this privacy policy from time to time. When we make significant changes we will: - Update the "Last updated" date at the top of this page - Post a notice on the AfyaPonea homepage for 30 days - Email registered users if the changes materially affect how we use their data Continued use of AfyaPonea after changes are posted constitutes acceptance of the updated policy.

For any privacy-related questions, requests, or complaints: Email: support@afyaponea.com Website: afyaponea.com Response time: within 21 days For urgent data protection matters or to report a potential data breach, email us with "URGENT DATA" in the subject line and we will respond within 72 hours.