Mama Care Safeguards at a Glance
Select your role to view a quick summary of how your information is protected.
Your pregnancy details, ANC visit dates, diagnostic results, and SMS reminders are strictly confidential and encrypted (AES-256). We never sell your health data or use it for commercial profiling. You can request a copy or deletion of your records at any time.
1. Who We Are
Mama Care Technologies Ltd.("we", "us", "our") operates Mama Care, a specialized maternal healthcare platform serving expectant mothers, community health workers (CHWs), clinical staff, and healthcare facility administrators across Kenya.
We are registered with the Office of the Data Protection Commissioner (ODPC) as a data controller and data processor under the Kenya Data Protection Act, 2019 (Act No. 24 of 2019).
2. What Data We Collect
We adhere strictly to the principle of data minimisation under Section 25 of the DPA, collecting only personal information necessary for providing safe, high-quality maternal healthcare.
Mothers & Expectant Patients
- Full name, date of birth, national ID / passport
- Phone number and village / sub-county location
- Gestational age, EDD, parity, & pregnancy history
- ANC visit notes, clinical diagnoses, and referrals
- Obstetric danger signs and emergency dispatch alerts
- SMS and WhatsApp appointment communications
Clinicians & Community Workers
- Full name, professional license number, MFL facility code
- CHW ID and assigned community catchment zone
- System audit logs (records accessed, timestamps)
- Encrypted login credentials and role permissions
- App telemetry, operating system, and security logs
3. Why We Collect Your Data
| Purpose | Description & Practical Application |
|---|---|
| Maternal Care Delivery | Enabling clinicians and CHWs to coordinate antenatal visits, monitor vital signs, and maintain continuous care profiles. |
| Reminders & Alerts | Sending SMS and WhatsApp notifications for upcoming ANC appointments and critical danger signs. |
| Emergency Obstetric Care | Routing urgent alerts to emergency health teams when life-threatening complications occur during labor or pregnancy. |
| Public Health Reporting | Submitting anonymised, aggregated metrics to the Ministry of Health via DHIS2 for national maternal health indicators. |
| Platform Security | Auditing access logs to detect and prevent unauthorized entry into sensitive clinical records. |
4. Lawful Bases for Processing
Under Section 30 of the Kenya Data Protection Act, every processing activity must have a defined legal basis:
5. Data Protection Principles
Your health data is never sold, leased, or shared with commercial advertisers or third-party data brokers. All data operations are governed by Section 25 of the DPA: lawful, transparent, purpose-bound, and accurate.
6. Who We Share Data With
| Recipient | Data Shared | Purpose & Legal Safeguard |
|---|---|---|
| Assigned Facility Clinicians | Full Maternal Clinical Profile | Continuity of clinical care |
| Community Health Workers | Visit Schedule & Contact Info | Home visitation & ANC follow-up |
| Ministry of Health / DHIS2 | Anonymised Metrics | National health statistics & reporting |
| SMS & Messaging Gateways | Encrypted Phone Number & Text | Appointment reminders via DPA Data Processing Agreements |
7. Cross-Border Data Transfers
Mama Care utilizes enterprise cloud hosting provided by Hetzner Cloud Infrastructure in EU (Germany). Data stored outside Kenya is bound by Standard Contractual Clauses (SCCs) and Data Processing Agreements ensuring security standards equivalent to or higher than the Kenya Data Protection Act.
8. Retention Periods
9. Your Data Rights
Under Section 26 of the Kenya Data Protection Act, you possess clear rights regarding your personal health data:
Exercise Your Rights Online
Submit an official Data Rights Request. We process and respond within 7 calendar days.
10. Technical & Organisational Security
11. Maternal Minors & Consent
In accordance with Section 33 of the DPA and Kenyan maternal health guidelines, where a pregnant patient is under 18 years of age, consent is managed with heightened privacy protections. Emergency care processing to protect the vital interests of the young mother or child proceeds immediately without administrative delay.
12. Data Breach Incident Response
In the event of a security breach affecting personal health data, Mama Care notifies the ODPC within 72 hours and informs affected data subjects without undue delay, outlining mitigation steps taken.
13. Policy Revisions
Material updates to this policy are communicated via SMS or in-app notification before taking effect. Continued use of the platform constitutes acknowledgment of the revised governance framework.
14. Contact Us & ODPC Escalation
For inquiries, rights requests, or privacy concerns, reach our Data Protection team directly:
If you are unsatisfied with our response, you may escalate your complaint to the Data Commissioner: