Effective Date: 19th August 2026 · Last Updated: August 2026
This Privacy Policy explains how personal information is collected, used, stored, protected and shared through the Mtoto Afya Digital Wallet/Tool ("Mtoto Afya").
Mtoto Afya is designed to support child registration, growth monitoring, immunisation monitoring and, subject to applicable approvals and programme phases, referrals, follow-ups and public-health reporting.
Because Mtoto Afya primarily concerns children and processes health information, we recognise that much of the information handled through the Tool requires a particularly high level of protection.
This Policy should be read together with any specific privacy notice or consent information presented to parents, guardians, Community Health Promoters ("CHPs") or other users when information is collected.
The precise roles of the organisations participating in Mtoto Afya must be determined according to the relevant deployment and data-processing activity.
Depending on the approved governance arrangements, the data controller or joint controllers may include:
Where Tiny Totos processes information solely on instructions from another organisation, Tiny Totos may instead act as a data processor.
Before production deployment or exchange of identifiable information between organisations, the applicable controller/processor responsibilities should be documented.
The applicable privacy notice provided at the point of collection will identify the organisation responsible for the relevant processing.
Mtoto Afya may process information relating to:
A. Information about children
Depending on the approved implementation, we may collect:
Identity and biographical information
Location and daycare information
Health information
This may include:
Health information is treated as sensitive personal data and receives enhanced protection.
B. Parent/Guardian and Next-of-Kin Information
We may collect:
We will not collect information about a parent or guardian merely because it might be useful in future. Collection must be connected to an identified purpose.
C. CHP and Authorised User Information
We may collect:
Information may be collected:
Where information comes from another system, appropriate safeguards must be used to prevent duplicate or incorrect child records.
Children deserve enhanced protection when their information is processed.
Where consent is the lawful basis relied upon for processing a child's personal or health information, we will obtain the required consent from a parent, guardian or other legally authorised person.
Parental/guardian consent must be:
A daycare manager, CHP or other person must not provide consent on behalf of a child's parent or guardian unless that person has lawful authority to do so.
Where a parent or guardian is not present during a daycare visit, the child's information must not automatically be collected merely because the child is present.
If another lawful basis permits or requires processing without parental/guardian consent, that basis must be identified and documented by the responsible data controller.
Where appropriate, information should also be explained to the child in language and a manner suitable for the child's age and level of understanding.
Subject to the applicable lawful basis, we may process information to:
Personal information will not be used for purposes incompatible with the purpose for which it was collected unless another lawful basis exists and required notices or permissions have been provided.
The applicable lawful basis will depend on the processing activity and the organisation acting as data controller.
It may include, where permitted by applicable law:
Because children's health information is sensitive personal data, an appropriate condition for processing sensitive personal data must also apply.
We will not rely on a generic acceptance of this Privacy Policy as a substitute for specific parental/guardian consent where the law requires such consent.
We seek to collect only information that is adequate, relevant and reasonably necessary for the approved purpose.
Mtoto Afya will be designed so that additional data fields are not automatically collected merely because they could potentially be useful.
Where an identifiable record is unnecessary, anonymised or aggregated information should be used.
Where child-level continuity is required, Mtoto Afya may assign a system-generated child identifier.
Where technically and operationally appropriate, direct identifiers such as a child's name and guardian contact information should be separated from health and analytical datasets.
Pseudonymised information remains protected information and must not be treated as anonymous merely because a name has been replaced with an identifier.
Mtoto Afya may capture location information at specific stages where this has an approved and documented purpose.
For example, authorised geolocation may help:
Geolocation will not be used for continuous surveillance or unrelated tracking.
Where precise location is unnecessary, less precise location information should be used.
Mtoto Afya may automatically calculate growth indicators using information entered during an assessment.
The Tool may classify measurements or generate alerts indicating that a child requires attention.
These outputs are intended to support authorised health personnel and do not replace appropriate professional assessment.
Where an automated output may materially affect a child, appropriate human review should be available in accordance with applicable law and programme protocols.
Access is restricted according to authorised roles.
Depending on the implementation, authorised access may be available to designated:
Users should only see information required for their authorised responsibilities.
Access should be protected through appropriate authentication, role-based permissions and audit logging.
Where the Tool provides a guest or temporary mode, that mode must be designed according to data-protection and security requirements.
Guest access should not provide unrestricted access to identifiable children's health records.
Before identifiable child information can be collected, viewed or modified, an appropriate mechanism should exist to identify or otherwise account for the authorised person performing the activity.
Information may be shared with NCCG, MoH or another authorised public-health institution only where:
Where government stakeholders require information solely for planning, monitoring or programme-performance purposes, anonymised and aggregated information should be provided wherever individual identification is unnecessary.
Mtoto Afya may in future be integrated with authorised health-information systems to support functions such as:
Such integration will only proceed subject to applicable governance, contractual, security, interoperability, Digital Health Agency certification/approval and other legal requirements.
No privacy notice should imply that a live government-system integration exists unless that integration has actually been approved and implemented.
We may engage authorised technology and service providers to support services such as:
Service providers that process personal information on our behalf must be subject to appropriate contractual, confidentiality, privacy and security requirements.
They may not use children's information for their own independent marketing or other unauthorised purposes.
Personal and health information should, wherever required by applicable law or health-data requirements, be stored and processed within approved jurisdictions and environments.
If personal information is transferred outside Kenya, the responsible data controller must ensure that the transfer complies with applicable Kenyan data-protection requirements and that appropriate safeguards are in place.
Sensitive personal information will not be transferred internationally merely for convenience where applicable legal requirements have not been satisfied.
We implement or require appropriate administrative, technical and physical safeguards proportionate to the sensitivity of the information.
These may include:
No digital system can guarantee absolute security, but we will take reasonable and legally required steps to protect information against accidental or unlawful destruction, loss, alteration, disclosure or unauthorised access.
Suspected loss, unauthorised access, disclosure, alteration or destruction of personal information must be reported immediately through the approved incident-reporting process.
Where a personal-data breach occurs, the responsible data controller will assess the incident and make notifications to affected persons and/or the Office of the Data Protection Commissioner or other authorities where required by law.
Special consideration will be given to the potential impact of a breach on affected children.
We will retain personal information only for as long as necessary for the relevant lawful purpose or as otherwise required by applicable health-record, digital-health or other legal retention requirements.
Different categories of information may have different retention periods.
Before production deployment, the responsible data controller(s) shall approve a documented data-retention and disposal schedule specifying retention periods for, among other things:
Where information is required to form part of an official health-information system, applicable statutory health-data retention requirements will take precedence.
At the end of an applicable retention period, information will be securely deleted, destroyed or irreversibly anonymised unless continued retention is authorised or required by law.
Subject to applicable law, a data subject has rights concerning their personal information.
Where the data subject is a child, applicable rights may be exercised by a parent, guardian or other legally authorised person acting for the child.
These may include the right to:
Certain rights may be restricted where information must lawfully be retained as part of a health record or where another legal requirement applies.
Where processing relies on consent, the parent or guardian may withdraw that consent using the contact details below.
Withdrawal will not make processing that occurred lawfully before withdrawal unlawful.
Withdrawal may also not require deletion of information that must continue to be retained under applicable health, public-interest or other legal requirements.
We will explain any such limitation where a withdrawal request is received.
Mtoto Afya shall not knowingly use children's information in a manner inconsistent with their best interests.
Children's information will not be:
Where information is used for research, statistics, programme evaluation or public-health planning, anonymised or aggregated information should be used wherever identification of an individual child is unnecessary.
Research involving identifiable or sensitive information must undergo applicable legal, ethical and institutional approvals.
Anonymised datasets should be designed so that individuals cannot reasonably be re-identified.
Because Mtoto Afya processes children's personal information, health information and potentially geolocation and information exchanged with public-health systems, the relevant organisations should conduct and maintain an appropriate Data Protection Impact Assessment (DPIA) before high-risk processing is deployed.
Material changes to the Tool, its data flows or integrations should be assessed to determine whether the DPIA requires updating.
We may update this Policy to reflect:
Where a change materially affects how children's or other individuals' information is processed, an appropriate updated notice will be provided and fresh consent obtained where required.
Questions, requests or complaints concerning personal information may be directed to:
Parents and guardians may use these contact details to request access, correction, deletion where applicable, withdrawal of consent or further information about how a child's information is handled.
Individuals also have the right to raise concerns regarding the processing of personal information with Kenya's Office of the Data Protection Commissioner (ODPC) in accordance with applicable law.
Using Mtoto Afya does not remove or limit any statutory data-protection rights.
This Privacy Policy shall be interpreted in accordance with applicable laws of the Republic of Kenya, including relevant requirements under the Data Protection Act, 2019, applicable regulations, applicable health legislation and the Digital Health Act, 2023, as amended or replaced from time to time.