Introduction
This document reflects the Platform's technical architecture and applicable Kenyan law. It should be reviewed by qualified legal counsel, and AfriPhysio should confirm registration obligations with the Office of the Data Protection Commissioner (ODPC) of Kenya.
Data Controller: AfriPhysio Ā· Platform: AfriPhysio Online Ā· Privacy enquiries: privacy@afriphysio.online Ā· Support: support@afriphysio.online
Scope
This policy applies to visitors, learners, instructors, institution administrators, accreditors, platform staff, and anyone whose data is processed through the Platform.
It does not govern third-party websites (including external Zoom or Google Meet sessions), Safaricom M-PESA's processing after you authorise payment on your device, or services operated solely by your employer outside our Platform.
Applicable law
| Jurisdiction | Primary legislation |
|---|---|
| Kenya | Data Protection Act, 2019; Data Protection (General) Regulations, 2021; Registration Regulations, 2021; Computer Misuse and Cybercrimes Act, 2018; Constitution of Kenya, Article 31 |
| EU / EEA | General Data Protection Regulation (GDPR) |
| United Kingdom | UK GDPR and Data Protection Act 2018 |
Where multiple laws apply, we apply the standard that affords you the greater protection unless required otherwise by law.
Data we collect
Account and identity
- Email, password (stored hashed), display name, Firebase user ID
- Account type (learner or instructor), Google OAuth profile if used
- Phone number, country, professional licence or registration number
- Email verification codes (hashed) and authentication session data
Professional profiles
- Learner: bio, workplace, specialties, CPD targets, verification documents, learning preferences
- Instructor: qualifications, portfolio links, payout preferences, government ID and licence uploads
- Institution: organisation details, employee roster, sponsorship and compliance data
Payments
- M-PESA phone number, transaction amount, status, invoice number, checkout and receipt references
- We do not store your M-PESA PIN or wallet credentials
Learning and CPD
- Enrollments, progress, quiz attempts, lesson notes, CPD points, certificates, course reviews
Live sessions
- Attendance, engagement metrics, chat participation, optional camera/microphone (with your permission)
- Optional SMS/WhatsApp reminder phone numbers
Technical data
- IP address, browser type, security logs, fraud flags, administrative audit records
- Cookies: portal session indicator; Firebase Auth manages secure tokens
How we use your data
We use personal data to provide the Platform, verify professional credentials, process payments, deliver live learning, support employer programmes, communicate with you, maintain security, comply with law, and improve services.
We do not sell your personal data.
Legal bases under Kenyan law include consent, contract, legal obligation, and legitimate interests (balanced against your rights). Where GDPR applies, we use equivalent lawful bases.
International transfers
Your data is primarily hosted in EU Google Cloud regions. Some processing occurs outside Kenya, including M-PESA proxy infrastructure and email providers in the United States. Cross-border transfers use appropriate safeguards under the Kenya Data Protection Act and, where applicable, GDPR transfer mechanisms. M-PESA payment data is transmitted to Safaricom in Kenya.
Data retention
We retain data only as long as necessary for the purposes described, unless longer retention is required by law.
- Active account data: for the life of your account plus a reasonable period after closure
- Payment records: typically at least seven years for tax and accounting compliance in Kenya
- CPD and certificates: retained to support verification and professional records
- Live session signalling: short operational retention (hours), not permanent records
Account deletion may anonymise certain identifiers while retaining records required for financial, legal, or accreditation integrity.
Security
We implement measures including encrypted connections, role-based access, private file storage with signed URLs, rate limiting, email verification, optional App Check, and administrative audit logging.
No system is completely secure. Safeguard your password and notify us promptly of suspected unauthorised access.
Your rights
Depending on your location, you may have rights to access, rectify, erase, restrict, object to processing, receive portable data, withdraw consent, and lodge complaints.
Kenya ā ODPC: www.odpc.go.ke Ā· complaints@odpc.go.ke
To exercise your rights, email privacy@afriphysio.online with your name, registered email, and the right you wish to exercise. We respond within 30 days or as required by law.
M-PESA payments
- You provide a mobile phone number on the Platform.
- We send a payment request to Safaricom via the Daraja API.
- You authorise payment on your handset.
- Safaricom sends a callback with transaction outcome and receipt details.
- We update your payment and enrollment status.
Children
AfriPhysio Online is designed for professional healthcare practitioners and is not directed at children under 18. We do not knowingly collect data from minors. Contact us if you believe a minor has registered.
Data breaches
If a breach is likely to risk your rights and freedoms, we will notify the ODPC within 72 hours where required and affected individuals without undue delay, and document remedial actions taken.
Changes to this policy
We may update this policy and will post revisions at afriphysio.online with an updated date. Material changes will be communicated through the Platform or email where appropriate.
Contact
AfriPhysio ā Privacy Team
Email: privacy@afriphysio.online
Support: support@afriphysio.online
Web: afriphysio.online