Keeping your health data private online

Using health services online means sharing sensitive information: symptoms, diagnoses, prescriptions, sometimes photographs. That data deserves care from the organisations holding it, and attention from you.

Your rights under the Data Protection Act, 2019

Kenyan law gives you rights over your personal data, including the right to be informed about what is collected, to access it, to have inaccurate data corrected, to object to certain processing, and to lodge a complaint with the Office of the Data Protection Commissioner. Health data is treated as sensitive, with stronger protection and generally requiring your consent.

What to look for in a health service

• A privacy policy you can actually find and read, saying what is collected and why
• A named contact, such as a data protection officer, for privacy questions
• Registration with the Office of the Data Protection Commissioner
• Clear statements about who data is shared with, including insurers, pharmacies and laboratories
• Encryption in transit, shown by an address beginning with https://
• Options to request a copy of your data, or its deletion

Practical steps on your side

• Use a strong, unique password for health accounts, and enable two-factor authentication if offered.
• Lock your phone with a PIN or biometrics; it is the device most likely to be lost.
• Be careful on shared or public computers: log out fully and avoid saving passwords.
• Avoid sending medical photos or documents over social media or unsecured channels.
• Check what an app can access on your phone and remove permissions it does not need.
• Delete apps you no longer use, and ask for your account to be closed.

Consent should be meaningful

You should be told who will see your data before you agree, and be able to decline optional uses such as marketing while still receiving care. Blanket consent buried in long text is poor practice. Ask if anything is unclear.

Family and shared accounts

Take care with shared devices and accounts, particularly for sensitive consultations. Where a family member manages care for an older relative or child, agree who can see what, and keep records of legal authority where it is required.

If something goes wrong

If you believe your data has been exposed or misused, contact the organisation first and ask what happened and what they are doing. Organisations have obligations to investigate and, in serious cases, to notify the Data Protection Commissioner. You can also complain to the ODPC directly.