Privacy Policy

1. Data Controller Information

TotoAfya Digital is owned and operated by TerraSept Solutions Ltd, located in Kisii Town, Kisii County, Kenya. We process personal health data in strict accordance with the Kenya Data Protection Act 2019 and relevant Ministry of Health guidelines.

2. Information We Collect

We process health information necessary for maternal and child health management, including:

• Mother Profile: Name, National ID / ANC Book Number, Contact Information, Last Menstrual Period (LMP), Estimated Date of Delivery (EDD).
• Child Profile: Name, Date of Birth, Gender, Weight, Height, Mid-Upper Arm Circumference (MUAC).
• Clinical Logs: Antenatal Care (ANC) vitals, danger signs, KEPI vaccine administration dates.
• Technical Data: Facility UUID, user roles (Mother, Nurse, Facility Lead), and audit logs.

3. Local Encryption & Sync Security

Personal health data stored on client devices (tablets, mobile phones, desktop computers) is encrypted using client-side IndexedDB encryption. Sync operations to cloud PostgreSQL infrastructure utilize TLS encryption and PostgreSQL Row Level Security (RLS) to enforce facility-based data isolation.

4. Contact & Data Protection Officer

Inquiries regarding data access, rectification, or deletion requests under the Data Protection Act 2019 may be directed to our Data Protection Officer at hello@totoafya.co.ke.