How we collect, use, and protect your information
Last Updated: 24 September 2026
HealthBridge Solutions ("we," "our," or "us") is committed to protecting your privacy and ensuring the security of your personal information. This Privacy Policy explains how we collect, use, disclose, and safeguard your information when you visit our website, use our services, or interact with us in any way.
By accessing our website or using our services, you agree to the terms of this Privacy Policy. If you do not agree with the practices described in this policy, please do not use our website or services.
HealthBridge Solutions is registered with the Office of the Data Protection Commissioner (ODPC) of Kenya as both a Data Controller and a Data Processor under the Data Protection Act, 2019, under registration number 285-4468-9C40. The Data Controller registration is valid from 19 May 2026 to 19 May 2028 and the Data Processor registration from 26 May 2026 to 26 May 2028.
When we run follow-up programmes for a hospital, the hospital is the data controller for its patients and HealthBridge Solutions acts as its data processor under a written Data Processing Agreement. We process patient data only on the hospital's documented instructions, in line with the Act's principles of lawfulness, purpose limitation, data minimisation and storage limitation.
No automated message is sent to a patient unless her consent has been recorded by the hospital. Patients may opt out of messaging at any time by replying STOP, and may request access to, correction of or deletion of their data through their hospital or directly via our data deletion page.
We use the information we collect for the following purposes:
We do not sell your personal information. We may share your information in the following circumstances:
We apply technical and organisational measures proportionate to the sensitivity of health data, including:
No method of transmission or storage is completely secure. We keep these measures under review and will update them as the service grows.
Patient data (hospital programmes). Identifying details of a mother enrolled in a maternal and child health programme, namely her name, phone number, message replies and nurse notes, are automatically removed 580 days after her recorded delivery date. This period covers the full postnatal and child immunisation schedule to 18 months, plus a short buffer for final follow-up and reporting. An automated purge runs weekly and every removal is logged. After purging, only de-identified records such as visit dates and attendance status are kept, for the hospital's statutory reporting.
If a mother opts out, messaging stops immediately and her record is closed. A hospital may ask us to delete a patient's record earlier, and we will do so unless the hospital is required by law to keep it.
Business contacts and website enquiries. We keep this information for as long as we have a business relationship with you, and for up to two years after our last contact, unless a longer period is required by law.
Depending on your location, you may have the following rights regarding your personal information:
To exercise these rights, please contact us using the information provided in the "Contact Us" section below.
We use cookies and similar tracking technologies to enhance your experience on our website. Cookies are small text files stored on your device that help us recognize you and remember your preferences.
Types of cookies we use:
You can control cookies through your browser settings. However, disabling certain cookies may affect the functionality of our website.
Our website may contain links to third-party websites. We are not responsible for the privacy practices or content of these external sites. We encourage you to review the privacy policies of any third-party sites you visit.
Our website is not directed at children. Our maternal and child health programmes do, however, process limited information about infants: the baby's name, date of birth and immunisation dates. This information is provided by the mother as the child's parent and is used only to send immunisation reminders and to produce the child's immunisation record for the family.
Where a mother enrolled by a hospital is under 18, the hospital is responsible for obtaining consent in the manner required by section 33 of the Data Protection Act, 2019 before enrolment.
Our service runs on established cloud providers, some of which store or process data outside Kenya. These are: Google (data storage and hospital user interface), Make.com (workflow automation), Vercel (report generation), and Meta (WhatsApp message delivery). Monthly reports are drafted with the help of Anthropic's AI service, which receives aggregated counts only and never patient names, phone numbers or message contents.
We use these providers under their data processing terms, which include contractual safeguards for international transfers, as permitted under sections 48 to 50 of the Data Protection Act, 2019.
We may update this Privacy Policy from time to time to reflect changes in our practices, legal requirements, or for other operational reasons. We will notify you of any material changes by posting the updated policy on our website with a revised "Last Updated" date. We encourage you to review this policy periodically.
If you have any questions, concerns, or requests regarding this Privacy Policy or our data practices, please contact us:
HealthBridge Solutions
Athi River, Machakos, Kenya
P.O. Box 23 - 90100
Phone: +254 795 822 310
Email: admin@healthbridgesolutions.net
Website: healthbridgesolutions.net