Skip to content

    Legal

    Privacy policy

    Last updated: October 9, 2026

    This policy explains how Tabibu Health handles personal and health data in Kenya. We use clear, practical language so you can understand what we collect, why we collect it, and what controls you have.

    Data Controller: Tabibu Health (Registration No: Available on request at compliance contact), Physical Address: Legal entity details available on request via compliance contact, Data Protection Contact: privacy@tabibu.health.

    Compliance status: Norah Labs, the company behind Tabibu Health, is registered with Kenya’s Office of the Data Protection Commissioner (ODPC) under the Data Protection Act. This is entity-level registration and is not a separate ODPC certification of the Tabibu product. DHA certification is not yet granted. We are currently preparing/undergoing self-attestation and document readiness.

    Google API Services: Limited Use Disclosure

    Tabibu Health's use and transfer of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

    Google user data we may access (only with your consent and as needed for the features you use):

    • Sign-in (openid, email, profile): to create and manage your Tabibu account.
    • Google Calendar (calendar.events), if you choose Connect Google Calendar: to create, update, list, or delete health-related events you request, and to help with scheduling in chat.

    We do not use Google user data for advertising, selling data to third parties, or training generalized/non-personalized AI models. You may disconnect Google Calendar in Settings → Integrations and revoke access in your Google Account at any time.

    Policy reference: https://developers.google.com/terms/api-services-user-data-policy

    Data Categories We Collect

    • Identity and account data (name, email, phone number if provided).
    • Health information you share in chats, symptom descriptions, and care goals.
    • Payment and transaction records handled through approved payment partners.
    • Technical data such as device type, browser, and security logs.
    • Support and feedback messages sent to our team.

    Purposes and Lawful Basis (Kenya)

    • To provide the service and respond to your requests, under contract and legitimate service delivery needs.
    • To maintain platform safety, prevent abuse, and protect users under legal obligations and legitimate interests.
    • To process payments and billing records as required for transaction completion and accounting duties.
    • To improve service quality with analytics that avoid unnecessary personal identification.
    • This policy follows the Kenya Data Protection Act (No. 24 of 2019) and the Digital Health Act (No. 15 of 2023) in plain-language terms.

    Sensitive Health Data Handling

    • Health data is treated as sensitive and processed with stricter access controls.
    • Only authorized personnel and approved processors access sensitive records on a need-to-know basis.
    • We do not sell personal health data and we do not share it with advertisers.
    • We do not use private health conversations to train public AI models.
    • Files you attach can contain very sensitive information, including other people's. Attach only your own documents, or documents of someone who has asked you to help (for example a child or parent in your care).

    Data Sharing and Processors

    • AI model provider: the text of your question is sent to OpenAI to write the answer and to search our knowledge base. If OpenAI is unavailable, an automatic backup model (reached through OpenRouter, with data retention switched off) may answer instead.
    • Infrastructure providers: Railway (service hosting), Vercel (website), Supabase (accounts and saved chats), Qdrant (knowledge-base search) and Upstash (short-lived answer cache and rate limits).
    • Country detection: your IP address is sent to a geolocation service (ipinfo.io, with ip-api.com as a backup) to guess your country. If it cannot tell, Tabibu assumes Kenya.
    • Nearby places (only if you tap "Use my location"): your device's position is sent to Tabibu for that one search, and then to Google Maps to find nearby pharmacies, hospitals or clinics. Tabibu does not save the position. The answer, which names the area and the nearby places, is saved with your chat like any other answer (see retention below). Google handles the position under its own terms. If you decline, type your area instead; the area you type is sent to Google Maps in the same way.
    • Files you attach (Basic and Pro plans, signed-in users only): the file is read to explain it. A PDF, Word or text file is read on our server and its text is sent to OpenAI, the same AI model provider as your questions. A photo, or a scanned PDF, is sent to OpenAI as an image so the text can be read. Photos are re-saved before sending, which removes hidden camera and location details (EXIF). Only the file you attach in that message is sent. If the backup model has to answer, it receives only the text read from your file, never the image.
    • Live information: for questions such as pharmacy prices, the text of your question may be sent to a web-search provider.
    • Payment processor (Pesapal) for transaction handling and fraud prevention.
    • Analytics and monitoring tools configured to minimize unnecessary personal data.
    • Regulators, law-enforcement agencies, or courts when disclosure is legally required.
    • Every processor is required to apply safeguards, confidentiality, and restricted use obligations.

    Cross-Border Transfers

    • Several of the providers above operate outside Kenya, including OpenAI in the United States. Health information is sensitive personal data under the Data Protection Act; we rely on your consent to send it to these providers and on contractual safeguards.
    • You can ask which provider handled a request, or withdraw consent, by writing to the contact address below.
    • Transfers are limited to service operations, resilience, or lawful reporting needs.
    • We assess vendor controls before onboarding and review transfer risks on an ongoing basis.

    Your Rights and Request Timelines

    • You may request access, correction, deletion, restriction, objection, or portability where applicable.
    • Identity checks are completed before releasing or changing account data.
    • Standard response timeline is within 30 calendar days from verified request receipt.
    • Complex requests may require an extension where law allows, and we will notify you of the reason.

    Security Controls Summary

    • Encryption in transit and at rest for sensitive records.
    • Role-based access control, credential hardening, and session protections.
    • Operational logging, monitoring alerts, and periodic access review.
    • Secure software change controls and incident playbooks for operational response.

    Breach Response & Notification

    • Internal triage target: initial incident triage and severity classification within 4 hours of detection.
    • ODPC reportable breaches: notify the Office of the Data Protection Commissioner within 72 hours where required.
    • User communication timeline: affected users are notified without undue delay after risk validation, with rolling updates during containment.
    • Incident contact: privacy@tabibu.health

    Retention Schedule

    Data categoryRetention period
    Account profile recordsDuration of account + up to 7 years where required by tax/accounting law
    Health chat content (signed-in users)Deleted automatically about 48 hours after the chat (an hourly cleanup job runs). You can choose "Keep 30 days" on a chat; that chat is then kept for 30 days from the moment you choose it and is deleted after that. You can turn it off or delete the chat at any time. Chats that include a file, and the WhatsApp thread, cannot be kept and are always deleted about 48 hours later. Anonymous visitors' chats are not saved to an account.
    Chat summariesWhen a chat is deleted, a short AI-generated summary is kept (up to 6 per user) to give more relevant help later. Kept until you delete your account or ask us to remove them.
    Files you attachNot stored. The file is held in memory only while it is read, then discarded. We do not keep the file or the text read from it, and we do not write file names or file contents to our logs. Answers about files are never placed in the shared answer cache.
    Files you send on WhatsAppNot stored by Tabibu. When you send a file, Tabibu keeps only a reference to it for up to 10 minutes while it waits for your YES. The file is downloaded only after you agree, held in memory while it is read, then discarded. The file also passes through WhatsApp (Meta) and our messaging provider (Twilio) as part of delivering your message, under their own terms. We ask Twilio to delete its copy once we have read it.
    Your question and the answer about a WhatsApp fileKept for 48 hours so you can ask follow-up questions, separate from your main chat, then deleted. It may quote values printed in your file.
    Your question and the answer about a fileSaved with your chat and always deleted about 48 hours later: a chat that includes a file cannot be kept for longer. The answer may quote values printed in your file (for example a lab result), so it can contain health details. If you delete a chat, the short summary we keep (see above) may mention them too; ask us to remove it at any time.
    Answer cacheShort-lived (about 30 minutes by default), keyed to the question text, not to your account
    Payment and billing recordsUp to 7 years for statutory financial compliance
    Security and audit logsUp to 24 months, then rotated or de-identified
    Support requestsUp to 24 months from closure for service quality and dispute handling

    Policy Updates

    We may update this Privacy Policy when our products, legal obligations, or security controls change. Material changes will be announced in-product or on this page with an updated date.