Skip to content

    Trust and testing

    Trust, tested in the open.

    How Tabibu is checked, who stands behind it, and where it still falls short. Last updated: October 2026.

    How it is tested

    Real numbers, generated, not typed.

    These figures are produced from the project's test files by a script, on 5 October 2026. They show that safety behaviour and retrieval are checked and improving. They do not show clinical accuracy.

    261

    emergency and safety cases

    Messages Tabibu must escalate to the emergency card, or must not wrongly escalate: 142 in English, 85 in Kiswahili, and the rest in Sheng, Arabic, French, Spanish and Portuguese. A research question that merely mentions “stroke” must not trigger the card; a real stroke report must.

    803

    automated backend tests

    Run on every change to the service. They include regression tests built from real answers that once leaked a prescription dose, so that failure cannot quietly return.

    44% to 72%

    right passage found

    On 41 questions whose answers exist only in the newer guidelines: share of expected facts found in the top 5 retrieved passages, before and after the library update.

    Where these numbers come from
    • tabibu-ai/agent/src/safety/red_team_set.jsonl
    • tabibu-ai/docs/proof/prod-collection-2026-10/matrix_v4_v2.json
    • tabibu-ai/docs/proof/prod-collection-2026-10/matrix_holdout_v4_v3_final.json

    Our own test sets, not clinical trials.

    Where it falls short

    What we have not done yet.

    • Our safety rules (emergency escalation and the dose and medicine-change checks) are rule-based. They lower risk; they are not a guarantee. A panel of clinicians has not yet reviewed them.
    • Kiswahili text has been reviewed by AI, not yet by a native speaker.
    • Helpline numbers come from official lists. We have not yet phone-tested each one.
    • All figures on this page come from our own test sets, not clinical trials, and Tabibu has no clinical certification.
    • Tabibu answers from published sources. Some Kenyan documents change faster than we can re-read them, so always confirm important details with the source.

    Who stands behind it

    Tabibu Health and Norah Labs.

    Last updated: October 9, 2026

    Tabibu Health is a product developed and operated by Norah Labs. ODPC registered — Kenya. ODPC registration is held by Norah Labs under Kenya’s Data Protection Act, not as a separate product-level registration for the Tabibu name. We do not link to a public registration certificate file; that matches how Norah Labs presents trust today (a compact “ODPC registered” line on norahlabs.com).

    For ODPC-related verification requests, contact Norah Labs through their site. For Tabibu support or privacy questions, you can also reach us at privacy@tabibu.health.

    Verify via Norah Labs

    Compliance status

    Status, as it is.

    This page reflects factual status only. We do not label any compliance programme as complete until official confirmation is available from the relevant authority. Status may change after regulator review.

    ODPC registration

    ODPC registered — Kenya

    Norah Labs, the company behind Tabibu Health, is registered with Kenya’s Office of the Data Protection Commissioner (ODPC) under the Data Protection Act. This is entity-level registration and is not a separate ODPC certification of the Tabibu product.

    Kenya Data Protection Act (No. 24 of 2019). Registration is in the name of Norah Labs; Tabibu is operated under that entity. Norah Labs does not host a public certificate file; verification is via Norah Labs contact.

    DHA certification

    DHA: Pre-Certification (Self-Attestation Stage)

    DHA certification is not yet granted. We are currently preparing/undergoing self-attestation and document readiness.

    Digital Health Act (No. 15 of 2023) health digital-service readiness track.

    How we verify claims

    • We publish status only after internal compliance evidence is reviewed against regulator requirements.
    • Any status labeled as submitted, in review, or pre-certification is based on current filing and readiness records.
    • We update this page after material regulator outcomes and keep prior status changes auditable in internal logs.

    Planned milestones

    What comes next.

    1. Governance documentation completion

      Q2 2026

      Finalize internal controls, processing records, and role assignments.

    2. ODPC registration (Norah Labs)

      Registered

      Norah Labs holds ODPC entity registration in Kenya. Public messaging matches norahlabs.com: a compact “ODPC registered” trust line; verification requests go through Norah Labs contact, not a hosted certificate PDF.

    3. DHA evidence review readiness

      Q3 2026

      Complete testing artifacts, risk logs, and technical control mapping.

    4. Public trust surface refresh

      After each regulatory status change

      Update this page and legal notices when official status changes are confirmed.

    Legal and contact

    Privacy Policy Terms of Service Medical Disclaimer Contact

    Incident and trust contact: privacy@tabibu.health