Privacy Policy

Kochi Assistive Technologies (“Kochi”, “we”, “us”), P.O. Box 53187-00200, Nairobi, Kenya, is the data controller for personal data processed through the Kochi website and dashboards (the “Platform”).

For any privacy question or request, email support@kochi.africa.

Account data (everyone)

• Your name, email address, password (stored only in hashed form by our authentication provider) and the role you choose.
• If you sign in with Google: the name, email address and profile picture Google shares with us.
• The consents you give or decline at sign-up, and your notification, language, currency and display preferences.
• A profile photo, if you upload one.

Verification data (depends on your role)

• Clients: phone number, country and county, the kind of support you are looking for (for example mobility, vision, hearing, cognitive or communication), and your national ID or passport number. For a client under 18, the child’s name, birth certificate number and preferred clinic, and the guardian’s name, phone number and ID details.
• Assessors and technicians: phone number, location, practitioner type or specialisation, licence or certification number, years of experience, service availability, and an uploaded copy of your licence or certificate.
• Merchants: business name and type, KRA PIN, phone number, location, business permit number, and an uploaded business permit or tax compliance certificate.
• Donors: whether you give as an individual or an organisation, organisation name, phone number, country, impact areas, funding preferences and whether you want impact updates.

Health and disability data (sensitive)

When you book and attend an assessment, we process information about your disability, functional needs, health conditions and the assistive devices you use or need. This includes answers to assessment forms, and photos uploaded as part of an assessment. Under the Data Protection Act this is sensitive personal data, and we process it only with your explicit consent, which you give at sign-up.

Bookings, orders and payments

• Appointment details: the date and time, county, whether it is at a clinic, mobile clinic or home visit, the contact name and phone number, and any notes you add.
• Order details: the products you buy and their prices.
• Payment records: amount, currency, status and the Paystack payment reference. Card and mobile money details are entered directly with Paystack; we never receive or store your full card number.
• Donation records: amount, date, the impact areas you choose and any note you add.
• Assessor payout details: bank account name, number, bank and branch, or M-Pesa number.

Communications and technical data

• Messages you send through the contact form (name, email address, phone number, subject and message) and newsletter sign-ups.
• One-time verification codes sent by email. We store them only in hashed form and they expire after 10 minutes.
• Your IP address when you use the contact or newsletter forms. We store a salted hash of it, not the address itself, to prevent abuse.
• In-app notifications and emails we send you about your account.
• Cookies and similar browser storage, as described in our Cookie Policy.

• Directly from you, when you sign up, complete verification, book, buy, donate or contact us.
• From a parent or guardian, for a client under 18.
• From the assessor or technician who works with you, who records assessment results and recommendations.
• From Google, if you choose to sign in with Google.
• From Paystack, which confirms whether a payment succeeded.

• To provide the Platform and the services you request (creating your account, matching you with assessors, technicians and products, bookings, orders, donations and payouts). Basis: performance of our contract with you.
• To process health and disability data for assessments and recommendations. Basis: your explicit consent.
• To verify professionals and merchants and keep clients safe. Basis: our legitimate interest in a trustworthy platform, and the contract with you.
• To process payments, refunds and payouts and keep financial records. Basis: contract, and our legal obligations under Kenyan tax and accounting law.
• To send service messages such as verification codes, booking confirmations and security alerts. Basis: contract.
• To secure the Platform and prevent fraud and abuse. Basis: legitimate interests, and legal obligation.
• For the optional purposes you choose (see the next section). Basis: your consent.

We do not sell your personal data, and we do not use it for third-party advertising.

At sign-up you can choose, separately, whether we may:

• anonymise your data and use it for research;
• send you accessibility and affordability information, opportunities and resources;
• tell you about training and education programmes;
• tell you about mobile clinic visits in your area;
• invite you to community workshops and events;
• share relevant information with caregivers or support partners you nominate.

Each is off unless you tick it, and declining any of them does not affect your use of the Platform. You can withdraw any consent at any time, including your consent to the processing of health data, by emailing support@kochi.africa. Withdrawing consent does not affect processing that already took place, but without health data we cannot provide assessments.

• The professionals involved in your care. Your assessor sees your booking and the assessment you complete together. A technician or merchant sees the details needed to fit, install or supply your device.
• Owners of assessment forms. Assessment forms on the Platform are created by assessors or merchants. The owner of a form can see the answers submitted with it.
• Kochi administrators, who verify accounts, approve prices, funding requests and payouts, and provide support. Access is limited to what each task requires.
• Donors receive impact information. It does not identify you unless you have agreed.
• Service providers who process data on our behalf (listed below), under contracts that require them to protect it.
• Authorities, where the law requires it, or to protect someone’s life, safety or rights.

The Platform’s read-aloud tool uses your browser’s built-in speech feature. Some browsers send the text to their own online voice service. That is controlled by your browser, not by us.

Some of our service providers store or process data on servers outside Kenya. When that happens, we rely on the safeguards the Data Protection Act requires: providers that give appropriate protection for personal data, contractual commitments to keep it secure and confidential, and, for sensitive data, your consent.

• Account, profile and verification data: for as long as your account is open. When an account is closed, the related records are deleted, except as below.
• Payment, refund, donation and payout records: for as long as Kenyan tax and accounting law requires, even after the account is closed.
• Assessment records: for as long as your account is open, or longer only where the law requires it or a dispute is ongoing.
• Contact form messages: for as long as needed to answer and follow up on your enquiry.
• One-time verification codes: they expire after 10 minutes.

• All traffic to the Platform is encrypted in transit (HTTPS).
• Database access rules limit each account to the records its role needs.
• Identity documents, licences, permits and assessment photos are kept in private storage and are only shown to authorised users.
• Passwords, one-time codes and IP addresses are stored in hashed form.
• Payments are handled by Paystack, which is certified to the PCI DSS card-security standard.

No system is perfectly secure. If a breach affecting your personal data occurs, we will notify the Office of the Data Protection Commissioner and, where required, you, within the timelines the law sets.

Only adults can create an account. A parent or legal guardian can register and manage a client account for a child under 18 and gives consent on the child’s behalf. We process a child’s data only for the child’s assessment and support, and only in the child’s best interests. If you believe we hold a child’s data without a guardian’s consent, contact us and we will delete it.

Under the Data Protection Act, 2019, you have the right to:

• be told how your personal data is used, as this policy does;
• access the personal data we hold about you;
• object to processing based on our legitimate interests, and to direct marketing;
• have inaccurate or misleading data corrected;
• have data deleted when we no longer have a lawful reason to keep it;
• receive data you provided in a structured, machine-readable format and have it moved to another provider (data portability);
• withdraw consent at any time.

Email support@kochi.africa from the address on your account, saying which right you want to use. We may ask you to confirm your identity before acting. We will respond within the timelines set by the Data Protection (General) Regulations, 2021. This is free of charge.

You can update much of your profile yourself in your dashboard settings. Account deletion, data copies and consent changes are currently handled by our support team on request.

If you are unhappy with how we handle your data, you can complain to the Office of the Data Protection Commissioner (opens in a new tab). We would appreciate the chance to resolve your concern first.

We do not make decisions that significantly affect you based solely on automated processing. Verification, pricing, funding and payout decisions are made by people.

We use only the cookies and browser storage the Platform needs to work and to remember your settings. See our Cookie Policy for the full list.

We will update this policy when our practices or the law change. The date at the top of this page shows when it last changed. We will tell account holders about significant changes by email or in the dashboard before they take effect.

Kochi Assistive Technologies
P.O. Box 53187-00200, Nairobi, Kenya
Email: support@kochi.africa