Privacy Policy

1. Introduction

Afia Concept Solution Limited and its affiliates (together, and each of them as the context may require, “ACS”, “we”, “us”, or “our”) provide third-party administration (TPA) services for health insurance and healthcare financing schemes in Kenya. We enable insurers, employers, and other payers of healthcare (each a “Payer”) to digitally administer their schemes, and enable members to access and manage their healthcare benefits through two distinct digital products:

• The ACS Provider & Payer Portal (the “Portal”) — a web-based platform used by Payers, their contracted healthcare providers, and ACS administrators to set up and manage benefit policies, check member eligibility, process biometric verifications, manage pre-authorizations, adjudicate and track claims, and process payments.
• The ACS Member App, called My Afia Solution, (the “Member App”) — a mobile application available on iOS and Android, used by scheme members to view their benefits and dependents, access the provider network, check their claims and pre-authorizations, and submit reimbursement claims.

This privacy policy applies to both products and all related services (together, the “Services”), and is intended for all individuals whose personal data is processed through the Services — including scheme members, their dependents, healthcare providers, Payer representatives, and ACS staff using the Portal on an administrative basis (together, “Users” or “you”).

By using the Portal or Member App, or by having your information registered on either platform, you acknowledge that you have read and understood this policy. If you share personal data of another person with us (for example, a dependent covered under your scheme), you are responsible for informing them of this statement.

This statement does not cover the processing of your personal data by Payers, healthcare providers, or other third parties acting independently as data controllers. Please consult their respective privacy statements for that information.

2. About Our Products — What They Do

2.1 ACS Provider & Payer Portal

The Portal is a secure, web-based benefits administration platform accessible to authorized users — including Payer administrators, contracted healthcare providers, and ACS operations staff. Through the Portal, users can:

• Policy setup: Configure and manage benefit schemes, policy terms, member limits, and exclusions on behalf of Payers
• Eligibility checks: Verify in real time whether a member is active and entitled to specific benefits at the point of care
• Biometric verification: Authenticate a member’s identity using biometric data (such as fingerprint recognition) at participating provider facilities to prevent fraud and ensure benefit access by entitled members only
• Pre-authorization: Submit, review, and approve or decline pre-authorization requests for planned procedures, investigations, and specialist referrals
• Claims management: Submit provider claims, review claim documentation, adjudicate claims against benefit rules, and track claim status through to payment
• Payments: Process and record payments to healthcare providers in settlement of adjudicated claims

2.2 ACS Member App (My Afia Solution)

The Member App is a mobile application for individual scheme members. Through the App, members can:

• View their active benefits, cover limits, and remaining balances
• Manage and view dependent details covered under their scheme
• Access the network of contracted healthcare providers and locate facilities near them
• Check the status of their claims and pre-authorization requests
• Submit reimbursement claims directly, including uploading supporting documentation such as receipts and medical reports

3. What Is Personal Data?

Personal data is any information that can be linked to an identified or identifiable natural person. Examples include your name, date of birth, national ID or passport number, telephone number, email address, physical address, membership or policy number, and photographs.

Personal data we process may relate to you as a member or provider, or to any dependent covered under your scheme, where you have registered them through the Member App or they have been enrolled by your Payer. Where we do not need to identify you specifically — for example for service analytics or scheme-level reporting — we use anonymized or pseudonymized data, so that the information cannot be traced back to an individual.

4. ACS’s Commitment to Data Protection

We recognize that processing personal data — and particularly health and biometric data — in the context of healthcare benefit administration carries significant responsibilities. ACS is committed to handling your personal data lawfully, securely, and with respect for your right to privacy as guaranteed under Article 31 of the Constitution of Kenya, 2010.

ACS complies with the Kenya Data Protection Act, 2019 (“KDPA”) and the Data Protection (General) Regulations, 2021, and is registered as a data controller and data processor with the Office of the Data Protection Commissioner (“ODPC”) as required under the Act. We also align our internal practices with internationally recognized best practice, including relevant principles drawn from the EU General Data Protection Regulation (GDPR), where they raise the standard of protection for our Users.

4.1 Our Data Protection Principles

In accordance with Section 25 of the Data Protection Act, we ensure that personal data is:

ACS enters into written data processing agreements with every third-party processor it engages, ensuring that any organization processing personal data on our behalf is bound by obligations equivalent to those imposed on ACS by the Data Protection Laws.

5. How Do We Protect Your Data?

Your personal data — especially health and biometric data — is treated with the strictest confidentiality and is accessed only by authorized persons with a legitimate need. We apply the following technical and organizational measures:

• End-to-end encryption of personal data in transit between the Member App or Portal and our servers, using industry-standard TLS protocols
• Encryption of sensitive data at rest, particularly health records, biometric data, and payment information
• Role-based access controls on the Portal, ensuring that only authorized staff — such as ACS claims assessors, care managers, and scheme administrators — can access member data relevant to their function
• Multi-factor authentication for Portal users to prevent unauthorized account access
• Secure biometric data storage, with fingerprint templates stored in encrypted, access-restricted environments separate from other member data
• Pseudonymization of data used for analytics, scheme reporting, and service improvement, so that analysis can be conducted without exposing individually identifiable information
• Contractual confidentiality obligations incorporated into every ACS employment contract and every third-party processor agreement
• Regular staff training on data protection, including mandatory certification for staff who access sensitive health and claims data
• System access logging and audit trails to detect and investigate unauthorized access or anomalous activity

6. Data Processing By Product & Function

This section explains what personal data we process, why, on what legal basis, and in what capacity (controller or processor), for each key function of our two products.

A. ACS Provider & Payer Portal

(i) Policy Setup & Benefit Configuration

When a Payer onboards a scheme onto the Portal, ACS configures benefit policies, member groups, cover limits, and scheme rules. This involves processing member lists — including names, national ID numbers, membership numbers, dates of birth, genders, employer details, and dependent information — provided to ACS by the Payer.

(ii) Eligibility Checks

When a member presents at a contracted healthcare provider, the provider uses the Portal to verify in real time whether the member is active and entitled to cover for the requested service. This involves processing the member’s name, membership number, national ID, date of birth, scheme details, benefit balances, and active dependent list.

(iii) Pre-Authorization Management

Healthcare providers submit pre-authorization requests through the Portal for planned procedures, specialist referrals, and high-cost investigations. ACS’s clinical and operations team reviews the request, applies benefit and clinical criteria, and approves or declines accordingly. This process involves the member’s identity data, diagnosis codes (ICD-10), procedure codes, clinical notes, referral letters, and relevant medical history submitted by the provider.

B. ACS Member App

(i) Member Registration & Account

To create a Member App account and access your benefits, ACS processes the following data, which may be pre-populated from enrollment data provided by your Payer, or entered by you during registration:

• Full name, date of birth, gender, and photograph (where applicable)
• National ID or passport number, and mobile phone number
• Policy or membership number, scheme name, and employer (where applicable)
• Email address (for account access and correspondence)

(ii) Benefits, Dependents & Provider Network

Through the Member App, you can view your active benefits, cover limits, remaining balances, and the dependents enrolled under your scheme. You can also browse the network of contracted healthcare providers. This requires ACS to display your scheme’s configured benefits and the provider directory, which includes provider names, locations, contact details, and specialties. No additional personal data is collected for these browsing functions beyond your authenticated account details.

(iii) Claims & Pre-Authorization Status

The Member App allows you to track the status of claims and pre-authorization requests associated with your membership. You can view the date, provider, service category, amount billed, amount approved, and current status (e.g. submitted, under review, approved, paid, declined). The underlying clinical detail of a claim is viewable only by you as the member (and your Payer), not by other users.

(iv) Reimbursement Claim Submission

Where you have paid for a healthcare service out-of-pocket and wish to claim reimbursement through your scheme, the Member App allows you to submit a reimbursement claim directly. This involves uploading:

• The name of the healthcare provider visited, date of service, and type of service
• The total amount paid, along with supporting receipts, invoices, or payment proof
• A prescription, referral letter, or medical report (where required by your scheme for the type of service claimed)

ACS processes this documentation to assess, adjudicate, and settle your reimbursement claim in accordance with your scheme’s benefit rules. Medical and clinical documentation uploaded as part of a reimbursement claim is sensitive personal data and is handled accordingly.

C. Claims Management & Payments

Beyond individual claim submissions through the Member App, ACS manages a full end-to-end claims lifecycle through the Portal. This includes receiving provider claims (submitted directly by facilities), reviewing supporting documentation, adjudicating claims against benefit rules and policy terms, and processing payments to providers. Data processed in this function includes:

• Member identity and benefit data (verified via the Portal at the point of care)
• Provider identity and banking or mobile money payment details
• Itemized bill of services rendered, including procedure codes, medication lists, and billed amounts
• Clinical documentation: diagnoses (ICD-10 codes), medical notes, investigation results, and treatment records submitted by the provider in support of the claim
• Payment reference data: payment amounts, dates, recipient accounts, and settlement confirmation

D. Biometric Verification

Where required by your Payer or scheme, the Portal supports biometric verification — using your fingerprint — to confirm your identity at the point of care at participating provider facilities. This is used to prevent fraud and ensure that healthcare benefits are accessed only by the enrolled member or their covered dependents.

• Your fingerprint template is collected and enrolled during your first visit to a participating provider facility
• On subsequent visits, your fingerprint is scanned and matched against the stored template to verify your identity before benefit access is granted
• Fingerprint templates are stored in encrypted, access-restricted environments, separate from other personal and health data
• Biometric data is never shared with any party other than ACS and the Payer under whose scheme you are enrolled, and only for the purpose of identity verification and fraud prevention

E. Call Centre & Customer Support

When you contact ACS through our call centre, the Member App’s in-app support function, or by email, we process the personal data necessary to verify your identity, understand and resolve your query, and keep a record of the interaction for quality assurance, training, audit, and dispute resolution purposes. This may include health-related or claims-related information you share in the course of describing your query.

Telephone calls to our call centre may be recorded. Where a call is recorded, you will be informed of this at the start of the call. Call recordings are retained for a limited period for the purposes above, after which they are securely deleted.

F. Marketing Communications

With your consent, or where you are an existing member and the communication relates to a similar service, we may use your name, email address, and mobile number to share information about new ACS products, scheme benefits, wellness programs, or to invite your feedback on your experience with the Portal or Member App.

You may opt out of marketing communications at any time — at no cost — using the notification settings in the Member App, the unsubscribe link in any email, or by contacting us using the details in Section 12. Opting out of marketing does not affect your ability to receive essential service notifications about your cover, claims, or account activity.

7. Where Is Your Data Processed?

ACS hosts its core systems — including the Portal and the Member App back-end infrastructure — on servers located in Kenya, in alignment with the data localization principle that personal data relating to Kenyan residents should, as far as practicable, be stored and processed within Kenya.

Where we engage cloud service providers, technology partners, or other processors located outside Kenya, we ensure that appropriate safeguards are in place before any cross-border transfer of personal data occurs, as required by Section 48 of the Data Protection Act, 2019. These safeguards may include:

• Contractual clauses with the receiving party that bind them to data protection standards equivalent to those under Kenyan law
• Confirmation that the receiving country or organization has been assessed as providing an adequate level of data protection
• Your explicit and informed consent to the specific transfer, where required

Health data, biometric data, and claims data processed through the Portal are, to the extent practicable, retained exclusively on Kenya-based infrastructure. Where cross-border processing is unavoidable for a specific operational function, we will update the information below accordingly.

8. Who Do We Share Data With?

We share your personal data only where necessary to deliver the Services, and always under appropriate contractual and confidentiality safeguards. The following table sets out the categories of recipients and the purposes for which data is shared:

9. Your Rights as a Data Subject

ACS is committed to facilitating the exercise of your rights under the Kenya Data Protection Act, 2019 and the Data Protection (General) Regulations, 2021. The rights below apply where ACS is acting as a data controller in relation to your personal data. Where a Payer is the controller (for example, for scheme enrollment data provided to ACS), please contact the Payer to exercise your rights in relation to that processing, unless ACS has been appointed to handle such requests on the Payer’s behalf.

To exercise any of these rights, you may contact ACS verbally or in writing using the details in Section 12. We may need to verify your identity before acting on your request, and may ask you to complete a short verification form. We will not charge a fee for a reasonable request, but may charge a reasonable administrative fee for repetitive or unfounded requests as permitted by law.

10. Children’s and Dependents’ Data

Where a dependent covered under your healthcare scheme is a minor (a person under 18 years of age), ACS processes their personal data — including identity data and health information — as necessary to administer their benefit entitlements, on the basis of the consent and parental authority of the parent or guardian who enrolled them.

If you register a dependent minor through your Payer’s enrolment process, you confirm that you are their parent or legal guardian, that you have authority to enroll them, and that you accept this privacy statement on their behalf. We will not knowingly process a minor’s data without the consent of a parent or legal guardian.

The Member App is not designed for independent use by minors to create their own account. If you become aware that a child has accessed the Portal or Member App and submitted personal data without appropriate parental or guardian consent, please contact us immediately so we can review and take appropriate action.

11. Data Retention

ACS retains personal data only for as long as is necessary for the purposes set out in this statement, including to comply with any applicable legal, regulatory, insurance, audit, or financial reporting requirements. The following schedule sets out our general approach by data category:

Where retention is governed by a specific agreement between ACS and a Payer, the terms of that agreement — together with applicable law — will determine the retention period that applies to your data in that scheme context. You may contact us using the details in Section 12 for specific further information about the retention period applicable to your data.

When personal data is no longer required, ACS disposes of it securely — through permanent deletion of electronic records or secure physical destruction of any paper records — in accordance with our internal data disposal procedures.

12. Contact, Data Protection Officer & Complaints

12.1 Contact ACS

Where ACS is the controller of your personal data, the controlling entity is Afia Concept Solution Limited. For questions about this statement, to exercise any of your rights, or to report a suspected data breach, please contact us:

12.2 Regulatory Complaints

If you are not satisfied with how we have handled your personal data or responded to a rights request, you have the right to lodge a complaint with the Office of the Data Protection Commissioner (ODPC):

We would welcome the opportunity to address and resolve any concern you have directly before a regulatory complaint is submitted, and we undertake to treat all complaints promptly, transparently, and fairly.

13. Updates to This Statement

ACS may update this privacy statement from time to time to reflect changes in our Services, our data processing practices, or applicable law. We will notify you of material changes — particularly those that affect how we process your health or biometric data — through a notification in the Member App, by SMS or email to your registered contact, or by a prominent notice on the Portal, before the changes take effect.

Your continued use of the Portal or Member App following notification of any changes constitutes your acknowledgement of the updated statement. The effective date at the top of this document indicates when the current version was last updated. We recommend reviewing this statement periodically.