Privacy Policy

We collect the following categories of information:

• Account information: full name, email address, phone number, password (we never store it in plain text — see Security), and your role (patient, doctor, nurse, physiotherapist, pharmacy, vendor).
• Health information:anything you or a treating clinician records in the course of care — clinical notes, allergies, conditions, medications, vital signs, immunizations, prescriptions, lab orders and results, uploaded medical documents, and signed certificates (e.g. sick-off sheets, travel/vaccination certificates). This is sensitive “special category” data under Kenya's Data Protection Act, 2019, and we handle it accordingly.
• Location information: for ambulance dispatch, the pickup coordinates you provide for that request; for finding nearby pharmacies and labs, the county/town you select or share so we can rank options by distance.
• Payment information:your M-Pesa phone number and the transaction/receipt reference Safaricom returns to us. Payments are processed directly by Safaricom through the M-Pesa Daraja API — we never see or store your M-Pesa PIN, and we don't handle card numbers.
• Files you upload: professional licence documents (providers/vendors), prescription images, and medical documents or lab result files you or your clinician add to your record.
• Communications: messages sent during a consultation, and any review or rating you leave.
• If you sign in with Google or Facebook: the name, email address, and account identifier that provider shares with us when you authorize it — nothing else from that account.
• Technical data: IP address, browser/device information, and session cookies used to keep you signed in (see Cookies).

• To create and secure your account, and verify your identity when you sign in.
• To let you book, conduct, and document consultations, home visits, lab tests, and ambulance requests.
• To process payments and reconcile them against the service you paid for.
• To route pharmacy orders and home-visit/ambulance requests to the nearest appropriate provider.
• To send booking, payment, and account notifications by email and SMS.
• To verify healthcare providers' and vendors' professional credentials before they can accept patients.
• To investigate disputes, enforce our terms, and meet legal and regulatory obligations.
• To maintain an audit trail of who accessed a medical record and when.

We do not sell your personal information, and we do not use your health information for advertising.

We share information only as needed to provide the service, with these categories of recipients:

• The clinician or vendor you engage with — a doctor, nurse, physiotherapist, pharmacy, lab, or ambulance operator sees what's necessary to provide your care or fulfil your order.
• Safaricom (M-Pesa Daraja), to complete and confirm your payment.
• Resend, for transactional email (booking confirmations, receipts, verification codes).
• Africa's Talking, for SMS notifications, when enabled.
• LiveKit, to establish your video/audio consultation connection. Consultations are not recorded or stored by CareBora.
• Our AI symptom-checker provider — see below.
• Google or Facebook, only if you choose to sign in that way, to confirm your identity.
• Our hosting and database providers (Vercel and Neon), who store and run the platform on our behalf under contract, and cannot access your data except to operate the infrastructure.
• Regulators or law enforcement, only where Kenyan law requires it.

If you use the symptom checker, the text you type is sent to a third-party AI model (by default a Hugging Face-hosted model, with Anthropic as a fallback if configured) to generate a suggested urgency level and specialty. The AI assistant is not a doctor and never gives a diagnosis — every response carries that disclaimer. Please avoid typing your name or other identifying details into the symptom box; the feature is designed to work from symptoms alone.

We keep account and health records for as long as your account is active, plus a period afterward to meet Kenyan medical-record retention and tax/accounting obligations. If you ask us to delete your account, we remove what we can immediately and retain only what we're legally required to for the applicable retention period, after which it is deleted.

• Passwords are hashed with scrypt — we cannot read your password, and neither can anyone who gains access to our database.
• All traffic to CareBora is encrypted in transit (HTTPS).
• Session cookies are httpOnly, so they can't be read by page scripts.
• Access to medical records is role-based: only you, your treating clinician, and anyone you explicitly grant access to can view them.
• Every access to a patient's medical record is logged, including who viewed it and when.

Under Kenya's Data Protection Act, 2019, you have the right to:

• Know what personal data we hold about you, and request a copy of it.
• Ask us to correct inaccurate or outdated information.
• Delete your account and data yourself, from the app or the website — see how to delete your account — subject to the retention obligations described above.
• Object to, or ask us to restrict, certain processing.
• Receive your data in a portable format.
• Lodge a complaint with the Office of the Data Protection Commissioner (ODPC) Kenya if you believe we've mishandled your data.

To exercise any of these rights, email customercare@carebora.co.ke. We'll respond within the time required by law.

We use only the cookies needed to keep you signed in (cb_access and cb_refresh) and, briefly during Google/Facebook sign-in, a short-lived cookie to prevent cross-site request forgery. We don't use advertising or cross-site tracking cookies.

CareBora is intended for use by adults, or by a parent/guardian booking and managing care on behalf of a child. We don't knowingly collect account information directly from children without a guardian's involvement.

Some of the providers above (our AI symptom-checker provider, Google, Facebook, and our hosting provider) may process data outside Kenya. Where that happens, we rely on those providers' contractual and technical safeguards to protect your information to a standard consistent with Kenyan law.

We'll update the effective date at the top of this page whenever we make a material change, and where appropriate we'll notify you directly (for example, by email).

Questions about this policy or your data? Reach us at customercare@carebora.co.ke or admin@carebora.co.ke, Nairobi, Kenya.

See also our homepage for how to reach us by phone.