Privacy Policy
Last updated: October 2026
1. Who we are
Imani Health ("Imani", "we", "us") is a registered healthcare trust that helps Kenyan families save for medical care through healthcare savings wallets, including the Seniors Wallet. The wallet is operated by Imani Health, located in Nairobi, Kenya.
You can reach us on privacy matters at hello@imanihealth.co.ke.
2. What this policy covers
This policy explains what personal data we collect, why we collect it, who we share it with, how long we keep it, and what rights you have. It applies to anyone who visits our website, registers for a wallet, is named as a beneficiary, pays into a wallet, contacts us, or responds to our adverts.
We have tried to write this plainly. If anything is unclear, ask us.
3. The personal data we collect
Information you give us when you register or use a wallet
- Your full name, phone number, email address and residential area
- Your National ID number and a photo of your National ID (we need this to verify who you are and to meet our legal and compliance duties)
- Details of the wallet you open: the tier you choose, your savings goal, and the family members you add
- Details of the people you add as beneficiaries or dependants, such as a parent, spouse or child: their names, relationship to you, date of birth and ID or birth certificate details where needed
- Payment information: M-Pesa phone number, transaction reference codes, amounts paid in and amounts paid out to hospitals. We do not store your M-Pesa PIN or card PINs.
Health-related information
Because our wallets pay for medical care, some of the data we handle is sensitive personal data under the Act. This can include the name of the hospital you or your beneficiary visited, the date and amount of a bill, and the type of service (for example outpatient, diagnostics, medication or specialist visit). Where a claim requires it, we may also receive limited clinical information from the hospital or our claims partner. We only collect the minimum needed to verify and settle a bill, and we do not ask you for medical history when you register.
Information we collect automatically
- Device and browser type, IP address, pages visited and time spent, collected through cookies and similar tools
Information from others
- Hospitals and our claims-administration partners, who send us bill and claim details
- Payment providers, who confirm that a payment has succeeded or failed
- Family members who register a wallet on behalf of an older parent or other relative (see section 10)
- Meta (Facebook and Instagram) and other platforms, if you submit your details through one of our lead forms
4. Why we use your data, and our legal basis
We only use your data where the Act allows it. The main reasons are:
| What we do | Why | Legal basis |
|---|---|---|
| Verify your identity and open your wallet | To create and run your account | Contract; legal obligation |
| Record deposits, withdrawals and balances | To manage your savings | Contract |
| Pay hospitals and settle claims | To deliver the service you signed up for | Contract; your consent for sensitive data |
| Send you receipts, reminders and service messages | To keep you informed about your wallet | Contract; legitimate interest |
| Prevent fraud and misuse | To protect your money and the trust | Legitimate interest; legal obligation |
| Meet legal, tax and regulatory requirements | To comply with Kenyan law | Legal obligation |
| Send you marketing about Imani products | To tell you about offers and new services | Your consent |
| Improve our website and services | To understand what works | Legitimate interest |
Where we rely on your consent, especially for sensitive health-related data and for marketing, you can withdraw it at any time (see section 9).
5. Who we share your data with
We do not sell your personal data. We share it only where needed to run the service:
- Hospitals and healthcare providers in our partner network, so they can confirm your wallet balance and receive payment for your care. They see only what they need, such as your name, wallet balance and the amount being charged.
- Our insurance and claims partners, including Minet and its hospital network, who help coordinate provider access and claims settlement. For optional inpatient or last expense cover, we share the details the insurer requires to issue and administer the policy.
- Payment providers, including Safaricom M-Pesa and PesaPal, to process deposits and payouts.
- Technology providers who host or support our systems, including our database and hosting providers and Africa's Talking for USSD. They process data only on our instructions.
- Trustees, auditors, lawyers and accountants, where needed to administer the trust and meet our duties.
- Regulators and authorities, such as the ODPC, the Central Bank of Kenya or law enforcement, where the law requires or allows disclosure.
- Advertising platforms, such as Meta, in limited ways (see section 11).
Every organisation that handles your data for us is required to protect it and use it only for the agreed purpose.
6. Where your data is stored
Some of our service providers, including our cloud database and hosting providers, store data on servers outside Kenya. When your data leaves Kenya we make sure it is protected as the Act requires, through safeguards such as contractual protections and by transferring only what is necessary. Where the Act requires your consent for a transfer of sensitive data, we will ask for it.
7. How we keep your data safe
We take the security of your information seriously, especially your ID documents and payment records. Our measures include:
- ID photos stored in a private, access-controlled storage area, not on public pages
- Encryption of data in transit, and role-based access so only authorised staff can see sensitive records
- Admin approval checks on registrations and payments
- Regular review of who has access to what
No system is completely secure. If a breach affects your personal data in a way that is likely to harm you, we will notify the ODPC within 72 hours as the Act requires, and we will tell you without unreasonable delay.
8. How long we keep your data
We keep personal data only as long as we need it for the purposes above, or as the law requires. As a guide:
- Account and wallet records: for as long as your wallet is active, and for 4 years after it closes, to meet financial record-keeping and audit requirements
- ID documents: for as long as your wallet is active and for the period required by law after closure
- Marketing contact details: until you unsubscribe or withdraw consent
- Website analytics: 26 months or less
When the retention period ends, we delete or anonymise your data.
9. Your rights
Under the Act, you have the right to:
- Be informed about how we use your data
- Access the personal data we hold about you
- Correct data that is wrong or incomplete
- Delete your data, where we no longer have a lawful reason to keep it
- Object to our processing, including direct marketing
- Restrict processing in certain situations
- Receive a copy of your data in a usable format (data portability)
- Withdraw consent at any time, without affecting what we did before you withdrew
To use any of these rights, write to hello@imanihealth.co.ke. We may ask you to confirm your identity first, and we will respond within 30 days. Some records we are legally required to keep, and we will tell you if that applies.
If you are not satisfied with how we handle your data, you can complain to the Office of the Data Protection Commissioner, Kenya (www.odpc.go.ke).
10. Seniors, children and other people you add to a wallet
Many of our users are adult children saving on behalf of an older parent, or parents saving for their families. If you add another person to a wallet, you confirm that you have told them, and that you have their permission (or the legal authority to act for them) to share their details with us.
- Older parents and beneficiaries: we may ask for proof of the relationship or the beneficiary's consent. A beneficiary can ask us what data we hold about them.
- Children under 18: we collect a child's data only through a parent or legal guardian, and only what is needed to include them as a beneficiary. We do not market to children.
11. Cookies, analytics and advertising
Our website uses cookies and similar tools to make the site work, understand how it is used, and measure our adverts. You can control cookies through your browser settings or our cookie banner. If you click or respond to one of our Facebook or Instagram adverts, Meta may share limited information with us (for example, the details you enter in a lead form), and we may use tools such as the Meta Pixel to measure results. We do not share your wallet, ID or health-related data with advertising platforms.
12. Marketing messages
We will contact you about Imani offers by SMS, WhatsApp, email or call only if you have agreed to it. You can opt out at any time by replying STOP, using the unsubscribe link, or writing to hello@imanihealth.co.ke. We will still send you service messages about your wallet, such as receipts and balance updates.
13. Changes to this policy
We may update this policy from time to time. When we make an important change, we will tell you through our website, SMS or email. The date at the top shows when it was last updated.
14. Contact us
Imani Health
Nairobi, Kenya
Email: hello@imanihealth.co.ke
Phone: +254 710 604 702
Website: imanihealth.co.ke