Privacy Policy

Version 2026-10. This policy explains how ZaziPoa ("ZaziPoa") collects and uses personal data, in line with Kenya's Data Protection Act, 2019.

1. Who we are

ZaziPoa, Nairobi, Kenya, is the data controller for personal data processed through ZaziPoa. Contact us about privacy at info@zazipoa.co.ke or +254 706 004 003.

2. What we collect

Mothers: name, phone number, email address (if you add one), how you want us to contact you, National ID number, county, due date, chosen clinic and package, payments and transaction codes, messages you send us by SMS or WhatsApp (including photos of payment messages), problem reports, and basic technical data such as login times.

Clinics: contact person, phone, email, facility details and location, licence and registration details, photos of the facility, payment account details, and the documents uploaded for verification, which include identity documents and KRA PIN certificates of directors or proprietors.

We do not ask mothers for medical records. Your due date and chosen package show that you are pregnant, which we treat as sensitive health information and protect accordingly.

3. Why we use it, and our legal basis

• To create and run your plan, match payments, send receipts and reminders, and let your clinic confirm payments and check you in (to perform our agreement with you, and with your consent for health-related data).
• To verify clinics and keep unlicensed or fake clinics off ZaziPoa (our legitimate interest in protecting mothers, and legal obligations).
• To handle complaints, prevent fraud and keep the service secure (legitimate interests and legal obligations).
• To improve ZaziPoa using statistics that do not identify individuals.

We do not sell personal data, and we do not use it for advertising.

4. Who we share it with

• Your chosen clinic: your name, phone number, ID number (partly hidden), plan and payments.
• Service providers who process data for us under contract: our hosting and email provider, SMS provider, payment providers (Flutterwave, and Safaricom for M-Pesa), WhatsApp (Meta), and an artificial intelligence provider that helps our WhatsApp assistant understand messages. They may only use the data to provide their service to us.
• Authorities and regulators when the law requires it, or to report suspected fraud or unlawful conduct by a clinic.

5. Transfers outside Kenya

Some providers, such as WhatsApp and our AI provider, may process data outside Kenya. We only use providers that give appropriate safeguards for personal data, as the Data Protection Act requires, and we send them only what is needed.

6. How long we keep it

We keep plan and payment records for as long as your account is active and for up to 7 years after your plan ends, so that payment and tax records can be checked. Clinic documents are kept while the clinic is listed and for up to 7 years afterwards. We delete or anonymise data we no longer need.

7. How we protect it

Data is stored on secured servers. Clinic documents and photos are stored privately and can be opened only by authorised ZaziPoa staff. Logins are protected by one-time codes for mothers and passwords for clinics and staff, and every important action is recorded.

8. Your rights

Under the Data Protection Act, 2019 you can ask to be told how your data is used, get a copy of it, correct it, have it deleted, object to or restrict its use, and withdraw your consent. Contact us at info@zazipoa.co.ke. We may need to keep some records the law requires. If you are not happy with our response, you can complain to the Office of the Data Protection Commissioner (ODPC).

9. Children

Mothers under 18 can only register with the consent and help of a parent or guardian. Please call us and we will help.

10. Changes

We will post any updates here and tell you about important changes by SMS or on the website.