Privacy Policy

Afya Smile (“Afya Smile”, “we”) runs the Afya Smile booking platform. For the personal data described in this policy, we are the data controller under Kenya’s Data Protection Act, 2019 (“the Act”).

Dentists who receive your booking are independent data controllers for the information they collect and keep at their clinic, including your clinical records. Their own privacy practices apply to that information.

Patients

• Account details: full name, email address, phone number and password (stored securely, never readable by us).
• Bookings: the dentist, date, time and treatment you choose, the booking status, and any note you add.
• Records of when you accepted our Terms and this policy.

Dentists

• Identity and contact details: full name, date of birth, national ID or passport number, phone and WhatsApp numbers, email.
• Professional details: KMPDC registration number, qualifications, university, specialty, experience, languages and profile text.
• Clinic details: name, location, phone number, working hours and fees.
• Verification documents: ID or passport, KMPDC licence, degree, KRA PIN certificate, business permit and any optional documents you upload.
• Profile photo.

Everyone

• Basic technical information needed to run the service securely, such as sign-in session cookies, IP address and error logs.
• Your approximate county, so we can show dentists near you first. We estimate it from your network (IP address) or, only if you tap “Use my location” and allow it, from your phone’s location. Your exact position stays on your device: we keep only the county name, in a cookie on your device, and you can change it at any time.

The fact that you booked a dental appointment, and anything you write in a booking note, may be health data, which the Act treats as sensitive personal data. We collect only what is needed to make your booking, and we process it on the basis of your consent, which you give by accepting this policy and choosing to make a booking.

Your booking details and notes are visible only to you, the dentist you booked with, and authorised Afya Smile administrators. Other patients and dentists cannot see them. Please do not include more health information in a note than you need to.

• To provide the service — create your account, make and manage bookings, show your booking to your dentist (to perform our contract with you).
• To verify dentists — check identity and professional documents before a dentist goes live, to protect patients (legitimate interests and legal obligations).
• To show dentist profiles — display a dentist’s name, photo, qualifications, KMPDC number and clinic details to the public (contract with the dentist).
• To keep the Platform safe — prevent fraud and misuse, secure accounts and fix problems (legitimate interests).
• To communicate with you — send account emails and messages about your bookings (contract). We will only send marketing if you have agreed to it, and you can opt out at any time.
• To meet legal duties — keep records and respond to lawful requests from authorities (legal obligation).

• The dentist you book receives your name, phone number, email, booking details and note.
• Our service providers, who process data for us under contract and only on our instructions: Supabase (database, file storage and sign-in) and Vercel (website hosting).
• Authorities such as courts, police, KMPDC or the Office of the Data Protection Commissioner, where the law requires it.
• A buyer or successor if the Afya Smile business is transferred, under the same protections.

We do not sell your personal data, and we do not share it with advertisers.

Our service providers may store and process data on servers outside Kenya. Where this happens, we rely on the safeguards required by the Act, including contractual protections and providers’ security certifications, so that your data receives an equivalent level of protection.

• Account information: for as long as your account is open.
• Booking records: up to 7 years after the appointment, to meet legal, tax and dispute-resolution needs.
• Dentist verification documents: while the dentist is listed, and up to 7 years afterwards to show what was verified.
• Records of acceptance of our Terms and this policy: for as long as needed to show that agreement.
• When we no longer need data, we delete or anonymise it.

• Data is encrypted in transit (HTTPS) and stored with access controls that limit each user to their own information.
• Dentist documents are kept in private storage that only the dentist and authorised administrators can open, using short-lived secure links.
• Passwords are stored in hashed form and cannot be read by anyone, including us.
• If a personal data breach puts your rights at risk, we will notify the Data Protection Commissioner and, where required, you, as the Act requires.

Under the Act you have the right to:

• be informed about how your data is used;
• access the personal data we hold about you;
• have inaccurate data corrected (you can update your name and phone in “My details”);
• have data deleted where we no longer have a lawful reason to keep it;
• object to, or ask us to restrict, certain processing;
• receive your data in a portable format; and
• withdraw consent at any time (this does not affect processing already done).

To use any of these rights, contact us through the contact details published on our About page. We may need to confirm your identity first. If you are not satisfied with our response, you can complain to the Office of the Data Protection Commissioner (ODPC).

Accounts are for adults aged 18 and over. A parent or guardian may book for a child and is responsible for the information they provide about the child.

We use only a few cookies: to keep you signed in, to run the Platform securely, to remember your language (English or Kiswahili) and to remember your county so nearby dentists show first. We do not use advertising or tracking cookies.

We may update this policy. The version and effective date at the top show the current version. We will tell you about important changes on the Platform or by email.

Afya Smile. For privacy questions or requests, contact us through the contact details published on our About page. See also our Terms & Conditions.