Data Privacy Policy

The Kenya National Vaccine and Immunization Portal (KeNVIP) is a cloud-based immunisation data management platform operated by Jomo Kenyatta University of Agriculture and Technology (JKUAT) on behalf of the National Vaccine and Immunization Program (NVIP), Ministry of Health, Government of Kenya.

This Privacy Policy explains what data we collect when you visit or use KeNVIP, how we use it, who we share it with, and the rights you have over your personal information. It applies to all users of kenvip-home.jkuat.ac.ke and associated sub-portals.

By accessing KeNVIP and clicking "Accept & Continue" on the privacy notice, you acknowledge that you have read and understood this policy. If you do not agree, please do not use the portal.

The data controller responsible for your personal data is:

We collect the following categories of data:

We process your personal data for the following purposes and under the following legal bases under the Kenya Data Protection Act 2019:

We do not sell, rent, or trade your personal data. We share data only in the following circumstances:

• Ministry of Health / NVIP — aggregate, de-identified immunisation statistics for national planning and reporting.
• UNICEF, Gavi, WHO, World Bank — programme-level aggregate data as required under funding agreements. No individual personal data is shared.
• Supabase Inc. — cloud database and authentication infrastructure. Data is processed under a Data Processing Agreement. Servers are located in eu-west-1 (Ireland).
• DHIS2, Chanjo, NexLeaf — technical integrations for immunisation data exchange. Only the data required for integration is shared.
• Law enforcement — where required by Kenyan law, a valid court order, or to protect the safety of individuals.

KeNVIP does not display advertising and does not share data with advertisers or marketing platforms.

We retain your personal data for as long as necessary to fulfil the purposes outlined in this policy:

• Account data — retained for the duration of your account, plus 3 years after closure for audit purposes.
• Activity logs — retained for 24 months, then aggregated and anonymised.
• Chat logs — retained for 12 months for quality improvement, then deleted.
• Child immunisation records — retained in line with Kenya Health Act requirements (minimum 10 years).
• Server logs — retained for 90 days for security monitoring.

When data is no longer needed, it is securely deleted or anonymised.

Under the Kenya Data Protection Act 2019, you have the following rights:

• Right of access — request a copy of the personal data we hold about you.
• Right to rectification — request correction of inaccurate or incomplete data.
• Right to erasure — request deletion of your personal data, subject to legal obligations.
• Right to object — object to processing based on legitimate interests.
• Right to data portability — request your data in a structured, machine-readable format.
• Right to withdraw consent — where processing is based on consent, you may withdraw it at any time.

To exercise any of these rights, contact us at the address in Section 12. We will respond within 30 days. You also have the right to lodge a complaint with the Office of the Data Protection Commissioner (ODPC), Kenya.

We implement technical and organisational measures to protect your personal data against unauthorised access, loss, or disclosure. These include:

• TLS encryption for all data in transit
• AES-256 encryption for data at rest in Supabase
• Role-based access control — users only access data relevant to their role
• Multi-factor authentication available for administrator accounts
• Regular security audits and vulnerability assessments
• Row-Level Security (RLS) enforced at the database level

Despite these measures, no internet transmission is 100% secure. If you discover a security vulnerability, please contact us immediately at the address in Section 12.

KeNVIP uses the following cookies:

We do not use advertising or tracking cookies. You can clear cookies at any time via your browser settings; clearing the kenvip_privacy_accepted cookie will cause the privacy notice to reappear on your next visit.

KeNVIP handles child immunisation records through the Defaulter Tracker tool. This data is collected, processed, and stored solely for the purpose of improving vaccine coverage among children in Kenya, in accordance with the Kenya Health Act and the Data Protection Act 2019.

Access to child records is restricted to authorised health workers who have been verified and granted access by the Ministry of Health. This data is never shared publicly or used for purposes beyond immunisation service delivery.

The portal interface itself is not directed at children as end users. Children should not create accounts or use the portal independently.

We may update this Privacy Policy from time to time to reflect changes in law, technology, or our data practices. When we make material changes, we will:

• Update the "Last updated" date at the top of this page
• Display a notice on the portal homepage
• Reset the privacy consent banner so all users see the updated notice on their next visit

Continued use of the portal after changes take effect constitutes acceptance of the revised policy.

For any questions about this Privacy Policy or to exercise your data rights, contact:

You may also contact the Office of the Data Protection Commissioner if you believe your data rights have been violated.