Bomakea Caregivers Limited, trading as BOMACARE™ ("BOMACARE", "we", "us" or "our"), respects your privacy. This Privacy Policy explains how we collect, use, disclose and safeguard your personal data when you use the BOMACARE™ website, mobile experience and related services (together, the "Services"). We handle personal data in accordance with the Kenya Data Protection Act, 2019 (the "DPA"), the Data Protection (General) Regulations, 2021, and international privacy best practices such as the GDPR where applicable.
1. Who we are
BOMACARE™ is a home-based care and medical supplies platform operating in Kenya. The platform is owned and operated by Bomakea Caregivers Limited, a company incorporated in Kenya. For the purposes of the DPA, Bomakea Caregivers Limited is the "data controller" of the personal data we collect through the Services. Contact us at info@bomahomecare.care or +254 20 250 5212.
2. Data we collect
2.1 Information you give us
- Account data: name, phone number, email, password.
- Booking data: care recipient details, address, preferred visit time, service requested.
- Health and care data (sensitive): medical history, medications, allergies, mobility, care notes and observations recorded by our professionals.
- Provider application data: for nurses, caregivers, therapists and grooming professionals — national ID, KRA PIN, professional licence (e.g. NCK), CV, references, police clearance, photograph, next of kin.
- Retail data: orders, delivery address and payment reference for medical and personal-care supplies purchased through the shop.
- Uploaded documents: prescriptions, discharge summaries, ID scans and other files you choose to share with us.
- Communications: messages you send us over WhatsApp, SMS, email, in-app chat or phone.
2.2 Information we collect automatically
- Device, browser and operating system information.
- IP address and approximate location.
- Usage data (pages visited, actions taken, timestamps).
- Cookies and similar technologies (see our Cookie Policy).
3. How we use your data
- To match you with an appropriate nurse, caregiver or specialist and coordinate the visit.
- To fulfil retail orders and arrange delivery of medical supplies.
- To vet, onboard and pay professionals who apply to work with BOMACARE.
- To maintain care notes, treatment records and continuity of care between visits.
- To process payments and prevent fraud.
- To send operational notifications (booking confirmations, provider assignment, schedule changes, visit reminders, order updates, OTP and security alerts) over SMS, WhatsApp, email or push.
- To improve the Services and measure performance through analytics.
- To send you promotional communications and newsletters, only where you have opted in.
- To comply with legal, regulatory and public-health obligations in Kenya.
4. Legal basis
We process your data on one or more of the following bases recognised by section 30 of the DPA: your consent; performance of a contract with you; compliance with a legal obligation; protection of vital interests; and our legitimate interests, provided these are not overridden by your rights.
Health data is "sensitive personal data" and is processed only where permitted by section 44 of the DPA — for example, with your explicit consent, or where necessary to provide medical care.
5. Sharing your data
- Care professionals assigned to your booking, strictly on a need-to-know basis to deliver care.
- Service providers that help us run the platform — hosting, database, notification delivery (SMS, WhatsApp, email, push), payment processing, analytics and error monitoring — under contractual data-protection obligations.
- Regulators and authorities where required by Kenyan law (including the Office of the Data Protection Commissioner) or court order.
- Emergency responders where necessary to protect life or health.
We do not sell your personal data.
6. International transfers
Some of our processors host data outside Kenya. Where we transfer personal data across borders, we do so in line with sections 48–50 of the DPA, relying on appropriate safeguards such as contractual commitments or a jurisdiction with adequate protection.
7. Retention
We retain personal data only as long as necessary for the purposes it was collected, including to meet legal, accounting or reporting requirements. Care and medical records are retained in line with applicable Kenyan health-records guidance; provider vetting records for the duration of the professional relationship plus a reasonable period thereafter; retail order records for statutory tax periods.
8. Security
We apply technical and organisational measures — including row-level-security in our database, encrypted transport (HTTPS), access controls, audit logging and staff training — to protect your data. No system is perfectly secure; we ask you to keep your login credentials confidential.
9. Your rights under the DPA
- Access the personal data we hold about you.
- Ask us to correct inaccurate data.
- Ask us to delete data ("right to erasure") subject to legal exceptions.
- Object to, or restrict, certain processing.
- Withdraw consent at any time, without affecting prior lawful processing.
- Receive your data in a portable format.
- Lodge a complaint with the Office of the Data Protection Commissioner (odpc.go.ke).
10. Children
The Services are not intended for use by children under 18 without a parent or guardian. Where we provide care to a minor, we rely on the consent of a parent or legal guardian.
11. Changes to this policy
We may update this policy from time to time. Material changes will be highlighted in-app or by email. The "Effective" date at the top of this document reflects the current version.
12. Contact
Data Protection Officer, BOMACARE — info@bomahomecare.care, Nairobi, Kenya.