Health Data & Confidentiality Policy

Territorial Application

This Policy applies to all processing activities conducted by Crucibel and NOVA within the territory of Kenya. All processing is subject to Kenyan law, including the Kenya Data Protection Act 2019, and to the regulatory oversight of the Office of the Data Protection Commissioner (ODPC) and the Kenya Health sector regulatory authorities.

1.3 What This Policy Does Not Cover

• Personal data of Crucibel employees processed for employment purposes (governed by Crucibel's HR Data Privacy Policy)
• Non-health personal data collected by Crucibel for commercial purposes (governed by Crucibel's general Privacy Policy)
• Health data processed in jurisdictions outside Kenya - NOVA is currently a Kenya-only platform

5.2 Right of Access

Patients have the right to obtain confirmation of whether their health data is being processed and to receive a copy of their health data. Requests must be:

• Submitted to the relevant client healthcare organization (data controller), which is responsible for responding
• Responded to within 21 days of receipt of a valid request
• Provided free of charge for the first request; a reasonable administrative fee may be charged for subsequent requests within 12 months

NOVA provides a patient-facing portal through which, where enabled by the client organization, patients may directly access their health records.

5.3 Right to Rectification

Patients have the right to have inaccurate or incomplete health data corrected. Where a patient identifies an error in their health record, they should:

• Notify their healthcare provider (the data controller)
• The healthcare provider will review the request and, where the inaccuracy is confirmed, correct the record in NOVA
• Where a clinical note is disputed rather than factually incorrect, the patient's objection may be appended to the record

5.4 Right to Erasure

The right to erasure ("right to be forgotten") is subject to significant limitations in the health data context under Kenyan law:

• Patient health records must be retained for the periods specified in Section 9 of this Policy to comply with the Health Act 2017 and medico-legal requirements
• Where erasure is legally permissible (e.g., data processed on the basis of consent for a secondary purpose), Crucibel and the client organization will delete or anonymize the data within 30 days
• Erasure requests that cannot be fulfilled due to legal obligations will be explained in writing to the patient within 21 days

5.5 Right to Data Portability

Patients have the right to receive their health data in a structured, commonly used, machine-readable format and to transmit that data to another healthcare provider. NOVA supports this right through:

• HL7 FHIR-compliant patient health record export
• Patient Summary documents downloadable via the patient portal
• Secure electronic transfer to authorized receiving healthcare providers

5.6 Right to Object

Patients have the right to object to processing of their health data for purposes other than direct clinical care, including:

• Medical research (even where ethical approval has been obtained - patient objection is valid)
• Health analytics and performance benchmarking beyond direct care purposes
• Teaching and training uses of their records

Objections must be directed to the relevant client healthcare organization. Crucibel will implement technical restrictions on data processing upon instruction from the data controller.

5.7 Rights of Vulnerable Patients

7.2 Client Healthcare Organizations

Client organizations accessing NOVA are bound by the following confidentiality standards as conditions of their Data Processing Agreement (DPA) with Crucibel:

• Appoint at least one designated System Administrator responsible for user access management and ensuring staff compliance with this Policy
• Ensure all clinical and administrative staff accessing NOVA have completed data protection and health data confidentiality training before being granted system access
• Implement a formal access management process, including onboarding, role assignment, periodic access review, and prompt offboarding of departing staff
• Report any suspected personal data breach or unauthorized access to Crucibel within 24 hours of discovery, in accordance with the Data Processing Agreement
• Not share NOVA login credentials between users; each user must have an individual account
• Not use NOVA to process health data for purposes beyond those specified in the Data Processing Agreement without written amendment

7.3 Permitted Disclosures

Health data may be disclosed without the patient's explicit consent only in the following circumstances permitted under Kenyan law:

7.4 Prohibited Disclosures

The following disclosures are strictly prohibited under this Policy and Kenyan law:

• Disclosure of HIV test results or HIV status to any employer, insurance company, school, or other third party without the patient's explicit written consent (HIV & AIDS Prevention and Control Act 2006, Section 23)
• Disclosure of mental health records to any person not directly involved in the patient's care without patient consent (Mental Health Act 2022)
• Disclosure of health data to media organizations, social media platforms, or any public forum
• Sharing of health data for commercial purposes such as targeted advertising, insurance risk scoring, or employment screening
• Disclosure to any foreign government, foreign law enforcement authority, or international organization without legal authority under Kenyan law
• Any disclosure that would enable the re-identification of a patient whose data has been de-identified

8.2 Technical Security Standards

The following minimum technical security standards apply to all health data processed through NOVA:

• Encryption at Rest: All health data stored in NOVA databases and backup systems is encrypted using AES-256 encryption
• Encryption in Transit: All data transmitted between clients and the NOVA platform uses TLS 1.3 or higher; unencrypted connections are rejected
• Vulnerability Management: Automated vulnerability scanning conducted weekly; critical vulnerabilities patched within 72 hours; high vulnerabilities patched within 14 days
• Penetration Testing: Annual third-party penetration testing of the NOVA platform and infrastructure by a certified ethical hacking firm
• Cloud Infrastructure: NOVA is hosted on ISO 27001-certified cloud infrastructure within data centers located in Kenya or, where Kenyan facilities are unavailable, subject to Transfer Impact Assessment
• Backup and Recovery: Automated daily backups; tested restoration procedures; Recovery Time Objective (RTO) of 4 hours for critical services
• Secure Development: NOVA software development follows a Secure Software Development Lifecycle (SSDLC); security code reviews are mandatory for all changes affecting health data processing

9.2 Disposal of Health Data

Upon expiry of the applicable retention period, health data shall be disposed of securely and permanently:

• Electronic health data shall be deleted using cryptographic erasure (overwriting encryption keys) or secure data deletion meeting NIST 800-88 standards
• Physical media containing health data shall be destroyed using certified destruction services with a certificate of destruction provided to Crucibel
• Disposal activities shall be recorded in Crucibel's data disposal register
• Client data controllers shall be notified of scheduled data disposal 60 days in advance
• Where a client requires extended retention beyond the scheduled disposal date for legitimate clinical, legal, or public health reasons, a written extension request must be submitted to the Crucibel DPO

10.2 Breach Response Procedure

• Contain: Isolate affected systems; revoke compromised access credentials; engage incident response team within 1 hour
• Assess: Determine scope, nature of data affected, number of data subjects, likely consequences, whether breach was malicious or accidental
• Notify: Notify DPO, client controller, ODPC, and affected patients as per the schedule above
• Investigate: Conduct root cause analysis; document timeline of events; preserve forensic evidence
• Remediate: Implement technical and organizational measures to prevent recurrence; apply patches or configuration changes as needed
• Review: Post-incident review within 30 days; update policies, procedures, and training as required; close breach record in the incident register

11.2 Mental Health Data

• Mental health diagnoses, psychiatric treatment records, and psychotherapy notes are subject to enhanced access restrictions within NOVA
• Access restricted to members of the patient's mental health care team; general clinical staff do not have default access to mental health records
• Mental health records cannot be shared with employers, schools, insurance companies, or family members without explicit patient consent and documentation
• Processing of mental health data of involuntarily admitted patients requires additional clinical governance oversight at the client facility

11.3 Reproductive and Maternal Health Data

• Reproductive health data, including contraception, abortion-related care, fertility treatment, and pregnancy records, is treated as highly sensitive
• Access is restricted to the patient's direct care team
• NOVA does not permit export or disclosure of reproductive health data for insurance, employment, or social service assessment purposes

11.4 Children's Health Data

• All data relating to patients aged under 18 years is classified as sensitive
• Parental/guardian consent is required for non-emergency processing; a documented consent trail is maintained in NOVA
• Children who are Gillick competent (i.e., sufficiently mature to consent independently for specific health services) may have their confidentiality preserved from parents for those specific services, consistent with Kenyan clinical guidance
• Child health data is never used for commercial profiling, marketing, or research without full ethical approval and guardian consent

11.5 Genetic and Biometric Data

• Genetic test results and biometric identifiers (where used for patient matching) are stored with field-level encryption and accessible only to authorized clinical staff
• Genetic data shall not be shared with insurers, employers, or any third party for predictive risk assessment purposes
• Biometric data used solely for patient identity verification shall be stored as irreversible hashes and not as raw biometric templates

12.2 Integration with National Health Systems

NOVA integrates with key national health information systems in Kenya, including:

• Kenya Health Information System (KHIS) / DHIS2: Aggregate, non-identifiable health statistics for national reporting
• National AIDS & STI Control Program (NASCOP): Anonymized HIV program data
• Kenya Immunization Management Information System (KEIMIS): Immunization records consistent with KEPI
• National Hospital Insurance Fund (NHIF) / SHA: Claims data where applicable and legally authorized

All integrations with national systems are governed by data sharing agreements with the relevant Ministry of Health agencies and are restricted to the data elements and formats prescribed by those agreements.

12.3 Sub-Processors

Crucibel engages the following categories of sub-processors to support the delivery of NOVA:

• Cloud infrastructure and hosting providers
• Cybersecurity and SIEM service providers
• Communication service providers (SMS/email for patient notifications)
• Software development and technical support partners

All sub-processors are bound by Data Processing Agreements that impose data protection obligations at least equivalent to those in this Policy. Crucibel maintains a current Sub-Processor Register available to clients upon request. Clients will be notified at least 30 days before any new sub-processor is engaged.

12.4 Research Access

Health data processed through NOVA may be made available for approved public health or medical research subject to the following conditions:

• Research protocol approved by a recognized Kenyan Research Ethics Committee (NACOSTI-accredited)
• Signed Data Use Agreement between the research institution and Crucibel/client data controller
• Data provided in pseudonymized or anonymized form wherever possible
• Individual patient consent obtained where identifiable data is required
• Research results may not identify individual patients
• Data destroyed upon completion of the research project unless ongoing retention is justified and consented

13.2 Roles and Responsibilities

13.3 Training Requirements

The following training requirements apply:

• All Crucibel staff: Mandatory annual data protection and health data confidentiality training; completion recorded and verified
• Crucibel developers: Additional secure coding and privacy engineering training annually
• Client healthcare staff: Mandatory NOVA user training including data protection module before first access; annual refresher
• New joiners (Crucibel and clients): Training completed and assessed before any health data access is granted

13.4 Records of Processing Activities (ROPA)

Crucibel maintains a Register of Processing Activities (ROPA) as required under the KDPA and Data Protection (General) Regulations 2021. The ROPA records all health data processing activities conducted through NOVA, including processing purposes, legal bases, data categories, retention periods, and security measures. The ROPA is reviewed and updated quarterly and is available to the ODPC upon request.

14.2 Regulatory Escalation

Complaints may be submitted to the Office of the Data Protection Commissioner (ODPC) at any time:

• Website: www.odpc.go.ke
• Postal Address: Office of the Data Protection Commissioner, Nairobi, Kenya
• The ODPC has powers to investigate complaints, issue enforcement notices, and impose administrative fines of up to KES 5 million or 1% of annual gross revenue under the KDPA

14.3 Consequences of Breach

Breaches of this Policy may result in:

• For Crucibel staff: Disciplinary action up to and including summary dismissal; personal civil and criminal liability under the KDPA and the Computer Misuse and Cybercrimes Act 2018
• For client organizations: Termination of the NOVA Service Agreement; notification to relevant healthcare regulatory bodies; liability under the Data Processing Agreement
• For Crucibel as a company: Administrative fines by the ODPC; regulatory sanctions; reputational harm; civil liability to affected data subjects

15.2 Version History

15.3 Approval