Platform Privacy Statement
Date: 6 May 2021; version: 2.0
Our view
CarePay has the mission to give everyone the power to care by enabling mobile access to healthcare services. For this purpose, we operate the CarePay platform and in doing so we handle personal data of platform users. Processing personal data comes with responsibilities on privacy, confidentiality, access and consent, which we take seriously.
CarePay endorses and seeks to comply with applicable data protection laws. In Kenya, this is the Kenya Data Protection Act (KDPA), while we also observe the principles of the European General Data Protection Regulation (GDPR) throughout the CarePay group. We design our services to be compliant with the KDPA and GDPR and to ensure we process personal data with a legal basis and in accordance with the processing purpose, while respecting your right to privacy.
To protect the personal data of CarePay platform users, our platform has built-in technical safeguards. We use up-to-date knowledge and tools to protect data in line with industry standards. We continuously evaluate the security of our systems and processes to improve them where necessary.
Privacy Statement
Introduction
CarePay endeavours to process your personal data carefully, securely, and confidentially. It is important to us that you have confidence in our organisation regarding the processing of your personal data. This privacy statement is intended for users of the CarePay platform and provides information about the processing of personal data through our platform’s web-portals and online applications. Information on the processing of personal data of users of the services and products delivered via our platform is provided in our Terms of Service
What is personal data?
Personal data are all data that can be traced back to a person. Examples include your name, address, telephone number and account number. Where we can, we pseudonymise your personal data so that it is no longer directly traceable to you as a person.
Which personal data do we process and why?
We process your personal data to enable and enhance your use of the platform. We process your username (e-mail address or phone number) and password to allow you to access the platform. We also process your username when you make a request on the platform, for example to download or save information. To know whether our platform can be visited properly and to locate and address root causes of errors, we process user actions (using cookies), IP address, location information and device details, in each case in pseudonymised form. This way we can provide our users a seamless experience, update the platform functionalities where necessary and expedite solving technical errors, while limiting the impact on your privacy.
Which parties process personal data for us?
CarePay has engaged various third-party processors for the processing of personal data on the web-portals and online applications of our platform. This includes AWS (Amazon Web Services) as host of our platform on their cloud servers, meaning AWS processes the platform data, including personal data. Google Analytics processes user actions in pseudonymised form to provide insights on the use of our platform and enables us to improve the platform user experience. We also use other third-party processors to enable us to develop, operate and monitor our platform as well as solve technical errors. As the platform is under development, these parties may change from time to time. You can contact us for an up-to-date overview and further information.
What is the legal basis for processing and how do we limit impact on your privacy?
The legal basis we use to process your personal data on the platform is the legitimate interest of CarePay to develop, operate and improve its platform web-portals and online applications. We take the following measures to limit the impact of our data processing on your privacy:
- Where it is not important for us to know exactly who the platform user is, we process user data in pseudonymised form.
- We offer you the opportunity to opt out of the use of Google Analytics.
- We use processors who have privacy/security policies and offer a data processing agreement with standard contractual clauses safeguarding data privacy.
- The processors may only process your personal data to support us in developing, operating and improving the platform.
Who is the data controller for the processing of personal data?
CarePay is the data controller for the processing of personal data on the platform:
CarePay Kenya Limited
114 East Manyani,
off James Gichuru,
Nairobi, Kenya.
Do we share your data with other parties?
Your personal data will be treated confidentially and will only be processed for the purposes set out in this statement. Where necessary to develop, operate and improve the platform web-portals and online applications, we share data with our third-party processors as described in this statement and with other CarePay group entities supporting the platform. In addition to Nairobi, Kenya CarePay currently has operational offices in Amsterdam, the Netherlands, and Lagos, Nigeria. All CarePay group entities apply appropriate safeguards using commercially reasonable efforts and are a party to a data sharing agreement with clauses safeguarding data privacy. CarePay is sometimes obliged to provide personal data pursuant to legal obligations, such as public investigations.
How do we protect your data?
We collect your data in pseudonymised form as much as possible. We further use commercially reasonable efforts in applying various technical and organisational measures to prevent the personal data from being misused. These measures include for example the encryption of data and training our employees on data privacy.
Where is personal data processed and for how long?
The CarePay platform is hosted on AWS’ European cloud servers and as such platform data is processed in Europe. Other third-party processors supporting our platform, such as Google Analytics, process data on their own servers which may have various locations. Data is also processed in CarePay’s various offices. In each case, all processing is subject to contractual clauses safeguarding data privacy and is only done for as long as necessary for the purpose of developing, operating, and improving the platform. You can contact us for any further information on this.
Third-party websites and the internet
Our platform may contain links to third-party websites. If you follow a link to any of these websites, please note that these websites have their own privacy policies and we do not accept any responsibility or liability for these websites or policies. The transmission of information over the internet is not completely secure. If you provide us with information over the internet, any transmission is at your own risk. However, once we receive your information, we use commercially reasonable efforts to prevent unauthorised access to your personal data.
What rights do you have?
CarePay considers it important that platform users can properly exercise their rights under data protection laws. In summary, you have the following rights:
- The right of access: you have the right to see which of your personal data we process.
- The right of rectification: if your personal data we process are not correct, you have the right to have them adjusted.
- The right of erasure: if we no longer need your personal data for the purpose for which they were collected, you have the right to ask us to delete them. There are several exceptions to this, such as our obligation to retain certain data, for example for statutory legal or tax requirements.
- The right to object: it is possible to object to the processing of your personal data, after which a balancing of interests will follow.
- The right of restriction: during the period that we are in the process of determining whether your data should be rectified, determining the unlawfulness of data processing, determining whether data should be deleted or whether you have rightfully objected to the processing, you have the right to request a restriction of the processing.
How can you contact us?
If you have any questions on the way we process your data or your rights in this respect, or have a complaint or other remark, you can contact us via privacy@carepay.com. This will put you in contact with our Data Protection Officer who is appointed to safeguard compliance with the KDPA.
If you have any questions or issues on the CarePay platform, you can contact our customer support via 0800 721 253 and 0709 071 000.
Filing a complaint with the competent authority
CarePay finds it important to have satisfied platform users. Even though we do everything we can to achieve this, if you are not satisfied, we invite you to reach out to our customer support so we can address your concerns. When it comes to the protection of your personal data it is possible to file a complaint with the supervisory authority, being the Office of the Kenya Data Commissioner (https://www.odpc.go.ke) We would appreciate you contacting us first to give us the opportunity to address your complaint.
Modifications to platform and statement
CarePay may make changes to the platform and its functionalities and reserves the right to update this privacy statement accordingly. If the changes impact the processing of your personal data, we will inform you of such updates upon your next visit to the platform.
You can only use M-TIBA to pay bills up to the value of funds you have stored. You can transfer additional funds to your M-TIBA directly from your M-PESA following instructions provided under above item “How do I transfer funds to my M-TIBA?”
Yes. You can pay for anyone using your M-TIBA if you add them as a dependant. Dial *253#, Log in, select Settings then Add Dependant; follow instructions to add dependant. Once the dependant is added you can pay for his/her treatment and medication.
You will get an error message and you will not be able to make a payment.
The healthcare facility uses a pre-agreed price list to bill you. You are advised to confirm the cost of a service with the healthcare provider before opening your M-TIBA. However, for any questions, please call the M-TIBA Toll Free line on 0800 721253.
You will receive an SMS notification when you have opened your M-TIBA before getting treated, and another SMS when the healthcare facility has billed your M-TIBA. The SMS sent after your M-TIBA has been billed will indicate the cost of the services and medication and your new M-TIBA balance.
- Dial *253#
- Enter your M-TIBA PIN (or press 1 if you have forgotten your PIN)
- Press 1 to ‘Get Treatment’
- Select recent clinic (1, 2, 3) or enter Till Number of the clinic you are visiting (e.g. 465004)
- Press 1 to Authorise
You will receive an SMS message with a transaction number.
M-TIBA funds can be used to pay for outpatient healthcare services and medication. Prices may vary depending on the healthcare facility you choose. The range of outpatient services you can pay for depends on the services your chosen M-TIBA facility can provide and on the amount of funds stored in your M-TIBA. Users are encouraged to save as much as possible to be able to pay for healthcare services in full.
Participating healthcare facilities will carry the M-TIBA logo.
M-TIBA works with a large network of healthcare providers. You can dial *253# and select “Find Clinic” to locate MTIBA healthcare provider around you. You may also ask an M-TIBA agent for a list of healthcare facilities participating in M-TIBA in your area, or call the M-TIBA Toll Free line on 0800 721253, or visit www.mtiba.com
My Health funds or healthcare savings stored in your M-TIBA will stay safe. Your M-TIBA is secured with a PIN which should be known only to you. Do not share your PIN with anyone. My Health Funds or healthcare savings stored in M-TIBA are managed by UAP. UAP is a licensed insurance company and a medical scheme fund manager regulated by the Insurance Regulatory Authority of Kenya.
There is no maximum limit of funds you can store in M-TIBA.
The minimum amount you can transfer from M-PESA to M-TIBA is 10 Ksh.
No. There is no set minimum balance in M-TIBA.
- Dial *253#
- Enter your M-TIBA PIN (or press 1 if you have forgotten your PIN)
- Select option 2: My M-TIBA Benefits
Available M-TIBA balance will be displayed on the screen.
You can transfer funds into your M-TIBA as often as you wish. There is no limit to the number of times you can transfer funds from your M-PESA to your M-TIBA
Funds stored in M-TIBA do not expire
- Step 1 – Go to M-PESA menu then select ‘Lipa na M-PESA’
- Step 2 – Select Paybill option then enter business number: 300066
- Step 3 – Enter ‘MTIBA’ as the Account Number
- Step 4 – Enter the amount you wish to transfer to your M-TIBA then click OK to confirm
You will receive a confirmation SMS from M-PESA and another from M-TIBA. All transactions from your M-PESA to your M-TIBA are free of charge.
All transactions from your M-PESA to your M-TIBA are free of charge.
You can call the M-TIBA Toll Free line on 0800 721253. Alternatively, you can visit www.mtiba.com or email customercare@mtiba.com
All information/data in our system is secure and protected using the highest standards.
Upon notification of death, by a next of kin by availing of a copy of the death certificate, the M-TIBA account will be de-activated and the remaining funds will be sent to your M-PESA account within 5 working days.
- Step 1 – Dial *253#
- Step 2 – Enter M-TIBA PIN
- Step 3 – Select option 2: My M-TIBA
- Step 4 – Select the program you wish to leave
- Step 5 – Select option 4 Quit program
- Step 6 – Select option 1 to confirm
Our customer care team will call you within 48 hours to complete the exit process. A confirmation will be made to ensure there are no pending bills. Upon confirmation, your remaining funds will be sent to your M-PESA within 5 working days. Any remaining Bonus funds will be returned to M-TIBA and will be used as bonus for other M-TIBA users.
es. Please contact the M-TIBA Toll Free line on 0800 721253 for instructions. You will be asked to provide confidential information to verify ownership. However, you are advised to keep your M-TIBA active.
You will need to call Safaricom Customer Care and get your SIM card blocked. Then you need to get a replacement for the SIM card at your nearest Safaricom Shop. After getting your new SIM card, you can continue using your M-TIBA by dialling *253#.
M-TIBA is a health payment platform that can accommodate various sources of funding such as savings, remittances from family members, donor funding for specific (vulnerable) populations or to support specific healthcare needs, and health insurance. M-TIBA is not a risk pool and deposits in M-TIBA health-savings service are not premiums giving access to an extensive medical cover. M-TIBA only pays the medical bill to the extent of the amount available in your mobile health savings or as defined by your insurance scheme or donor program.
Mauris finibus eros eu orci iaculis laoreet. In accumsan nulla ut sagittis tristique. Morbi a sollicitudin dui, quis tincidunt purus. Pellentesque eu lacinia lacus. Vestibulum tincidunt erat ac massa gravida accumsan. Suspendisse finibus commodo arcu, sed dapibus enim tincidunt in. Suspendisse pretium mollis ex, ut auctor neque pellentesque a. Morbi vel cursus odio, at interdum lorem. Pellentesque vitae eros sapien.
Funds on MTIBA can only be used to pay for healthcare at M-TIBA providers. In the case of personal savings and MTIBA deposits from friends and relatives, if one decides to exit M-TIBA, we will pay any remaining funds back to the owner or back to the remitter respectively (withholding transaction charges)
You, your relatives or friends can dial *253# and choose “FIND CLINIC” in the main menu. Once they share the name of their location, they receive a list of providers close to them (including distance). For more information or assistance, your relatives or friend can call our customer care center (toll free and 24 hours per day): 0800721253
My Health funds or healthcare savings stored in your M-TIBA will stay safe. Your M-TIBA is secured with a PIN which should be known only to you. Do not share your PIN with anyone. My Health Funds or healthcare savings stored in M-TIBA are managed by UAP. UAP is a licensed insurance company and a medical scheme fund manager regulated by the Insurance Regulatory Authority of Kenya.
M-TIBA funds can be used to pay for outpatient healthcare services and medication. Prices may vary depending on the healthcare facility you choose. The range of outpatient services you can pay for depends on the services your chosen M-TIBA facility can provide and on the amount of funds stored in your M-TIBA. Users are encouraged to save as much as possible to be able to pay for healthcare services in full. In cases of public and private insurance schemes and donor funded programs, the range of services that can be paid for will be determined by the scheme payer.
Anyone who is a Safaricom customer above the age of 18 years is eligible to register for M-TIBA.
You must have a duly registered Safaricom SIM card and be a holder of a valid national identity card or passport.
An M-TIBA agent is an authorised person who can provide information on M-TIBA and help you with the following activities:
- Registration on M-TIBA
- Transfer funds from your M-PESA to your M-TIBA
- Provide a list of healthcare facilities participating in M-TIBA in your area
- Provide information about promotional offerings on M-TIBA
You are advised not to give cash to M-TIBA agents.
There are multiple ways to register for M-TIBA:
- Simply dial *253# and complete the steps in the menu to register
- An M-TIBA agent will visit you to help you register
- You can register from any of the facilities that carry the M-TIBA logo
- You can register by calling the M-TIBA Toll Free line 0800 721253
For MTIBA donor programs and public insurance schemes (UHC), a field agent will visit you and register you and your dependants to the program.
For private and corporate insurance schemes, your company’s HR will do the registration for you and your dependants.
No. You can only register one M-TIBA Account.
- Step 1 – Dial *253#
- Step 2 – Enter M-TIBA PIN
- Step 3 – Select option 9: Settings
- Step 4 – Select Option 1: Change PIN
- Step 5 – Enter Current PIN
- Step 6 – Enter New PIN
- Step 7 – Confirm New PIN
You will receive an SMS notification confirming PIN change “Your PIN has been changed.
Make sure you provide correct details during registration. If you notice certain details are wrong, please call the M-TIBA Toll Free line on 0800 721253 or email customercare@mtiba.com
To confirm registration status simply dial *253#
No. This option will become available in the near future. We will inform you when this is active.