Data processing agreement

This agreement is between a business that uses Miadi (a clinic, hospital, lab or pharmacy: "the business") and Miadi Technologies Limited, which operates Miadi ("we"). It applies to the personal data of the business's patients that we handle to run its assistant. An owner of the business accepts it in the dashboard under Account, and we record who accepted it, when, and which version. If you would like a signed copy, write to hello@miadi.care. It sits alongside our Terms of Service and Privacy notice. A plain-language summary is also available.

1. Who decides and who processes

The business is the data controller: it decides why and how its patients' information is used. We are its data processor under Kenya's Data Protection Act, 2019 (and similar laws where the business works). We handle patient data only on the business's instructions. Its instructions are how it sets up and uses Miadi (its hours, services, messages and settings) and anything else it asks of us in writing. If we think an instruction breaks the law, we will say so.

2. What we handle, and why

• Whose data: patients and anyone else who messages the business through Miadi.
• What data: phone number, WhatsApp profile name, the name given for a booking, appointment details, the messages exchanged, and health information a patient chooses to share, such as their symptoms, with the short summary the assistant writes for the business's team. At a pharmacy, also the customer's orders, their answers about refill reminders and back-in-stock messages, the photos and documents they send (kept at WhatsApp's provider: we keep a reference to each), and, where the pharmacy has them switched on, short summaries of those photos for the pharmacist.
• Why: to answer patients, book, change and remind them of appointments, pass what they say about their health to the business's team, and let the team follow the conversation. Nothing else: we never sell patient data or use it for advertising.
• How long: while the business uses Miadi, unless the business deletes it sooner (see 8).

3. Who at Miadi can see it

Only people who need to, to run the service, and they keep it confidential. Miadi's own tools have no screen for reading a business's chats. We open a particular chat only when the business asks us to help with it, or when we must to keep the service safe or working (for example, to stop messages going to the wrong person), and then we tell the business.

4. Keeping it safe

• Each business can see only its own patients and conversations, and only through its staff logins.
• Passwords are never stored in readable form, and sessions expire.
• The assistant never diagnoses or gives medical advice; health details are shown only to the business's team.

The security measures behind the service are listed in Annex 2, and in plain words on our Trust page.

5. Other providers we use

To run the service we use the providers (sub-processors) listed in Annex 3, with what each one does and where it handles data. Each handles patient data for the purpose listed there, under its terms with us. WhatsApp is also the patients' own app: WhatsApp (Meta) and Twilio keep their own records of messages under their own terms. Under our agreement with it, our AI provider (Anthropic) does not use the business's data to train its models.

Our email provider and Paystack (payments) never receive patient conversations. Before we add or replace a provider that handles patient data, we email the business's owners at least 14 days ahead; a business that objects can stop using Miadi.

6. Data outside Kenya

Some of these providers store or process data outside Kenya, and outside the business's own country. For a business outside Kenya, its patients' data is handled by us in Kenya and by these providers. Annex 4 sets out, for each region, how patient data sent abroad is protected, and says where a question is still with our lawyers.

7. Helping the business

• Patients' rights: owners can download or delete a patient's information from the Inbox. If a patient asks us directly, we pass the request to the business and help it answer.
• If something goes wrong: if patient data is lost, leaked or seen by someone who shouldn't see it, we tell the business without delay, and within 48 hours of finding out, with what we know and what we are doing, so it can meet its own duty to tell its data protection authority (in Kenya, the Data Commissioner).
• Questions and checks: we answer the business's reasonable questions about how we protect its data, and give it the information it needs to show it meets its own duties under the law.

8. When the business leaves

An owner can close the account at any time from Account in the dashboard. Its patients, chats, bookings, team logins and settings are then deleted straight away. Only payment records are kept, as accounting law requires, and a scrambled form of the business's own phone numbers (never patients' numbers) for 12 months from its free trial, so each number gets one free trial. Before closing, owners can download each patient's chat from the Inbox.

9. Changes

If we change this agreement, we publish the new version here with its date and ask owners to accept it again in the dashboard. The version an owner accepted stays in force for that business until they accept a new one.

Updating Annex 3 under section 5 (a provider added or replaced, or a location confirmed), or the notes in Annex 4 about where going live is on hold, doesn't change the terms you accepted. Each such update to Annex 3 is dated in that annex.

10. Transfer clauses, and the law that governs this agreement

For some regions, Annex 4 uses a set of standard clauses, such as those adopted by Commission Implementing Decision (EU) 2021/914. Those clauses say which law governs them and which courts decide disputes about them. Those choices apply to the clauses, whatever section 13 of our Terms of Service says. If this agreement and those clauses ever disagree, the clauses win. Where the clauses ask the parties to choose an option (such as the country whose law and courts apply), that choice is being confirmed by our lawyers and will be added here.

Apart from those clauses, this agreement follows section 13 of our Terms of Service: the laws of Kenya govern it, and it doesn't take away any right the business has under its own country's law that can't be excluded by agreement.

Annex 1. The processing

• The parties: the business (the controller, which sends the data) and Miadi Technologies Limited, which operates Miadi (the processor, which receives it), run from Kenya.
• Whose data, what data and why: as in section 2. It includes health information patients choose to share, which many laws treat as sensitive.
• How often: all the time while the business uses Miadi.
• How long: as in sections 2 and 8.
• Providers: as in Annex 3, for the purposes listed there.

Annex 2. How we keep the data safe

These are the measures the service takes today. We add to them as it grows.

• Passwords are never stored in readable form: we keep only a scrambled version (an scrypt hash with a random salt).
• Signing in gives a random key kept in a cookie that the page's scripts can't read, sent only over secure connections. We store only a scrambled version of the key, and sessions expire.
• Only Miadi's named admins can open our admin area, and repeated wrong passwords are slowed down.
• Each business sees only its own patients and chats. A patient's details can only be downloaded or deleted by the business they wrote to.
• Every table in our database has row level security switched on with no public rules, so the database's public web access can't read any of it.
• Messages and payment notices that Twilio, WhatsApp and Paystack send us are checked against their signature. Any that don't match are refused.
• Sign-in, sign-up, password reset and other forms limit how often they can be tried, which slows down guessing.
• Sensitive actions, such as downloading or deleting a patient's data, are recorded in an audit log, without patient names, numbers or messages.
• Owners can download everything Miadi keeps about a patient, or delete it from Miadi for good, from the Inbox. We also ask Twilio or WhatsApp (Meta), whichever carried them, to delete the photos and documents the patient sent. WhatsApp and Twilio keep their own records under their terms.
• Regular clean-ups delete ended sign-ins, the website demo's chats after a day, and the WhatsApp demo's scrambled phone numbers after two days.
• A booking's private link stops showing any details 30 days after the visit.
• Push alerts on the team's phones and computers, and alert emails, carry no patient names and nothing a patient wrote: the team opens Miadi to see them.
• Our test site refuses to use the live database, so testing never touches businesses' records.
• Every page is sent with security settings that stop other sites showing it inside theirs and stop browsers guessing file types.
• The connection between our servers and the database is encrypted.

Annex 3. Our providers (sub-processors)

Last changed on 31 October 2026.

Providers marked "No" never receive the business's patients' data. We list them so the business sees every provider we use. Before we add or replace a provider that handles patient data, we email the business's owners at least 14 days ahead; a business that objects can stop using Miadi.

Annex 4. Data sent abroad

We run Miadi from Kenya and our providers are in other countries (Annex 3), so for most businesses their patients' data leaves their country. This is how it is protected, by where the business is:

• The European Union and the European Economic Area (Regulation (EU) 2016/679, Article 46): The standard contractual clauses adopted by Commission Implementing Decision (EU) 2021/914 apply between the business and us (Module 2, controller to processor). When we pass the data on to a provider outside the EU or EEA, Module 3 of the same clauses (processor to processor) or another safeguard Article 46 allows applies. The options these clauses leave to the parties (the governing law, the courts and the supervisory authority) are being confirmed by our lawyers (section 10). We are confirming that each provider's terms with us include one of these safeguards.
• The United Kingdom (Data Protection Act 2018, and the UK's version of Regulation (EU) 2016/679): The same clauses apply, together with the International Data Transfer Addendum to the EU Commission Standard Contractual Clauses issued by the UK Information Commissioner. The Addendum's tables are being confirmed (section 10).
• Switzerland (Federal Act on Data Protection of 25 September 2020, Article 16): The same clauses apply, with the changes the Swiss Federal Data Protection and Information Commissioner asks for, such as that Commissioner as the authority for data from Switzerland. The details are being confirmed (section 10).
• Brazil (Lei Geral de Proteção de Dados (Law No. 13.709/2018), Article 33): The standard contractual clauses approved by Brazil's data protection authority (ANPD Resolution CD/ANPD No. 19 of 23 August 2024) apply.
• South Africa (Protection of Personal Information Act 4 of 2013, section 72): This agreement binds us to protect the data as the Act's conditions do (section 72(1)(a)). We are confirming that each provider's data processing terms bind it to protect the data too. Whether sending health data abroad also needs the Information Regulator's prior authorisation (section 57) is being reviewed by our lawyers.
• Nigeria (Nigeria Data Protection Act 2023, sections 41 to 43): This agreement is a contract that protects the data (section 41). We are confirming that each provider's data processing terms do the same.
• The United Arab Emirates (Federal Decree-Law No. 45 of 2021 on the Protection of Personal Data, Articles 22 and 23): This agreement is a contract that protects the data. We are confirming that each provider's data processing terms do the same. Federal Law No. 2 of 2019 on the use of information technology in health fields (Article 13) restricts storing or sending health data outside the UAE. Going live is on hold there for now: businesses in the United Arab Emirates can sign up, set up and try their assistant, but patients can't write to them through Miadi until local health-data rules are cleared.
• Saudi Arabia (Personal Data Protection Law, Article 29, and its Regulation on Personal Data Transfer outside the Kingdom): The Regulation lets data go only to places it allows, or with the safeguards it lists, such as the standard contractual clauses issued by the Saudi Data and Artificial Intelligence Authority. Which of these we will use is being confirmed while going live is on hold there. Going live is on hold there for now: businesses in Saudi Arabia can sign up, set up and try their assistant, but patients can't write to them through Miadi until local health-data rules are cleared.
• India (Digital Personal Data Protection Act, 2023, section 16): Data may go abroad unless the Government of India restricts the country it goes to. We follow any such restriction.
• Kenya (Data Protection Act, 2019, sections 48 to 50): We are putting together a record of the safeguards for each provider, to give the Data Commissioner if asked (section 48). Patients' messages can include health details, which the Act treats as sensitive. The Act says sensitive data may go out of Kenya only with the patient's consent and proper safeguards (section 49). Whether that consent must be asked for here, who asks for it (the business or us) and how it is recorded is being reviewed by our lawyers. Miadi doesn't ask patients for it yet.
• Any other country (The data protection law of the business's country): Ask us. We will tell you how your patients' data is protected, and add your country here.