Privacy Policy
Last updated: September 14, 2026
Mental health care is personal, and the information that comes with it deserves real protection. This policy explains what Mindafya collects, why we collect it, and the choices you have. We've written it in plain language on purpose — if anything is still unclear, email us at support@mindafya.com and a person will answer.
This policy covers the Mindafya website and the Mindafya mobile app. Mindafya is based in Nairobi, Kenya, and we are the party responsible for the personal data described here — the "data controller," in the language of the law. You can reach us any time at support@mindafya.com.
We collect only what we need to run the platform, and nothing more:
We use your information to run your account, connect patients with professionals, process bookings and payments, show published content to visitors, and send notifications you'd expect — like a confirmation when an appointment changes.
This is worth stating as plainly as we can. We do not sell your personal data. We do not share it with advertisers or data brokers. We do not use your health information, appointments, or session notes to target ads — not on Mindafya, and not anywhere else. There are no advertising trackers in our app or on our site.
We do use Google Analytics, to understand how people find the site and which articles and professionals they find useful. It receives the addresses of the pages you visit, your approximate location, and your device type. It never receives your health information, your appointments, or anything you write — including session notes.
It's worth being explicit about the boundary between the two:
We share data only with the services we need to operate, and each one receives only what it needs to do its job:
Naturally, when you book a session, the professional you booked with sees the details of that booking — that's the point. We may also disclose information if the law genuinely requires it, and if that ever happens, we'll tell you unless we're legally prevented from doing so.
We keep your data for as long as your account is active. If you delete your account, we remove your personal information within 30 days, except for records we're required to keep (like payment records for tax purposes) and content you published that others have built on — which we'll anonymise rather than delete.
You can ask us to delete your Mindafya account and the personal data attached to it at any time, and you don't need the app installed to do it. Email support@mindafya.comfrom the address on your account, tell us you want your account deleted, and that's enough — there's no form to hunt down and nobody will try to talk you out of it.
Either way we'll confirm the request, delete your profile, bookings, reviews, and contact details within 30 days, and tell you when it's done. The only things we hold on to are records the law requires us to keep — chiefly payment and tax records — and clinical notes your professional is independently obliged to retain under their own professional standards. We'll tell you if that applies to you.
Traffic between your device and Mindafya is encrypted with TLS, and data is encrypted at rest by our infrastructure providers. Passwords are salted and hashed. Access rules are enforced inside the database itself through row-level security, so a bug in the interface still can't hand over data that isn't yours. Our security page goes into more detail.
No system is perfect. If a breach ever affects your personal data, we'll notify you and the Office of the Data Protection Commissioner as the law requires.
Under Kenya's Data Protection Act, 2019, you have the right to ask us for a copy of the data we hold about you, to correct anything that's wrong, to ask us to delete it, to object to how we're using it, and to withdraw consent you previously gave. Email support@mindafya.comand we'll act on it within 30 days, free of charge.
If you think we've got it wrong and we haven't put it right, you can complain to the Office of the Data Protection Commissioner in Kenya. We'd rather you came to us first so we can fix it, but it's your right either way.
Mindafya is not intended for anyone under 18. We don't knowingly collect information from minors, and if we learn we have, we'll delete it.
If we change this policy in a way that matters, we'll update the date at the top and let account holders know by email before the change takes effect. We won't quietly weaken your protections.
Questions, concerns, or requests about your data all go to support@mindafya.com. A real person reads that inbox, and we aim to reply within a few working days.
