Global Privacy Policy

My 1Health, the trading name of My Health Africa Group Limited (registered in Kenya) and MEA Medical Treatment Facilitation Services Limited (registered in the United Arab Emirates) ("My 1Health", "we", "us") is a global medical and wellness travel facilitator connecting patients with accredited healthcare providers across more than 20 countries on five continents. We are committed to maintaining the confidentiality, integrity, and availability of all personal data and health information entrusted to us.

This Privacy Policy explains what information we collect, how we use, share, and protect it, the legal bases on which we process it, and the rights you hold over your data. It applies to the My 1Health website, the My 1Health Booking Platform, the My 1Health Medical Practice Management System, our mobile applications, and any other services offered by My 1Health (collectively, the "Services"). It should be read together with our Terms and Conditions.

If you use the Services on behalf of someone else (such as your child or a family member in your care) or an entity (such as your employer), you represent that you are authorized by such individual or entity to accept this Privacy Policy on their behalf.

My 1Health operates internationally and aligns its data protection practices with the laws and standards applicable to our operations and to the locations of our patients and healthcare partners, including:

• The Kenya Data Protection Act, 2019 — the data protection law of the jurisdiction in which our Kenyan entity, My Health Africa Group Limited, is established. We are registered with, and answerable to, the Office of the Data Protection Commissioner of Kenya.
• The UAE Personal Data Protection Law — Federal Decree-Law No. 45 of 2021, as the data protection law applicable to our UAE entity, MEA Medical Treatment Facilitation Services Limited, established in mainland Dubai.
• The EU and UK General Data Protection Regulation (GDPR) — where we process the personal data of individuals located in the European Economic Area or the United Kingdom, or where data is stored or processed in the UK.
• The Health Insurance Portability and Accountability Act (HIPAA) — we voluntarily align our security and privacy controls with HIPAA standards as a benchmark of good practice, and apply this benchmark across all markets. HIPAA is a United States law that does not itself govern our operations; we adopt it as a standard rather than as a governing regulatory obligation. Where we act in connection with a US covered entity, we comply with any applicable HIPAA obligations.
• Local healthcare and data protection laws — in the countries where our partner hospitals and clinics operate, applicable local requirements (such as data localization, patient consent, and medical record rules) are addressed through our agreements with those providers.

Where laws differ, we apply the standard that provides the stronger protection for your data.

We only process your personal data where we have a valid legal basis to do so. Depending on the context, this will be one or more of the following:

• Consent: For the collection and processing of your health information and other special category data, we rely on your explicit consent, which we obtain at the point of intake or booking. You may withdraw your consent at any time, without affecting the lawfulness of processing carried out before withdrawal.
• Performance of a Contract: Where processing is necessary to deliver the Services you have requested — for example, coordinating your treatment, travel, and accommodation arrangements.
• Legal Obligation: Where we must process or retain data to comply with applicable laws, regulations, or lawful requests from authorities.
• Vital Interests: Where processing is necessary to protect your life or physical safety, such as in a medical emergency.
• Legitimate Interests: For limited purposes such as service improvement, fraud prevention, and security, where our interests are not overridden by your rights and freedoms. We do not rely on legitimate interests to process your health information.

Health information is special category data. We will always seek your explicit, informed consent before collecting or processing your medical information, and before sharing it with healthcare providers, insurers, or processing it through AI-assisted systems as described in this policy.

Subject to applicable law, you have the following rights over your personal data. We will respond to requests within 30 days, with a possible extension where permitted by law, and we will never charge you for a reasonable request.

• Right to Access: You have the right to access and obtain a copy of the personal data and health information we maintain about you.
• Right to Rectification and Erasure: You have the right to request correction of inaccurate or incomplete data, and deletion of your data where there is no overriding legal or medical-record obligation for us to retain it.
• Right to Information About Disclosures: You have the right to request information about how, and with whom, we have shared your personal and health information, subject to applicable law.
• Right to Restriction of Processing: You have the right to request restrictions on certain uses and disclosures of your data. While we are not required to agree to all requested restrictions, we will comply with any agreed-upon restrictions.
• Right to Data Portability: You have the right to receive the personal data you have provided to us in a structured, commonly used, machine-readable format, and to have it transmitted to another provider where technically feasible.
• Right to Confidential Communications: You have the right to request that we communicate with you through alternative means, channels, or at alternative locations. We will accommodate reasonable requests.
• Right to Withdraw Consent: You have the right to withdraw any consent previously given for the use or disclosure of your data, except to the extent that action has already been taken based on that consent.
• Rights Relating to Automated Processing and AI: You have the right to be informed when your data is processed using artificial intelligence or automated systems, to object to such processing where it is not essential to service delivery, and to request that any significant determination assisted by automated processing be reviewed by a qualified human professional. My 1Health does not make decisions based solely on automated processing that produce legal or similarly significant effects on you.
• Right to Complain: You have the right to lodge a complaint with a supervisory authority — including the Office of the Data Protection Commissioner in Kenya, or the data protection authority in your country of residence. We would, however, welcome the chance to address your concerns first through our Privacy Officer.

We may collect the following types of personal information:

• Personal Identification Information: Name, email, phone number, address, date of birth, gender, and other contact details.
• Medical Information: Medical history, treatment plans, diagnostic reports, and other health-related information.
• Financial Information: Payment information, billing details, and insurance information.
• Communication Records: Correspondence between you and our staff, including emails, phone calls, and chat logs.
• Digital Identifiers: IP address and device information.
• Travel and Accommodation Details: Flight details, passport details, hotel information, and other travel facilitation details.
• Emergency Contact Details: Next of kin/guardian name, email, phone number, and other contact details.
• AI Interaction Data: Information generated through your interactions with our AI-assisted services, including queries submitted, AI-generated responses provided to you, session metadata, and feedback you provide on AI-generated outputs.

We may collect or receive personal information about you from third-party sources to enhance our services, verify details, and facilitate health and wellness travel arrangements. These sources may include healthcare providers, insurance companies, travel agencies, referral partners, payment processors, and regulatory bodies.

Purpose of Collecting Third-Party Information:

• Facilitate medical and wellness services, including coordinating treatments, travel, and accommodations.
• Verify the accuracy of information provided by patients, referral partners, or service providers.
• Process payments, insurance claims, and financial transactions securely.
• Ensure compliance with regulatory and legal requirements in the healthcare and travel sectors.
• Prevent fraud, unauthorized transactions, or identity theft.

Your Rights Regarding Third-Party Information:

• You have the right to access and verify any third-party information we have collected about you.
• If you believe any third-party information is incorrect, you may request corrections or updates.
• Where we rely on third-party data for processing, you may request the source of the data.

Our website uses cookies and similar technologies (such as pixels, tags, and local storage) to operate the site, remember your preferences, understand how the site is used, and support our marketing. Cookies are small files placed on your device when you visit a website.

We use the following categories of cookies:

• Strictly Necessary: Required for the website to function and to provide services you have requested. These cannot be switched off in our systems.
• Functional: Remember your choices and preferences to provide enhanced, more personal features.
• Analytics and Performance: Help us understand how visitors interact with the site so we can improve it. We use Google Analytics (GA4) for this purpose.
• Advertising: Used to deliver and measure relevant advertising, including through Google Ads. These may be set by us or by third-party advertising partners.

Where required by law, we request your consent before setting non-essential cookies. You can accept, reject, or manage cookies through the consent banner presented on your first visit, and through your browser settings at any time. Withdrawing consent does not affect the lawfulness of processing carried out beforehand. Some third-party cookies are governed by the privacy policies of the third parties that set them.

My 1Health operates through three channels: direct online services, insurance partnerships, and a referral partner network. Data flows within this ecosystem are governed as follows:

• Healthcare Providers: We share the personal and medical information necessary for your assessment, treatment, and care coordination with the hospitals, clinics, and specialists you elect to use. Each provider is contractually required to protect your information in accordance with this policy and the laws of their jurisdiction, and to obtain your direct consent for any information they collect beyond what we share.
• Insurance Partners: Where you access our services through an insurance partnership, we share information with your insurer as necessary to verify eligibility, coordinate benefits, and process claims — and only with your consent or as required for the performance of your insurance arrangement.
• Referral Partners: Travel agents and other referral partners who introduce you to My 1Health provide us with your initial contact details. Referral partners do not receive your medical information from us. Any commission or referral reporting to partners is limited to non-medical booking status information.
• Service Providers and Sub-Processors: We engage vetted third parties for hosting, payment processing, communications, analytics, and AI-assisted processing. All sub-processors are bound by data processing agreements imposing confidentiality, security, and use-limitation obligations consistent with this policy. A current list of our sub-processors is available from our Privacy Officer on request.

We never sell your personal data to third parties.

Medical travel is inherently international, and your data may be transferred across borders in the course of providing our Services. Specifically:

• Your data is stored and processed on our servers in Kenya and the United Kingdom.
• Your data may be shared with healthcare providers in the destination country where you elect to receive treatment.
• Certain processing activities, including AI-assisted processing, may occur on infrastructure operated by our service providers in other jurisdictions, including the United States.

Whenever your data is transferred internationally, we ensure appropriate safeguards are in place, which may include: transfer to jurisdictions recognized as providing adequate protection; contractual protections such as standard contractual clauses or equivalent mechanisms recognized under the Kenya Data Protection Act and GDPR; and your explicit, informed consent for transfers connected to the medical services you have requested. Where our providers offer regional processing options, we assess and use them where appropriate to keep data closer to you.

Healthcare service providers may collect, process, and store personal and medical information of patients referred through our platform. This may include personal identifiable information (full name, date of birth, nationality, passport details, contact information), medical records (diagnosis, medical history, test results, treatment plans, prescriptions, physician notes), and insurance information (policy details, claim history, eligibility verification).

This information is collected solely for the purpose of providing accurate medical assessments, treatment plans, and care coordination. The healthcare provider is required to obtain your consent directly during your initial consultation for any information they collect and store, and may not share that information without your prior approval.

My 1Health integrates artificial intelligence (AI) technologies into certain aspects of its services to enhance the patient experience, improve operational efficiency, and support clinical coordination. This section describes how AI is used, the data it may process, and the safeguards we have implemented.

AI Technologies We Use

My 1Health utilizes enterprise AI services provided by established AI providers, currently Anthropic and OpenAI, to assist in various aspects of the patient journey. These AI systems may be used for:

• Patient Communication and Support: AI-powered tools may assist in responding to patient inquiries, providing information about healthcare services, facilitating appointment scheduling, and guiding patients through the medical travel process.
• Clinical Coordination Assistance: AI may be used to help summarize medical records, draft correspondence between healthcare providers, assist in treatment plan coordination, and support the preparation of patient referral documentation.
• Administrative Operations: AI tools may assist with generating reports, processing documentation, translating medical information for cross-border healthcare coordination, and streamlining internal workflows.
• Content and Information Services: AI may be used to generate or enhance health-related educational content, personalize information presented to users, and support the development of care guides and resources.

Data Processing by AI Systems

When AI systems are used in the delivery of our services, certain categories of your data may be processed, including personal identification information necessary for patient coordination, medical information relevant to the service being provided, communication records and queries you submit through our platforms, and travel and logistical details pertinent to your arrangements.

We apply the principle of data minimization to all AI processing: only the minimum information required to fulfill the specific task is shared with an AI system, and identifying details are removed or pseudonymized before processing wherever the task allows. We do not transmit your complete medical record or full personal profile to AI systems where it is not required for the service being performed. Payment card information is never transmitted to or processed by AI systems.

Enterprise Agreements and Contractual Protections

My 1Health accesses AI services exclusively under enterprise-grade commercial agreements, and never through consumer-grade accounts. These agreements provide contractual protections that materially exceed those of consumer AI services:

• No Model Training: Our agreements with our AI providers prohibit the use of data we submit for training, fine-tuning, or improving their AI models. This is a contractual commitment under the commercial terms governing our enterprise accounts, and is independent of any consumer-facing data policies those providers may operate.
• Limited Retention: Our AI providers are contractually limited to retaining submitted data only for short, defined periods necessary for abuse monitoring and service integrity, after which it is deleted. Where available and appropriate for the sensitivity of the data, we make use of zero-data-retention processing arrangements under which data is not stored by the provider beyond real-time processing.
• Confidentiality and Security: Data transmitted to AI providers is encrypted in transit using current industry-standard protocols, and any data temporarily held is encrypted at rest. Provider personnel do not access our data except as strictly required for incident resolution or as required by law.
• Executed Business Associate Agreements: My 1Health has executed Business Associate Agreements (BAAs) with its AI providers, contractually binding them to HIPAA-grade safeguards for health information, including use and disclosure limitations, security requirements, sub-processing controls, and breach notification obligations. These agreements, together with the providers' data processing terms, address the international transfer safeguards and data protection requirements of the Kenya Data Protection Act and GDPR.

We periodically review and audit the data handling practices and certifications of our AI providers (including independent attestations such as SOC 2 and ISO/IEC 27001) to verify continued alignment with our privacy commitments. Specific vendor arrangements may evolve; the protections described in this section reflect our minimum contractual requirements for any AI provider we engage.

AI Governance and Oversight

Human Oversight: AI systems used by My 1Health operate in an assistive capacity only. They do not make autonomous decisions regarding your healthcare, treatment, insurance eligibility, or access to services. All AI-generated outputs that pertain to clinical matters are reviewed and validated by qualified healthcare professionals or trained My 1Health staff before being communicated to patients or healthcare providers. My 1Health does not engage in decision-making based solely on automated processing that produces legal or similarly significant effects on you.

AI Risk Assessments: We conduct regular risk and impact assessments of our AI systems and their data processing activities, evaluating the types and sensitivity of data processed, the adequacy of security measures, the accuracy and reliability of AI outputs, and compliance with applicable regulatory requirements across the jurisdictions in which we operate.

Vendor Due Diligence and Feature Control: Before integrating any AI service, we conduct due diligence on the provider's privacy and security practices, data handling policies, regulatory compliance posture, and incident response record. We additionally maintain an internal register of approved AI features and endpoints: only features covered by our contractual data protections are permitted for use with patient information.

Staff Controls: Our employees are prohibited from processing patient information through personal or consumer AI accounts. All staff use of AI tools with patient data occurs exclusively through My 1Health's managed enterprise environment, is logged, and is governed by our internal AI acceptable use policy and training program.

Incident Response: In the event of a data breach or security incident involving AI systems, we will follow our established Incident Response Plan, including notification to affected individuals and the relevant supervisory authorities within the timelines required under applicable law, coordination with the AI provider to contain and remediate the incident, thorough investigation and documentation, and corrective measures to prevent recurrence.

Limitations of AI

• AI Is Not a Substitute for Medical Advice: AI-generated content and recommendations are for informational and operational support purposes only. They do not constitute medical advice, diagnosis, or treatment and should not be relied upon as such.
• AI Accuracy: AI systems may occasionally produce outputs that are incomplete, inaccurate, or not fully contextual. We take reasonable steps to verify and validate AI outputs, particularly those relating to patient care.
• No Autonomous Medical Decisions: AI systems do not independently make decisions about your medical treatment, insurance eligibility, or access to services. Such decisions are always made or verified by qualified human professionals.

Your Choices Regarding AI Processing

• Consent: Your explicit consent to AI-assisted processing of your health information is obtained as part of our intake consent process, and may be withdrawn at any time.
• Right to Inquire: You may contact our Privacy Officer at any time to ask whether and how AI systems have been used in processing your personal data.
• Right to Object: Where AI processing is not essential to the core delivery of our services, you may request that your data not be processed by AI systems. We will accommodate such requests, though this may affect the speed or availability of certain services.
• Right to Human Review: You may request that any significant determination assisted by AI be reviewed by a qualified human professional.

We implement industry-standard security measures, aligned with HIPAA security standards and internationally recognized frameworks, to protect the data we collect, store, and process.

• Data Encryption: Encryption in Transit — All health information transmitted over public networks is encrypted using secure protocols (TLS 1.2 or higher). Encryption at Rest — Health information stored in databases, file systems, and backup media is encrypted using strong encryption (AES-256).
• Access Controls: Role-Based Access Control (RBAC) — Access is granted on the principle of least privilege, so users only access the minimum necessary information for their roles. Multi-Factor Authentication (MFA) — Access to systems containing health information requires multi-factor authentication. Unique User Identification — Each user is assigned a unique identifier to ensure accountability and traceability.
• Audit Logs and Monitoring: Audit Logs — Detailed audit logs are maintained for all access and modifications to health information, capturing user identity, date, time, and nature of activity — including all data sent to and received from AI systems, with data classification of each interaction. Continuous Monitoring — Systems and networks are continuously monitored for unauthorized access attempts, anomalies, and potential breaches, with data loss prevention controls applied to external processing endpoints including AI services.
• Employee Training and Awareness: Privacy and Security Training — All employees receive regular training on data protection regulations (including HIPAA, GDPR, and the Kenya Data Protection Act), data privacy, and security best practices. AI Literacy Training — Staff who work with AI-powered tools receive training on responsible AI use, data minimization, recognizing AI limitations, and proper handling of AI-generated outputs.
• Data Backup and Disaster Recovery: Regular Backups — Data is regularly backed up to ensure restoration in case of loss or corruption. Disaster Recovery Plan — A comprehensive disaster recovery plan ensures rapid recovery of systems and data in the event of a security incident or natural disaster.
• Incident Response and Breach Notification: Incident Response Plan — A formal incident response plan addresses potential security breaches, including those involving AI systems or third-party processors. Notification — Security incidents involving personal data are reported to the appropriate supervisory authorities and affected individuals within the timelines required under applicable law — including the 72-hour regulator notification requirements of the Kenya Data Protection Act and GDPR where they apply.
• Physical Security: Access Controls — Physical access to data centers and facilities housing sensitive data is restricted to authorized personnel. Environmental Controls — Data centers are equipped with fire suppression, climate control, and related protections.

Your Role in Protecting Your Information:

• Use strong, unique passwords for your online accounts.
• Keep your login credentials confidential and do not share them with others.
• Be mindful of the information you share in chat interfaces or AI-assisted communication tools.
• Report any suspicious activity or unauthorized access to your account through the contact information below.

We collect payment information when you make payment transactions for health and wellness services, including consultations, medical treatments, travel arrangements, and related services. Payment information is used strictly for processing your transactions, confirming bookings, preventing fraud and chargebacks, and complying with financial and tax regulations.

• All online payments are securely processed through PCI DSS-compliant payment processors (currently Stripe and Paystack).
• Offline payment records are securely stored and accessed only by authorized personnel.
• We do not store full credit or debit card details, and retain payment transaction records only as long as necessary for financial record-keeping, audits, and regulatory compliance.
• Payment information is never transmitted to or processed by AI systems.

Consistent with our Terms of Use, you must be 18 years of age to create an account or use the Services. Individuals aged 16 to 18 (or the applicable legal age in their jurisdiction) may use the Services only under the supervision of a parent or guardian who has agreed to our Terms. Individuals under 16 may not use the Services directly; parents or legal guardians may use the Services on their behalf.

We recognize that individuals may provide personal and medical information on behalf of minors, elderly patients, or individuals unable to provide their own consent due to medical conditions or disabilities. We take special precautions with such data, using it only for medical treatment coordination, travel and logistical arrangements, insurance and payment processing, and legal and regulatory compliance (including child protection laws).

Precautions include:

• Encrypted storage in compliance with healthcare data security regulations
• Access restricted to authorized personnel (healthcare professionals, legal representatives, or appointed family members)
• Retention only as long as necessary for medical, legal, or regulatory reasons with deletion or anonymization on request unless required by law
• Enhanced human review of any AI-assisted processing involving minors or vulnerable individuals

We may use and disclose your health information for the following purposes:

• Treatment: Sharing with healthcare providers involved in your care to ensure you receive appropriate medical treatment and services.
• Payment and Reconciliations: Billing and collecting payment for healthcare services, which may include sharing with insurance companies and other third-party payers.
• Healthcare Operations: Internal operations including quality assessment and administrative activities.
• Appointment Reminders and Health-Related Benefits: Contacting you with reminders or informing you about relevant health-related benefits and services.
• Business Associates and Processors: Sharing with third parties who perform services on our behalf (billing, legal, administrative, or technology services), all of whom are bound by data processing agreements to protect your information to the standards of this policy.
• AI-Assisted Service Delivery: Processing through AI systems as described in this policy, with your consent and subject to the safeguards described herein.
• Health and Safety: Disclosure to prevent or lessen a serious and imminent threat to the health or safety of a person or the public.
• Legal Requirements: Disclosure to third parties where permitted or required by applicable law.

We retain personal data for as long as you have an active relationship with us or as necessary to provide the Services. Medical records and related information may be retained for longer periods where required by healthcare record-keeping laws in the relevant jurisdictions, or where necessary to comply with legal obligations, resolve disputes, prevent fraud, or enforce our agreements. Thereafter, data is deleted or retained only in anonymized or aggregated form that cannot identify you. AI interaction data held by our providers is subject to the limited retention arrangements described in the AI section of this policy.

You have the right to withhold personal data, but doing so may affect the service we can provide:

• Incomplete Service Delivery: Without necessary data, we may be unable to coordinate effectively with healthcare providers, delaying treatment arrangements.
• Reduced Quality of Care: Inadequate medical information may prevent providers from delivering appropriate and timely care.
• Limited Insurance Assistance: Missing insurance information may hinder coverage verification and claims facilitation, leading to potential out-of-pocket expenses.
• Compliance Constraints: Missing required data may impede our compliance with legal obligations, possibly resulting in delays or denial of services.
• Communication Barriers: Inaccurate contact information may cause delays in important updates and coordination.
• Limited AI-Assisted Services: Declining AI-assisted processing may result in longer processing times for certain services.

For questions about this policy, or to exercise any of the rights listed above, please contact our Privacy Officer:

If you are located in the EEA or UK and have unresolved concerns, you may also contact the supervisory authority in your country of residence.

We reserve the right to change this Privacy Policy at any time. Changes will be effective upon posting of the revised policy, and we will notify you of material changes in the way we handle your health information — including any material changes to how AI systems are used in processing your data. Where a change would materially expand the processing of your health information, we will seek fresh consent where required by applicable law.