Privacy Policy

Ventcare (ventcare.org) is a Kenyan platform that connects people with therapists, counselling centres and recovery providers, and processes session payments through M-Pesa. For the personal data described here, Ventcare acts as a data controller under the Kenya Data Protection Act, 2019 (the "Act"). Providers who deliver your care are separate data controllers for their own clinical records.

• Account data: name, email, phone number and password (stored hashed).
• Booking data: chosen provider, session time and mode, reason for the session and any notes you add.
• Payment data: M-Pesa phone number, amount, reference and receipt number. We never see or store your M-Pesa PIN.
• Sensitive (health) data: mood check-ins, journal entries, safety plans, assessment answers and crisis requests — only when you choose to give them.
• Provider data: identity, qualifications, registration and licence details, certificate of good conduct and payout details.
• Technical data: device and browser type, IP address and essential cookies needed to keep you signed in.

• To create your account and book, schedule and remind you of sessions — performance of a contract.
• To process M-Pesa payments, settle providers and keep financial records — contract and legal obligation.
• To verify providers and protect clients, including children — legitimate interest and legal obligation.
• To store and share health information you give us with the provider you choose — your explicit consent, which you can withdraw at any time.
• To respond to a crisis request where life may be at risk — vital interests.
• Optional analytics to improve the site — consent via the cookie banner.

We share booking details only with the provider you book. We use trusted processors for hosting, email delivery and M-Pesa payment processing (Kopo Kopo / Safaricom), bound by contract to protect your data. We never sell your data and never share your mental-health information with employers. Corporate sponsors see only anonymised, aggregated usage.

Some processors store data outside Kenya. Where that happens we rely on appropriate safeguards as required by section 48 of the Act.

• Account data: while your account is open, then deleted within 90 days of a deletion request.
• Payment and tax records: 7 years, as required by Kenyan tax law.
• Booking history: 2 years after your last session, then deleted or anonymised.
• Journals, mood check-ins and safety plans: until you delete them or close your account.
• Crisis and safeguarding records: up to 7 years where needed to protect a person or meet a legal duty.
• Unpaid booking attempts: 30 days.

Under section 26 of the Act you have the right to:

• be informed of how your data is used;
• access the personal data we hold about you;
• object to processing, including for marketing;
• have false or misleading data corrected;
• have data deleted where we no longer have a lawful reason to keep it;
• withdraw consent at any time, without affecting earlier processing;
• receive your data in a portable format.

Email notify@ventcare.org with the subject "Data request", or call 0713 668 405. Tell us which right you want to use. We will confirm your identity and respond within 7 days (extendable once where the request is complex, and we will tell you why).

You can also delete journal entries and safety plans yourself from My Ventcare.

Data is encrypted in transit, access is limited by role, and staff access to sensitive records is logged. If a breach is likely to put you at risk we will notify the Office of the Data Protection Commissioner within 72 hours and tell you without delay.

We use essential storage to keep you signed in and remember your choices. Optional analytics only run if you accept them in the cookie banner. You can change your choice by clearing site data in your browser.

People under 18 may only book with the consent of a parent or guardian, and only with providers who have completed Ventcare's safeguarding checks.

If you are unhappy with how we handle your data, contact us first. You may also complain to the Office of the Data Protection Commissioner (ODPC), Kenya, at odpc.go.ke.