1. Who we are

Convo Africa Ltd (“Convo Africa”, “we”, “us”) is a social enterprise registered in Kenya and based in Ruiru. We are the data controller for personal data collected through convo.africa and its sub-sites, our WhatsApp channels and our events.

This policy covers convo.africa (including the Shop, Magazine, Stories, Knowledge Hub, Help, Programmes and contact pages), Convo E-Therapy (e-therapy.convo.africa), Convo Academy (academy.convo.africa), our newsletter, our WhatsApp channel and community group, and our social media pages.

Doctor’s Bench EHR (doctorsbench.care) has its own privacy notice. When practitioners keep client records there, the practitioner is the controller and we process that data on their behalf.

We process personal data in line with Kenya’s Data Protection Act, 2019. Questions go to privacy@convo.africa.

Convo Africa is not an emergency service. If you or someone else is in danger, call 999 or 112.

2. What we collect

We collect only what each service needs. Most of it you give us directly.

• Contact form: name, email, phone or WhatsApp (optional), topic, message and your consent.
• Newsletter and issue alerts: email address, sign-up date, and open and click activity.
• Programme sign-ups such as He Matters: first name, phone or WhatsApp, and location.
• Partnership enquiries: organisation, contact name, email, phone (optional), area of interest and message.
• Shop orders: full name, phone, delivery option and address, order details and payment confirmation.
• E-Therapy: name, contact details, age, the concerns you share, therapist match preferences, bookings and payments, and your therapist’s session notes.
• Youth therapy (13–17): the above, plus a parent’s or guardian’s name, contact details and consent.
• Academy: name, email, phone, organisation (if sponsored), payment, course progress and certificates.
• Practitioner applications: name, contact details, county or city, years in practice, licence number and documents, certificates, fees, languages, session types, profile photo, and two referees’ names and emails.
• WhatsApp and live chat: your phone number or chat name and the messages you send.
• Story feedback: your Yes/No rating, which is not linked to your identity.

Self-checks, such as the anxiety self-check, are completed and scored privately in your browser. Your answers and results are not saved or sent to us.

Collected automatically: IP address, browser and device type, pages visited and the referring site, through server logs and the cookies described in section 7.

From others: referees you name, an organisation that sponsors your seat, or a parent or guardian booking for a young person.

3. How we use it

• To provide the therapy, courses, programmes and orders you ask for (contract).
• To match you with a therapist and arrange sessions (contract, and your explicit consent for health information).
• To reply to enquiries, WhatsApp and chat messages (legitimate interest, or consent where you opt in).
• To send the newsletter and issue alerts (consent; unsubscribe at any time).
• To vet practitioners through licence and referee checks (legitimate interest in client safety, and legal obligation where it applies).
• To take payments, issue receipts and keep tax records (contract and legal obligation).
• To keep the site secure and understand how it is used in aggregate (legitimate interest, or consent for non-essential cookies).
• To protect someone at serious risk of harm (vital interests, and where the law requires it).

We do not sell your personal data. We do not make automated decisions about you that have legal or similarly significant effects. The therapist matcher suggests options; you and our team make the choice. We will not use your data for a new purpose without telling you first and, where needed, asking for your consent.

4. Health information and confidentiality

Information about your mental or physical health is sensitive personal data. We collect it only when you choose to share it to get support, and with your explicit consent.

• Only your therapist and the few staff who arrange your care can see it. Therapists are licensed professionals bound by their own confidentiality duties.
• We never use what you share in therapy for marketing, and never publish it.
• Stories appear on our site only with the storyteller’s written consent, and are anonymised unless they ask otherwise.

Limits to confidentiality. We or your therapist may share the minimum needed if there is a serious and immediate risk to your life or someone else’s, if a child is at risk of harm, or if a court or the law requires it. Where it is safe, we will tell you first.

5. Children and young people

Anyone under 18 is a child under Kenyan law, and we need a parent’s or guardian’s consent to process their data.

• Youth therapy (13–17): a parent or guardian must give consent before sessions start. We confirm this directly with them.
• Ages 18–24: young adults consent for themselves.
• Under 13: we do not offer services directly. A parent or guardian should contact us.

What a young person shares in sessions stays between them and their therapist, except where safety requires otherwise. If we learn we hold a child’s data without proper consent, we will delete it.

6. Who we share it with

We share personal data only with those who need it to deliver our services, under written agreements that require them to protect it:

• your matched therapist, to provide your sessions
• payment providers (M-Pesa and Paystack), to take payments; we never see your full card number
• delivery partners, to deliver shop orders
• our email, live chat and WhatsApp providers, to send messages and run conversations you start
• our website host and site software providers, to run the site and store form entries
• an organisation that sponsors your seat: only that you enrolled or attended, never what you shared in sessions
• authorities, courts or professional bodies, only where the law requires it or to prevent serious harm

Transfers outside Kenya. Some of these providers store data outside Kenya. We use them only where the Data Protection Act’s transfer conditions are met, such as appropriate safeguards in our contracts or your consent. Ask us for details at privacy@convo.africa.

7. Cookies, retention and security

Cookies. We use essential cookies to keep the site and shop cart working and to remember your language. We use analytics or chat cookies only if you accept them. You can change your choice at any time, or block cookies in your browser.

How long we keep data. We keep data only as long as we need it, then delete or anonymise it:

• therapy records and session notes: 7 years after your last session, or longer if health regulations require
• youth therapy records: until the young person turns 18, plus 7 years
• contact and partnership enquiries: 2 years after our last exchange
• newsletter subscription: until you unsubscribe
• shop and payment records: 7 years, as tax law requires
• course records and certificates: 5 years, so we can verify certificates
• practitioner applications: 6 months if unsuccessful; while listed plus 2 years if accepted
• server logs: 90 days

Security. We use encrypted connections (HTTPS), limit access to staff who need it, and protect admin accounts with strong passwords and two-factor sign-in. We keep regular backups. No system is perfectly secure. If a breach puts your rights at risk, we will notify the Data Protection Commissioner within 72 hours and tell you without delay.

8. Your rights and contact

Under the Data Protection Act you have the right to be told how your data is used, see a copy of it, correct it, ask us to delete it (unless the law requires us to keep it), object to or limit how we use it, withdraw consent at any time, and receive your data in a common format or have it sent to another provider.

To use any right, email privacy@convo.africa or WhatsApp +254 724 936 949 (Monday to Saturday, 08:00–17:00 EAT). We may ask you to confirm your identity. We will reply within 7 days and act within the time the law allows.

Complaints. Tell us first so we can put it right. You can also complain to the Office of the Data Protection Commissioner at odpc.go.ke.

Changes. We will post updates on this page with a new date. For significant changes, we will tell you by email or on the site.