Privacy Policy
HomecareHub Limited (“HomecareHub”, “we”, “us”) is committed to protecting the personal information of our users in accordance with the Data Protection Act, 2019 (DPA) and the Data Protection (General) Regulations, 2021 of Kenya. Please read this Privacy Policy (“Policy”) carefully to understand how we process personal information.
This Policy describes how HomecareHub processes personal information of Clients, Service Providers, and visitors (“users”) in connection with our website, mobile app, and services (collectively, the “Platform”). By accessing or using the Platform, registering an account, or engaging with our services, you acknowledge that you have read and understood this Policy.
We may update this Policy periodically. Material changes will be communicated via the Platform, email, or SMS as required by law. Changes are effective as of the stated “Last Updated” date. We recommend reviewing this Policy regularly.
1. The Short Version
Information we collect
You provide most information directly (registration, bookings, verification). We also collect communications, platform activity, and automatically gathered technical data. We receive supplementary data from third-party verification vendors, payment providers, and referral sources.
Legal basis for processing
All processing is justified under lawful grounds under the DPA, including consent, contractual necessity, legal obligation, and legitimate interests.
How we use information
To operate the Platform; verify identities and credentials; facilitate bookings and payments; ensure safety and marketplace integrity; prevent fraud; communicate with you; send marketing (with opt-out); and comply with Kenyan laws and regulatory requests.
Retention
We retain personal information only as long as necessary for the purpose collected, or longer where required by law (e.g. tax, employment, or litigation records).
Children
The Platform is available to users aged 18+.
Sharing with third parties
We share data with other users (as necessary for bookings), service providers (payments, hosting, verification), regulators, law enforcement, and corporate affiliates, only as needed to operate the Platform, comply with law, or protect safety.
Where we process data
Personal information is primarily stored and processed in Kenya. Cross-border transfers (e.g. to cloud hosting or payment processors outside Kenya) comply with Section 48 of the DPA and appropriate safeguards.
External links
Third-party sites linked from our Platform are not governed by this Policy. Review their policies independently.
Security
We implement technical and organizational measures aligned with industry standards and DPA requirements to protect personal information against unauthorized access, loss, or misuse.
Your rights
Under the DPA, you have rights to access, rectify, erase, restrict processing, object, and lodge complaints with the Office of the Data Protection Commissioner (ODPC).
Contact us
Exercise your rights or ask questions via privacy@homecarehub.co.ke or our Support Centre.
The above are highlights. Please read the full Policy below.
2. Information We Collect
Information you provide
When you register, book services, complete forms, verify identity, or communicate on the Platform, we collect:
- Identity & contact: Full name, username, email, phone number, physical/billing address, date of birth, national ID/passport number.
- Profile & credentials: Profile photo, profession, qualifications, trade certificates, Certificate of Good Conduct, work history, portfolio, ratings, and reviews.
- Financial: Payment method details, M-PESA/mobile money transaction IDs, bank account details (for payouts), KRA PIN, taxpayer information.
- Communications: Messages between users, support tickets, forum posts, dispute records, and files uploaded (including care plans, invoices, photos of completed work).
- Verification documents: Government-issued ID, selfies for biometric verification, business registration (CR12), insurance certificates, and professional licenses.
Information collected automatically
When you access or use the Platform, we collect:
- Device/IP address, geolocation, browser type, OS, session duration, language/currency settings.
- Pages visited, searches, clicks, booking history, and interaction patterns.
- Cookie and tracking technology data (see Section 8, Do Not Track).
- Impression/ad engagement data (user agent, country, device info).
Information from third parties
- Verification vendors: Background check results, credential validation, fraud/risk scores.
- Payment & mobile money providers: Transaction confirmations, chargeback/dispute data from M-PESA, banks, and card processors.
- Social/login integrations: Profile data from Google, Facebook, or LinkedIn if you link accounts.
- Referrals & invites: Limited contact info when another user invites you.
- Complaints/reports: Information submitted by third parties about your conduct or activity.
- Public/commercial sources: Business registry data, professional licensing databases, and enrichment services.
3. Legal Basis for Processing (Under Kenya’s DPA)
All processing is grounded in one or more lawful bases under Section 30 of the DPA:
- Consent: For marketing, sensitive data processing, or optional features.
- Contractual necessity: To create accounts, facilitate bookings, process payments, and deliver services.
- Legal obligation: To comply with tax (KRA), labour, health professions, NCA, PSRA, POCAMLA, and ODPC reporting requirements.
- Legitimate interests: For fraud prevention, platform security, service improvement, and internal analytics, balanced against your rights and freedoms.
- Vital interests: In rare emergencies involving health/safety during service delivery.
- Public interest: When required by lawful government or regulatory directives.
For sensitive personal data (health, biometrics), we obtain explicit consent or rely on specific DPA exemptions (e.g. vital interests, legal claims, or substantial public interest).
4. How We Use Your Information
We use personal information to:
- Operate the Platform: Create/manage accounts, verify identities and credentials, facilitate bookings, process payments, enable messaging, and provide customer support.
- Ensure safety & integrity: Prevent fraud, abuse, and illegal activity; investigate complaints; enforce Terms; conduct risk assessments; and restrict access when necessary. Automated decision-making may be used for fraud detection; you may request human review.
- Improve services: Analyze usage, personalize recommendations, optimize search/ranking, and develop new features.
- Communicate: Send transactional messages, support responses, and (with consent or legitimate interest) marketing/promotional content. You may opt out of marketing anytime via unsubscribe links.
- Comply with law: Respond to lawful requests from ODPC, KRA, DCI, county governments, courts, or sector regulators; maintain statutory records; and fulfill tax/reporting obligations.
- Marketing & advertising: Promote HomecareHub via email, SMS, targeted ads, and referral programs based on your profile and activity.
We will seek fresh consent before using data for materially different purposes.
5. Retention Periods
We retain personal information only as long as necessary for the purpose collected, or as required by law:
- Active accounts: Duration of account + 7 years post-closure (for tax, contractual, and dispute resolution under Kenyan limitation periods).
- Verification documents: 3 years after last verification or account closure, whichever is later.
- Health/sensitive data: Minimum period required for service delivery + 7 years for medical/legal record retention, then securely deleted/anonymized.
- Marketing consent records: Duration of consent + 3 years post-withdrawal.
- Closed accounts: Retained as needed for fraud prevention, fee collection, legal compliance, or ongoing investigations.
- Statutory obligations: As mandated by KRA, Employment Act, or other applicable laws.
Data no longer needed is securely deleted or anonymized.
6. Children
The Platform is intended for users aged 18+.
7. Sharing Personal Information
We share data only as necessary and with appropriate safeguards:
- With other users: Username, profile, ratings, portfolio, and booking-relevant details are visible to facilitate transactions. Messaging shares limited contact info. You share at your own risk. While Terms require confidentiality, we cannot guarantee third-party compliance. Verified business Service Providers may have certain details displayed per consumer protection rules.
- To facilitate bookings: Limited Client info (e.g. first-time user flag, care needs summary) shared with Service Providers to tailor service. Scope is minimized.
- Service providers: Hosting, cloud infrastructure, payment/M-PESA processors, background check vendors, CRM, analytics, translation, cybersecurity, legal/financial advisors, and IT SaaS tools. All bound by DPA-compliant data processing agreements.
- Payment & fraud partners: Mobile money providers, banks, and fraud detection agencies to secure transactions and prevent money laundering.
- Social media & ad partners: Limited data for login, retargeting, and campaign measurement. Governed by their policies.
- Corporate affiliates: For operational, security, and promotional purposes within the HomecareHub group.
- Business transfers: In mergers, acquisitions, or asset sales, user data may transfer as part of due diligence or completion. Affected users will be notified.
8. Do Not Track
Our Platform does not respond to browser DNT signals. Use cookie settings or marketing opt-outs to control tracking.
9. External Links
Links to third-party sites (e.g. regulator pages, social media, partner tools) are not covered by this Policy. Review external privacy policies before submitting data. Tagging HomecareHub on social media subjects your post to that platform’s terms.
10. Security
We implement DPA-aligned technical and organizational measures including encryption, access controls, PCI-DSS compliance (for card payments), regular audits, staff training, and vendor assessments. However, internet transmission is inherently insecure. We cannot guarantee absolute security but commit to reasonable protection. You must safeguard your password and never share it. Report suspected breaches immediately.
11. Your Rights Under Kenya’s DPA
As a data subject in Kenya, you have the right to:
- Access: Request confirmation of processing and a copy of your data.
- Rectification: Correct inaccurate or incomplete data.
- Erasure: Request deletion where data is no longer necessary, consent is withdrawn, or processing is unlawful (subject to legal retention exceptions).
- Restrict processing: Temporarily halt processing in specific circumstances (e.g. contested accuracy).
- Object: Object to processing based on legitimate interests or direct marketing (marketing objections are absolute).
- Data portability: Receive your data in structured, machine-readable format where processing is automated and based on consent/contract.
- Withdraw consent: At any time, without affecting prior lawful processing.
- Lodge a complaint: With the Office of the Data Protection Commissioner (ODPC) if you believe your rights are violated.
To exercise rights, contact privacy@homecarehub.co.ke with sufficient detail. We will verify your identity before acting. Requests are typically resolved within 30 days as per DPA timelines. Fees apply only for manifestly unfounded/excessive requests.
Deleting user-generated content may leave residual copies in caches/archives or with other users. Deletion does not override legal retention obligations.