Privacy Policy

1. Who We Are

E-Vive is operated by Star Delight Enterprises Ltd, a company registered in Kenya (the “Company”, “we”, “us”, or “our”). Our registered office is at Mugoya Phase 4, Nairobi, Kenya.

E-Vive is a location-based homecare matching platform that connects families and individuals (“Clients”) with verified HomeCare Assistants (“HCAs”). We are the data controller for personal data processed through our platform and website at e-vive.co.ke.

2. Data We Collect

We collect the following categories of personal data:

• Identity data: full name, date of birth, national ID number, passport (for international travel-enabled HCAs), profile photograph.
• Contact data: mobile phone number, email address, physical address, sub-county.
• Health data: patient care requirements, medical conditions relevant to care planning, medication schedules (entered into the Cardex by HCAs with client consent).
• Employment data (HCAs): professional certificates, training records, employment history, references, DBS/police clearance certificate.
• Location data: GPS clock-in and clock-out coordinates, shift location history.
• Financial data: M-Pesa phone number for payroll; invoice and payment records.
• Usage data: pages visited, features used, device type, browser, IP address.

3. How We Use Your Data

We use personal data for the following purposes:

• To match Clients with suitable, verified HCAs in their area.
• To verify HCA qualifications, identity, and criminal record status.
• To facilitate the digital Cardex - the shift record updated by HCAs and shared with families.
• To process payments and maintain financial records.
• To communicate with you about placements, schedules, and platform updates.
• To ensure the safety and quality of care through GPS verification and incident reporting.
• To comply with our legal obligations under Kenyan law.
• To improve our platform through anonymised, aggregated usage analytics.

We do not use your data for automated decision-making or profiling that produces significant legal effects without human review.

4. Sharing Your Data

We share personal data only where necessary:

• Between Clients and HCAs: Name, contact details, and care requirements are shared to facilitate the placement and ongoing care relationship.
• Service providers: We use Supabase (database hosting), Vercel (web hosting), and M-Pesa (payments). All processors are contractually bound to protect your data.
• Legal obligations: We may disclose data to regulatory or law enforcement authorities if required by Kenyan law or court order.

We do not sell personal data to third parties. We do not share data with advertisers.

5. Data Retention

We retain personal data for the following periods:

• Active accounts: for the duration of the active placement or account relationship.
• Cardex records: 7 years from the date of the last entry, to comply with Kenyan healthcare documentation standards.
• Financial records: 7 years, as required by the Kenya Revenue Authority.
• Inactive accounts: 2 years from last login, after which data is anonymised or deleted.

6. Your Rights

Under the Kenya Data Protection Act 2019, you have the right to:

• Access the personal data we hold about you.
• Correct inaccurate or incomplete data.
• Delete your data (subject to retention obligations).
• Object to processing where we rely on legitimate interests.
• Withdraw consent for any processing based solely on your consent.
• Data portability - receive your data in a machine-readable format.

To exercise any of these rights, contact us at hello@e-vive.co.ke. We will respond within 21 days as required by law.

7. Cookies & Tracking

We use essential cookies to maintain your session and platform preferences. We do not use third-party advertising cookies. Analytics cookies (where used) are anonymised and can be disabled in your browser settings.

Local storage is used on the HCA dashboard to maintain session state. This data does not leave your device and is cleared on logout.

8. Security

We implement industry-standard technical and organisational measures to protect your data, including TLS encryption in transit, AES-256 encryption at rest, row-level security on our database, and access controls limiting who can view sensitive patient data.

In the event of a data breach that is likely to result in risk to your rights and freedoms, we will notify the Office of the Data Protection Commissioner and affected individuals within 72 hours of becoming aware of the breach.

9. Children's Privacy

Our platform may process data relating to child patients where parents or guardians have engaged E-Vive for paediatric or child care services. In such cases, consent is obtained from the parent or legal guardian. We do not knowingly collect personal data from children under 18 for account registration without parental consent.

10. Changes to This Policy

We may update this Privacy Policy from time to time. Material changes will be communicated by email or a prominent notice on the platform. Your continued use of E-Vive after such notice constitutes acceptance of the updated policy.

11. Contact Us

For privacy-related enquiries, data subject requests, or to report a concern:

• Email: hello@e-vive.co.ke
• Post: Data Protection Officer, Star Delight Enterprises Ltd, Mugoya Phase 4, Nairobi, Kenya
• Phone: +254 141 888 340

You also have the right to lodge a complaint with the Office of the Data Protection Commissioner of Kenya (odpc.go.ke) if you believe your rights have been infringed.