Privacy notice for tibaiq.com

Last updated 22 October 2026

This notice explains how TibaIQ handles personal data collected through this website, in line with the Kenya Data Protection Act, 2019 and the Data Protection (General) Regulations, 2021. It covers the website only. It does not cover patient data processed in the TibaIQ platform for hospitals, which is governed by each customer’s agreement with TibaIQ.

1. Who is responsible for your data

The data controller for this website is:

Controller: TibaIQ, Westlands, Nairobi, Kenya
Privacy contact: Data Protection Officer, through the request form, starting your message with “Privacy”

2. What we collect

When you request a demo, we collect:

your name, work email address, phone number and role;
your organisation’s name, facility type, number of facilities and country;
if you choose to tell us, the system your organisation uses today;
anything you choose to write in the message field;
the topic you came from, if you followed a link such as “Ask about revenue cycle”;
your consent, with the date and time you gave it and the version of the consent wording.

With each request we also keep:

a random request reference, which is shown to you, and a one-way fingerprint of the request, so a repeated submission is not saved twice;
the follow-up status of your request and a short log of what happened to it (for example, when it was submitted);
a one-way, salted fingerprint of your email address, so we can limit how many requests one address makes.

To protect the form from abuse we also process:

a one-way, salted hash of your IP address (for IPv6, of its network prefix), used to limit repeated submissions. It is kept separately from your request, and we never store the IP address itself;
a Cloudflare Turnstile security check, which Cloudflare runs in your browser to tell people from automated traffic.

We do not collect patient or clinical information through this website. Please do not include any in your message. If you do, we delete it.

We do not use advertising or analytics cookies on this website.

3. Why we use it and our lawful basis

To respond to your demo request and arrange a demonstration: based on your consent, which you give with the checkbox on the form.
To follow up about TibaIQ for the organisation you represent, such as sending a quote you asked for: based on your consent.
To keep the form secure and prevent spam: based on our legitimate interest in protecting our systems.

We do not sell your data and we do not use it for automated decision-making or profiling.

Cloudflare, Inc. hosts this website, stores demo requests in its D1 database and runs the Turnstile check, as our data processor.
The TibaIQ platform. Demo requests can be copied into TibaIQ’s own customer records system so our team can follow up. This is currently switched off; we update this notice before switching it on.
Authorities, where the law requires it.

5. Transfers outside Kenya

Demo requests are stored in a Cloudflare data centre in Western Europe, and Cloudflare’s network may process requests in other countries. We rely on Cloudflare’s Data Processing Addendum, which incorporates standard contractual clauses and appropriate technical and organisational safeguards, as required by Part VI of the Act.

6. How long we keep it

Demo requests, with the reference and fingerprints stored alongside them: 24 months after our last contact with you, unless you become a customer or ask us to delete them sooner.
Hashed IP addresses used for rate limiting: deleted once they are more than 24 hours old. Deletion runs each time the form is used and, during quiet periods, at least every 30 days.

7. Your rights

Under the Act you have the right to:

be informed of how your data is used (this notice);
access the personal data we hold about you;
object to the processing of your data;
have inaccurate or misleading data corrected;
have data deleted where we no longer have a lawful reason to keep it;
withdraw your consent at any time, without affecting processing that took place before; and
receive your data in a portable format.

To use any of these rights, use the request form and start your message with “Privacy”. We respond to access requests within 7 days, to requests for correction or deletion within 14 days, and to portability requests within 30 days, as set by the Data Protection (General) Regulations, 2021. If you are not satisfied with our response, you can complain to the Office of the Data Protection Commissioner at www.odpc.go.ke.

8. Security

The form is served only over HTTPS. Demo requests are stored in a database that is not publicly accessible, and access is limited to the TibaIQ team members who follow up on requests.

9. Changes to this notice

We post any changes on this page and update the date at the top.

10. Contact

Questions about this notice or requests about your data: use the request form and start your message with “Privacy”.