Safari HMIS

Privacy Policy

Version 1.0 | Last updated 14 October 2026

This policy explains how Tangikel Solutions Limited ("Tangikel") handles personal data in connection with Safari HMIS, its health management information system. Safari HMIS is used by healthcare facilities. Patients do not use it directly. The facilities decide how their patients' data is used. This policy is written for facilities, regulators and certification reviewers.

Who Tangikel is

Tangikel Solutions Limited supplies, hosts (through sub-processors) and supports Safari HMIS. The company is based in Nakuru, Nakuru County, Kenya. Tangikel is registered with the Office of the Data Protection Commissioner (ODPC) as a data controller and data processor.

Our roles: processor and controller

Tangikel as processor. Each healthcare facility that uses Safari HMIS is the data controller for its patients' data. It decides why and how that data is used. Tangikel is the data processor. We supply the system, arrange its hosting and support it, and we handle patient data only on the facility's documented instructions.

Tangikel as controller. Tangikel is the controller only for its own business data:

• user accounts of facility staff, including name, work contact details, role and branch;
• sign-in records and audit records of use of the system;
• support tickets and the messages exchanged to resolve them;
• contact details of client organisations and their representatives.

A facility's own privacy policy, not this one, tells its patients how the facility uses their data.

Personal data processed on facilities' behalf

What Safari HMIS holds depends on the modules a facility uses. The categories are:

• Patient identity and contact data: name, date of birth, sex, phone number, optional national ID number, and the details of a parent or guardian for a child.
• Health data (sensitive): laboratory orders and results, radiology orders, reports and imaging study identifiers, clinical notes, diagnoses coded to ICD-10/11, prescriptions and dispensing records.
• Insurance and payment data: insurer and member details for insured patients, bills, payments, M-Pesa payment references and claims.
• Referrer data: details of referring clinicians and corporate clients.
• Staff data: the facility's own employee records, if the facility uses the HR module.
• Records of changes: who viewed, changed, amended or cancelled a record, and when.

Health data is sensitive personal data. We treat all of it with the protections described below.

Purposes and the instructions-only rule

Tangikel processes a facility's patient data only to provide Safari HMIS to that facility: to run registration, billing, clinical, laboratory, imaging, pharmacy and related functions, to host and back up the data, and to support the facility's users.

Tangikel commits that it will:

• process facility data only on the facility's documented instructions;
• not use it for marketing, profiling, analytics, research or any purpose of its own;
• not sell it or share it except with the sub-processors below or as the facility directs;
• limit access to staff who need it, and bind them to confidentiality;
• return or delete the data when the contract ends, as set out in the Safari HMIS Data Retention and Disposal Policy.

The terms between Tangikel and each facility are set in a written agreement.

Sub-processors and connected services

Tangikel uses a small number of sub-processors to deliver Safari HMIS: a cloud hosting provider for the production application and database, a cloud storage provider for database exports, and a cloud mailing service for emails sent on a facility's behalf, including results. Each is bound by written terms and receives only the data needed for its service.

A facility may also connect Safari HMIS to third-party services it chooses, such as imaging (PACS), insurance claims and mobile-money payments. Each receives only the data needed for its purpose.

Tangikel plans to connect Safari HMIS to the Kenya Health Information Exchange (KHIE) of the Digital Health Agency, and to the Social Health Authority (SHA) for claims. These connections are not live. Tangikel will update this policy before they are.

Tangikel will inform facilities before it adds or replaces a sub-processor.

Data location and transfers

Safari HMIS is a hybrid deployment. The production system is hosted by a cloud provider in South Africa. Database exports are stored in France and Canada. This means data is held outside Kenya.

A Kenyan serving copy is being set up. A local server in Kenya holds backup copies today. It is to become a local replica by the end of October 2026, and to take over as the primary system over time, kept in step with the cloud.

Tangikel commits to these safeguards for data held abroad:

• written terms with each hosting and storage provider, which Tangikel will complete by 30 November 2026;
• telling the ODPC where cloud copies are held;
• encryption of data stored and in transit, described below;
• limits on who can reach the stored data.

Security

Safari HMIS protects personal data with these measures:

• Access control: unique user IDs, role-based access by branch, and multi-factor sign-in (password plus a one-time code) for staff accounts.
• Automatic logoff: sessions end after a period of inactivity.
• Encryption: the production database and its backups are encrypted at rest, and connections to Safari HMIS are encrypted in transit.
• Audit trail: changes to records are recorded, and result amendments are kept as new versions.
• Backups: regular backups, with a copy held off-site.
• Controlled release: laboratory results are approved before they are released.
• Test data: development and test copies have personal details replaced before use.
• Staff: Tangikel staff with access to facility data are bound by confidentiality.

These measures are described in more detail in Tangikel's security documents for Safari HMIS. Tangikel reviews them regularly and records the actions it takes to strengthen them.

Retention

Facility data. Each facility decides how long it keeps its patients' data and tells Tangikel. Safari HMIS does not delete records automatically today. Tangikel plans a retention job, due 31 March 2027, to apply each facility's schedule. Tangikel also recommends a default schedule, which is proposed and awaiting confirmation by counsel.

Tangikel's own records. Tangikel keeps its own business data (accounts, sign-in and audit records, support tickets, client contacts) and its technical copies for the periods in the Safari HMIS Data Retention and Disposal Policy.

When a contract ends, Tangikel returns the facility's data and then deletes it, as that policy sets out.

Data subject requests

Patients exercise their rights, such as access, correction, objection and deletion, with the facility that holds their data, because the facility is the controller. If a patient contacts Tangikel, we will refer them to the facility and will not act on the request ourselves.

Tangikel commits to help each facility answer a request, including by finding and exporting the data held in Safari HMIS. The target is that a patient receives a copy of their data within 7 days of the request. Facilities can correct patient details in Safari HMIS, and each correction is recorded.

People whose data Tangikel holds as controller, such as facility staff with accounts, can send requests to [email protected]. They may also complain to the ODPC.

Breach notification

If Tangikel becomes aware of a personal data breach affecting facility data, it will:

1. contain the breach and record what happened;
2. tell the facility within 48 hours of becoming aware, with the facts it has and the steps taken;
3. help the facility investigate and notify.

The facility, as controller, notifies the Data Commissioner within 72 hours and tells affected patients in writing. For a breach of its own business data, Tangikel notifies the Data Commissioner and the people affected itself.

Children's data

Safari HMIS holds children's records for facilities, with the details of a parent or guardian on the child's record. The facility is responsible for obtaining consent from the parent or guardian, and for deciding how long a child's record is kept. Tangikel recommends keeping a child's record until the child's 25th birthday if that is later than the standard period. Tangikel processes children's data under the same rules and protections as all other facility data and never for its own purposes.

Changes to this policy

Tangikel will review this policy at least every 12 months, and when its services, sub-processors or the law change, for example when Safari HMIS connects to KHIE and SHA. The version and date are at the top. Tangikel will tell client facilities about changes that affect them.

Contact