This Data Processing Agreement (“DPA”) is entered into between the healthcare facility or organisation subscribing to the hosted Healix HMIS (the “Customer”, acting as controller) and the Healix entity named in the subscription agreement, acting as processor. It applies to all personal data that Healix processes on the Customer’s behalf in the course of providing the service.
Where the Customer runs the HMIS on its own infrastructure, Healix does not process personal data on the Customer’s behalf and this DPA does not apply.
1. Definitions
- Applicable Data Protection Law means the data-protection law that governs the Customer’s processing — including, where applicable, the Kenya Data Protection Act, 2019, and the EU General Data Protection Regulation (Regulation (EU) 2016/679).
- Personal Data, Processing, Controller, Processor, Data Subject and Supervisory Authority have the meanings given in Applicable Data Protection Law.
- Services means the hosted hospital management information system, its support, maintenance and related services provided under the subscription agreement.
- Sub-processor means any processor engaged by Healix to process Personal Data in connection with the Services.
- Security Incident means a breach of security leading to the accidental or unlawful destruction, loss, alteration, unauthorised disclosure of, or access to, Personal Data.
2. Roles and scope
The Customer is the Controller and Healix is the Processor. The Customer determines the purposes and means of processing and is responsible for the lawfulness of the Personal Data it enters into the Services, for the instructions it gives Healix, and for obtaining any consent or providing any notice that Applicable Data Protection Law requires.
The subject matter, duration, nature and purpose of the processing, the types of Personal Data and the categories of Data Subject are described in Annex A.
3. Instructions
Healix processes Personal Data only on the Customer’s documented instructions, including those expressed by the Customer’s configuration of and use of the Services, unless required to do otherwise by law. If Healix is required by law to process Personal Data for another purpose, it will inform the Customer before doing so unless that law prohibits informing the Customer on important grounds of public interest.
Healix will immediately inform the Customer if, in its opinion, an instruction infringes Applicable Data Protection Law.
4. Confidentiality
Healix ensures that personnel authorised to process Personal Data are bound by appropriate confidentiality obligations, receive training on data protection and information security, and have access only to the data their role requires.
5. Security
Healix implements and maintains the technical and organisational measures set out in Annex B, taking into account the state of the art, the costs of implementation and the nature, scope, context and purposes of processing, as well as the risk to Data Subjects. The measures are designed to ensure a level of security appropriate to the risk, including protecting against unauthorised or unlawful processing and against accidental loss, destruction or damage.
The Customer remains responsible for the security of its own users’ credentials, for assigning roles and permissions appropriate to each user, and for enabling the multi-factor authentication the service provides.
6. Sub-processors
The Customer gives general written authorisation for Healix to engage sub-processors to provide the Services. The current list, with the purpose, categories of data and location of each, is published in the sub-processor register.
- Healix imposes data-protection obligations on each sub-processor that are no less protective than those in this DPA, and remains fully liable to the Customer for the performance of each sub-processor’s obligations.
- Healix gives notice of any intended addition or replacement of a sub-processor before that sub-processor begins processing Personal Data for the Customer, and updates the register at the same time. We update this register before a new sub-processor starts processing customer data, and we publish the date of every change.
- The Customer may object to a change on reasonable data-protection grounds within thirty days of the notice. If the parties cannot resolve the objection, the Customer may terminate the affected part of the Services without penalty.
7. Assistance with data-subject rights
Taking into account the nature of the processing, Healix assists the Customer by appropriate technical and organisational measures in fulfilling its obligation to respond to requests from Data Subjects to exercise their rights. The service provides a data-subject access export and an erasure procedure the Customer’s authorised staff can run directly; where a request requires more, Healix will assist on the Customer’s reasonable request and within the time limits the law imposes.
If Healix receives a request directly from a Data Subject relating to Personal Data it holds for the Customer, it will not respond to the substance of the request itself and will refer the Data Subject to the Customer without undue delay.
8. Security incidents
Healix notifies the Customer without undue delay after becoming aware of a Security Incident affecting the Customer’s Personal Data. The notification describes, to the extent then known, the nature of the incident, the categories and approximate volume of data and Data Subjects affected, the likely consequences, and the measures taken or proposed to address the incident and mitigate its effects.
Healix takes reasonable steps to contain and remediate the incident, co-operates with the Customer’s investigation, and provides the information the Customer reasonably needs to meet its own obligations towards Data Subjects and Supervisory Authorities. Healix does not notify Data Subjects or a Supervisory Authority on the Customer’s behalf unless the Customer instructs it to.
9. Data-protection impact assessments
Taking into account the nature of the processing and the information available to it, Healix assists the Customer with data-protection impact assessments and with prior consultations with a Supervisory Authority, where the Customer is required to carry one out for processing under the Services.
10. International transfers
Healix operates from Kenya. Where the Services involve transferring Personal Data outside the country in which the Customer operates, Healix ensures that a lawful transfer mechanism is in place — an adequacy decision, or standard contractual clauses adopted by the competent authority, supplemented where necessary by additional technical and organisational measures. The location of each sub-processor is published in the register.
11. Return and deletion
On termination of the subscription, Healix makes available to the Customer an export of its data in a structured, machine-readable format, for a period of ninety days after termination. After that period, Healix deletes the Customer’s Personal Data, including backups containing it within the regular backup rotation, unless the law requires it to be retained. Deletion of a cloud-hosted tenant removes the tenant’s database and its files; the service reports success only after verifying that both are gone.
12. Audit
Healix makes available the information reasonably necessary to demonstrate compliance with this DPA and allows for audits, including inspections, by the Customer or an auditor mandated by the Customer, subject to reasonable advance notice, during normal business hours, no more than once in any twelve-month period unless required by a Supervisory Authority or after a Security Incident, and subject to confidentiality obligations and to not disrupting the service for other customers.
13. Liability and precedence
Each party’s liability under this DPA is subject to the limitations and exclusions agreed in the subscription agreement. Nothing in this DPA limits the liability of either party towards a Data Subject or a Supervisory Authority where the law does not allow it to be limited.
If there is a conflict between this DPA and the subscription agreement on the processing of Personal Data, this DPA prevails. If there is a conflict between this DPA and the Applicable Data Protection Law, that law prevails.
14. Term
This DPA applies for as long as Healix processes Personal Data on the Customer’s behalf, and the provisions on confidentiality, return and deletion, audit and liability survive its termination.
Annex A — Details of the processing
| Subject matter | Provision of the hosted hospital management information system, including clinical, administrative, financial and human-resources modules. |
|---|---|
| Duration | The term of the subscription agreement, plus the return and deletion period in clause 11. |
| Nature of processing | Collection, recording, organisation, structuring, storage, adaptation, retrieval, consultation, use, disclosure by transmission to the Customer and its authorised users, alignment, combination, restriction, erasure and destruction — as instructed through the Customer’s use of the Services. |
| Purpose | Operating the Services for the Customer: recording and managing patient care, clinical workflows, billing, inventory, human resources, statutory reporting, and the security, support and continuity of the platform. |
| Categories of Personal Data | Identification and contact details; national or passport numbers; dates of birth; clinical records including diagnoses, prescriptions, laboratory and radiology results, vitals, maternity and inpatient records; financial and insurance records; staff employment and payroll records; account and audit records. |
| Categories of Data Subject | Patients and their next of kin or guardians; the Customer’s staff and practitioners; the Customer’s authorised system users. |
| Special categories | Health data, and where the Customer records it, data revealing racial or ethnic origin or religious beliefs — processed under the Customer’s responsibility and the legal bases the Customer relies on. |
Annex B — Technical and organisational measures
Healix maintains the following measures, which are described in more detail in the Security & Trust statement:
- Isolation: a separate database and file store for each customer instance; application tenant checks on every request.
- Access control: role-based permissions checked server-side, per-module licensing, and multi-factor authentication for administrative accounts.
- Encryption: transport encryption for every connection, and field-level encryption of identifiable patient data at rest.
- Auditability: an append-only, hash-chained audit log of access to and changes of records, with per-user attribution.
- Availability and recovery: automated pre-deployment database backups, transactional database writes, and documented restore procedures.
- Secure development: code review, isolated staging environments, parameterised database access, and server-side validation of data-entry and API requests.
- Vendor management: written data-protection terms with every sub-processor and a published register of them.
- Incident response: a documented procedure to contain, assess and notify incidents affecting Personal Data.
Executing this DPA
Customers who need a countersigned copy, or a version naming the Customer’s legal entity and address, should write to support@healix.co.ke. We will return an executed copy for signature. This DPA is governed by the laws of Kenya, unless the subscription agreement provides otherwise.
Questions about this document? Write to support@healix.co.ke and our team will answer in writing.