💡 律咖编者按：
本文由律咖网社群读者 dolioletta 投稿分享。
为了方便大家阅读，律咖网编辑 JingJing（微信：lvga2015）对原文进行了细致的逻辑润色与合规性整理。希望能给正在 肯尼亚 创业路上的你带来真实的参考。

I never thought I’d be writing about a school fire in Voi while trying to figure out how to protect my team’s medical records.

I’m dolioletta—29, from Beining, Liaoning, graduated in Tourism Management, now knee-deep in excavator market research in Kenya. I came here with a loan on my back, a laptop, and too much hope. I didn’t plan to become someone who thinks about data privacy. But after last week’s tragedy at Utumishi Girls School in Gilgil—where at least 16 students lost their lives in a dormitory fire—I can’t stop thinking about what happened to their health records.

The news outlets reported the horror: 16 dead, 79 injured. Emergency teams rushed in. Psychologists arrived. The president spoke. All of it was raw, human, necessary. But buried in the aftermath was something quieter—and far more dangerous for foreign operators like me: what happened to the digital medical files of those girls?

I work with a small Kenyan logistics team. We have three staff members who are students at local schools. I pay for their health insurance through a local clinic. We keep a basic spreadsheet—name, blood type, allergies, emergency contacts. It’s not fancy. But it’s on a shared Google Drive folder. Password-protected? Yes. Encrypted? Not really. Backed up? Sometimes.

I used to think: It’s just basic info. No one’s going to hack it.
Then I saw the headlines. And I realized: in a country where infrastructure is fragile, where fire can turn a dormitory into a tomb in minutes, digital data doesn’t vanish—it just becomes untraceable.

I called a local friend who works at a hospital in Nairobi. He said: “In Kenya, most private clinics still use paper charts. But the ones that digitize? They often use whatever software the intern downloaded from a blog. No compliance. No audit. No one checking if it’s even legal.”

That’s when it hit me: I’ve been treating medical data protection like an IT problem. It’s not. It’s a human safety issue.

I used to believe client satisfaction meant delivering equipment on time. Now I see it’s also about ensuring that if something goes wrong—whether it’s a fire, an accident, or a sudden illness—your team’s most personal information isn’t lost, leaked, or left in the ashes.

I spent two nights thinking about this. Not because I’m a compliance officer. But because I’m a guy who owes $2,800 a month on a tractor I haven’t even sold yet. And I can’t afford to lose trust.

Here’s what I’ve learned so far—not as an expert, but as someone who almost didn’t ask the right questions.

The Variables No One Talks About

  • Who owns the data? In Kenya, there’s no single law called “GDPR.” But the Data Protection Act (2019) applies to all personal data—including health info. If you’re a foreign business with Kenyan employees, you’re technically a “data controller.” That means you’re responsible. Even if you didn’t build the system.

  • Where is it stored? Cloud? Local server? USB stick in a drawer? I asked three Kenyan small business owners last week. Two said their HR files were on personal phones. One said his clinic used a free app from the Play Store called “MediSafe v1.2.” No privacy policy. No encryption. Just a login.

  • Who has access? In many cases, the office assistant who types the invoices also prints the medical forms. No role-based access. No audit trail. Just… whoever’s there.

I didn’t realize how much I was relying on luck.

My Framework: Three Layers of Risk

I started thinking in layers—not because I’m smart, but because I’m scared.

  1. Physical Layer: If a fire, flood, or theft happens, are your records recoverable?
    → Backups? Off-site? Cloud?
    → Are they encrypted? Can someone else read them?

  2. Digital Layer: Is your system compliant with Kenya’s Data Protection Act?
    → Do you have a privacy notice?
    → Do you know what “lawful basis for processing” means?
    → Have you ever asked your clinic provider if they’re registered with the Office of the Data Protection Commissioner?

  3. Human Layer: Do your local staff know what to do if a record is compromised?
    → Can they report a breach?
    → Do they understand that sharing a patient’s blood type on WhatsApp is a violation?

I still don’t know the full answer to any of these. But I stopped pretending I didn’t need to know.

What I’m Doing Now (Not Promising, Just Trying)

I’m not fixing everything overnight. But here’s what changed:

  1. I asked my clinic provider—the one handling employee health checks—if they use a certified system. They said, “We use a local platform called MediTrack.” I asked for their Data Protection Officer’s contact. They didn’t have one. So I’m looking for another provider.
    → Tip: Ask for their DPO. If they don’t know what that is, walk away.

  2. I moved all health data off Google Drive. I created a single encrypted file (AES-256), password-protected, stored on a local USB drive kept in a locked drawer. No cloud. No sharing. Only two people have access—me and my local HR liaison. I printed a copy. Stored it separately.
    → Yes, it’s archaic. But in a place where power cuts happen daily, and internet is unreliable, sometimes analog is safer.

  3. I wrote a one-page notice in Swahili and English, explaining what data we collect, why, and how it’s protected. I gave it to every staff member. I asked them to sign it. Not because I need their signature—I need them to understand.

I used to think: If I deliver the machine on time, they’ll be happy.
Now I know: If their child gets sick and their medical record vanishes, they won’t care how fast I delivered the digger.

I still have car payments. I still don’t know if this market will work. But I’ve learned something more important: customer satisfaction isn’t just about product quality—it’s about dignity.

And dignity includes the right to have your health data treated like it matters.

📌 FAQ

Q1: What should I do if I employ staff in Kenya and collect their medical data?

  • Step 1: Identify what data you collect (e.g., blood type, allergies, insurance ID).
  • Step 2: Determine if you’re a “data controller” under Kenya’s Data Protection Act (2019)—if you decide why and how it’s used, you are.
  • Step 3: Use only platforms registered with the Office of the Data Protection Commissioner (ODPC). Check their public registry: https://odpc.go.ke
  • Step 4: Provide a clear, simple privacy notice in Swahili and English.
  • Step 5: Limit access. Never store health data on shared drives or personal phones.

Q2: How do I know if a local clinic or health provider is compliant?

  • Step 1: Ask: “Are you registered with the ODPC as a data processor?”
  • Step 2: Request their Data Protection Impact Assessment (DPIA) document.
  • Step 3: Confirm they have a designated Data Protection Officer (DPO).
  • Step 4: If they can’t provide any of the above, assume they’re not compliant.
  • Step 5: Consider partnering with international providers with local offices (e.g., some Nairobi-based clinics work with German or South African health tech firms).

Q3: Can I use free apps like Google Forms or WhatsApp to collect health info?

  • No.
  • WhatsApp is end-to-end encrypted, but not compliant with data minimization or storage limits.
  • Google Forms doesn’t offer adequate access controls or audit logs for health data.
  • Always use purpose-built systems—even if they cost more.
  • Key point: If the app doesn’t have a privacy policy written in English and Swahili, don’t use it.

I still wake up at 4 a.m. worrying about my loan. But now I also worry about whether the 19-year-old girl who helps me with customs paperwork has a safe place to store her asthma records.

I don’t have the answers. But I’m asking the questions.

If you’re in Kenya—running a small business, hiring local staff, managing any kind of personal data—I’d love to talk. Not to sell you anything. Just to share what’s working, what’s broken, and what we’re learning together.

I’m not a lawyer. I’m not a tech expert. I’m just a guy from Liaoning trying to keep his head above water—and maybe help someone else stay afloat too.

If you’ve been thinking about medical data protection in Kenya, or just want to talk about the mess of running a business here—JingJing from Lvga.com might be someone worth reaching out to. She’s helped me sort through confusing local rules before. Not because she’s got magic solutions. But because she listens.

You can find her on WeChat: lvga2015. No sales pitch. Just real talk.

🔸 延伸阅读

🔸 At least 16 students killed in fire at Kenya girls school dorm 🗞️ 来源: Al Jazeera – 📅 2026-05-28
🔗 阅读原文

🔸 Fire rips through dormitory at girl’s school in Kenya, killing at least 16 students 🗞️ 来源: CTV News – 📅 2026-05-28
🔗 阅读原文

🔸 Kenya School Fire : ਗਰਲਜ਼ ਸਕੂਲ ‘ਚ ਭਿਆਨਕ ਅੱਗ, 16 ਵਿਦਿਆਰਥਣਾਂ ਦੀ ਮੌਤ, 70 ਤੋਂ ਵੱਧ ਜ਼ਖਮੀ 🗞️ 来源: ABP Sanjha – 📅 2026-05-28
🔗 阅读原文

📌 免责声明：
请知悉：律咖网（Lvga.com）是跨境创业公开信息与内容分享平台，不提供法律、税务、会计或合规服务。
本文内容基于公开资料，并由人工编辑与 AI 工具协助整理，仅供信息参考之用，不构成任何法律、投资、移民或商业决策建议。
政策可能随时间变化，请以官方渠道与当地持牌专业人士意见为准。
如内容有需要修订之处，欢迎随时与我联系。