Kenya — Data Protection Act, 2019

The DPA and its regulations set principles for lawful processing, grant data subjects enforceable rights, and impose duties on data controllers and processors — including handling sensitive data such as health information with extra care and observing rules on cross-border transfers.

The DPA is overseen by the Office of the Data Protection Commissioner (ODPC). Depending on your activities, you may need to register as a data controller or processor with the ODPC. Teliyadu provides the security measures and records to support that registration.

• Encryption everywhere — TLS 1.2+ for data in transit and AES-256 for data at rest.
• Strict tenant isolation — each clinic's records live in their own private database schema, never in shared tables.
• Role-based access control (Admin, Dentist, Receptionist, Dental Assistant) so staff only reach the data their role needs.
• Audit logging of every access to patient records and financial data.
• Hosting on AWS in the EU (Frankfurt, eu-central-1) with automated, encrypted daily backups.
• We never use your patients' data to train third-party AI models, and we never sell it.

Your clinic is the data controller for the patient information it stores in Teliyadu OralOS — you decide why and how it is processed. Teliyadu acts as a data processor, handling that information only on your documented instructions and only to provide the service. A data processing agreement (DPA) setting out these responsibilities is available on request.

Individuals have the right to be informed, to access their data, to object to processing, to correction or deletion, and to data portability. Teliyadu OralOS gives your clinic the tools to respond.

To ask a data-protection question, or to make a request on behalf of a patient, email support@teliyadu.com and we'll route it to the right person.