This Privacy Notice (“Notice”) is provided by meWell LLP (“meWell”, “we”, “use, or “our”).
This Notice applies to all persons who use our mobile application and related services (“Users”).
The purpose of this Notice is to describe how we collect, use, store, share, and process your personal and sensitive data, including, where applicable, medical and health-related data, in accordance with the law.
meWell provides wellness and health-related services focused on fitness tracking, nutrition guidance, weight management, and general well-being programs. We will only process your personal and sensitive data where we have a lawful basis as permitted by law.
For more information about your rights and how we process your data, please read the full sections of the Privacy Notice below.
Contents
1. Who We Are 2
2. Information We Collect 2
3. How we collect your data 3
4. How We Use Your Data 4
5. Retention and Security 5
6. Data Sharing 5
7. Legal Bases for Processing 6
8. Your Privacy Rights 7
9. Children’s Privacy 7
10. International Data Transfers 7
11. How We Use AI Responsibly 8
12. Updates to This Policy 8
13. Contact Us 8
Who We Are
meWell is a holistic digital health and wellness platform that connects users to licensed health professionals, personalised wellness programs, and educational resources.
Our mission is to make preventive and proactive healthcare accessible. For more information on our services, please visit here.
Information We Collect
We collect information to provide personalised, safe, and effective services. The types of data we collect include:
| Personal Data | We process data that identifies you or which may reasonably be used to identify you (“Personal Data”) as defined under Section 2 of the Data Protection Act, 2019. This includes but is not limited to: Identifiers and Contact Information Name, postal address, email address, phone number, and other similar identifiers necessary for account creation and communication. Health and Medical Information: Information relating to your physical, mental, or emotional health, including weight, activity level, mood symptoms, and responses to our wellness surveys. Account information: Your username, password, and any preferences or settings associated with your meWell Account. Demographic Information Age, date of birth, and gender were voluntarily provided. Internet or Other Electronic Network Activity Information: Technical data such as your IP address, geographic region, device type, operating system, browser type, dates and times of access, and interactions with our services. You may control or disable location sharing in your device settings. Communication Data: Any correspondence you send to us, such as inquiries, feedback, or survey responses. |
| Usage Data | We process certain data regarding usage of our services (“Usage Data”). Usage data does not identify you and cannot reasonably be used to identify you. This includes data about app pages visited by users, time spent on app pages, sources of traffic on our app (information about media referring users to our services), actions such as downloads and clicks on links, and whether a user is a first-time or repeat user of our services. |
| Additional Information | During onboarding and login, we may collect additional self-reported information (e.g., mood, activity level, or wellness goals) that allows our AI system to suggest appropriate programs, experts, or content for you. |
How we collect your data
We collect Personal Data and Usage Data in the following ways:
- Data we collect directly from you
| Registration Data | When you create an account, you provide us with certain information, which includes, but is not limited to, your email address, telephone number, date of birth, gender, as well as a password for your account. |
| Payment information | If you choose to use a fee-based service, you will be requested to provide, at a minimum, your name and payment information, including payment card information. A third-party service provider that handles payments for us will also receive your payment card information. |
- Data you choose to provide to us
You can provide a variety of data during your interactions with us and meWell Health Services, such as the emails you send us, filling in the wellness survey form, the information you respond to, and emails or newsletters that you sign up to receive.
| Feedback and Support | We love to hear from you. Whether you have an idea to make the user experience of meWell better or you need help with one of our services, we store the emails you send us and use them to prioritize how to improve our product. |
- Data from wearable devices and third-party platforms
We may collect data from supported wearable devices and third-party platforms (such as fitness trackers or health apps) that you choose to connect to our app. This includes information such as your physical activity, heart rate, sleep patterns and other health-related metrics. We only collect this data with your explicit consent, and the data is transmitted to us securely through the wearable’s platform or API
- De-identified data
This refers to anonymised data, data that cannot be used to identify you. This data is used for research and development of new products or tools, to refine our algorithms and machine learning applications and to improve the app and the services we provide. We may disclose such data publicly and to third parties, for example, in public reports about health, to partners under the agreement with us, or to provide data to the medical community. If meWell wishes to use identifiable information for research, we will ask for your separate, explicit consent.
How We Use Your Data
At meWell, we prioritise your privacy and are committed to using your personal data responsibly and transparently. The data we collect is utilised to enhance your wellness journey, provide personalised services and ensure compliance with applicable laws.
| Providing our Services | We use de-identified data to improve our services. This includes making the app easier to use, refining features, and enhancing your overall wellness experience. We may also use your data to fulfil our legitimate interests (that do not override your privacy rights) and to personalise recommendations and services we offer you. |
| Communicating with you | We may use your Personal Data to respond to your inquiries or support requests and to send important updates, notifications, or direct marketing information, where you have given consent. For these purposes, we may use identifiers, contact information, and any Personal Data included in your inquiry or request. |
| For our internal business purposes | We may allow third parties such as researchers, statisticians, academic institutions, or health organisations to analyze anonymized or de-identified data for research purposes or to prepare publications. Identifiable personal data will only be used if you give separate, explicit consent. |
| Protecting rights and interests. | We may use your data to protect the health, safety, and security of meWell, its employees, and users, enforce our legal rights, or investigate suspected violations of our terms of service. This may include identifiers and contact information, or health and medical information in emergencies. |
| Research purposes | We may allow third parties such as researchers, statisticians, academic institutions, or health organisations to analyse anonymised or de-identified data for research purposes or to prepare publications. Identifiable personal data will only be used if you give separate, explicit consent. |
| Business transfers | In the event of a merger, acquisition, or sale of all or substantially all of our assets, your data may be transferred to effectuate the change in control of our business. For these purposes, we may process any of the types of Personal Data described above. |
| As required by law. | We may process your data to comply with Kenyan legal or regulatory obligations, such as orders issued by courts, directives from regulatory authorities, or requirements under the Data Protection Act, 2019, and the Digital Health Act, 2023. For these purposes, we may process any of the types of Personal Data described above. |
Retention and Security
We use technical and organisational safeguards designed to protect the personal data we collect and process about you. However, security risk is inherent in all internet and information technologies, and we cannot guarantee the security of your personal data.
We retain personal data for as long as necessary to fulfil the purposes for which we collected it, including for the purposes of satisfying any legal, accounting, or reporting requirements, to establish or defend legal claims, or for the compliance and protection purposes described above. Factors determining the appropriate retention period for personal data include the amount, nature, and sensitivity of the personal data, the potential risk of harm from unauthorised use or disclosure of personal data, the purposes for which we process the personal data, whether we can achieve those purposes through other means, and the applicable legal requirements.
When we no longer require the personal data, we have collected about you, we will either delete or anonymize it (so that it is no longer personally identifiable with you) or, if this is not possible (for example, because your personal data has been stored in backup archives), then we will isolate your personal data from any further processing, employing security safeguards designed to protect it until deletion is possible.
Data Sharing
We may share your personal data and usage data in the following ways;
| With trusted service providers | We may share your Personal Data with carefully selected vendors who help us provide and improve our Services, for example, providers of data hosting, analytics, IT support, data security, and customer communication tools. We require all our service providers to handle your data confidentially, securely, and only for the specific purposes agreed upon with meWell. |
| Within the meWell Group | We may share your data with our affiliates or subsidiaries (if any) where this is necessary to deliver our services, ensure consistent support, or improve our operations. |
| Business transfers | If meWell undergoes a merger, acquisition, restructuring, or transfer of assets, your Personal Data may be shared as part of that process. In such cases, we will ensure that your data remains protected and that any receiving entity upholds equivalent privacy safeguards. |
| Legal and regulatory obligations | We may share your Personal Data where required by Kenyan law, for example, in response to lawful requests from government or regulatory bodies, or to comply with court orders or directives issued under due process. |
| Protecting rights and safety | We may disclose Personal Data if necessary to protect the rights, safety, and property of meWell, our users, or the public, for example, to prevent fraud, security threats, or misuse of our Services. |
| Research and partnerships (with your consent) | With your explicit consent, we may share anonymised or aggregated health data with academic institutions, health organisations, or research partners for public health or scientific purposes. We will never share your identifiable health data for research or marketing without your consent. |
Legal Bases for Processing
We collect and process your personal data only where we have legal bases for doing so under applicable laws as follows:
- Based on the necessity to perform contracts with you, When you access, use, or register for services, you form a contract with us based on the applicable agreements. We need to process your personal data to discharge our obligations in any such contract, fulfil your requests and orders, answer questions and requests from you, and provide tailored customer support.
- Based on compliance with legal obligations: We may need to process your personal data to comply with relevant laws or regulatory requirements, and to respond to lawful requests, court orders, and legal processes.
- Based on our legitimate interests: We process your personal data to send you information on relevant services, understand which offerings may be relevant to you, and to improve our services, products, solutions, and business practices.
- Based on your consent: In certain situations, we process your data based on your consent. When applicable, we will ask for your consent before we process your data. You have the right to withdraw your consent at any time.
Your Privacy Rights
You have several rights in relation to your personal data. These include the right to:
- ask for a copy of personal data we hold about you (Right of access);
- ask us to give you (or a third party chosen by you) an electronic copy of the personal data you have given us (Right to data portability);
- ask us to correct personal data we hold (Right to rectification);
- restrict how we use your personal data (Right to restriction of processing);
- ask us to delete personal data (Right of erasure);
- object to particular ways we are using your personal data (Right to object);
- object to any automated decision-making; and
- Withdraw any permission you have previously given to allow us to use your information.
Your ability to exercise these rights may be influenced by several factors. In some cases, we may not be able to accede to your request due to a valid reason or if the specific right is not applicable to the information we possess concerning you. If you do not provide information we identify as required or mandatory, we may not be able to provide features or services that require that information.
Children’s Privacy
meWell does not knowingly collect or process Personal Data directly from individuals under the age of 18. Suppose we become aware that we have inadvertently collected Personal Data from a minor without appropriate parental or guardian consent. In that case, we will take immediate steps to delete such information from our records.
If you believe that a minor has provided us with their Personal Data, please contact us promptly at [email protected]
International Data Transfers
If we transfer your Personal Data outside Kenya, for example, to a secure cloud service provider or trusted partner, we will ensure that such transfers comply with the Kenya Data Protection Act, 2019, and the Data Protection (General) Regulations, 2021.
Specifically, we will only transfer Personal Data to countries or organisations that maintain adequate data protection standards, or where appropriate safeguards (such as data transfer agreements or standard contractual clauses) are in place to ensure that your information remains secure and is processed lawfully.
We will take all reasonable steps to ensure that your Personal Data continues to receive an equivalent level of protection as it would under Kenyan law.
How We Use AI Responsibly
We use artificial intelligence to enhance your experience on meWell responsibly and ethically.
How our AI tools help:
- Suggest programs, experts, or lifestyle changes that match your needs.
- Analyse patterns (such as stress levels or exercise frequency) to provide useful wellness insights.
- Continuously improve based on anonymised user feedback and interactions.
AI transparency and safeguards:
- Our AI does not make clinical diagnoses and cannot replace the judgment of a healthcare professional.
- Decisions or recommendations supported by AI are transparent and subject to human oversight.
- Personal data used by AI is processed in accordance with your consent, privacy protections, and security safeguards.
- You can opt out of AI-based personalisation at any time, though this may limit some features.
- AI will not be used to discriminate against, unfairly target, or harm users in any way.
We are committed to continuous monitoring and evaluation of AI systems to ensure they remain fair, accurate, and aligned with ethical standards in health and wellness.
Updates to This Policy
We may update this Privacy Policy to reflect legal changes or improvements to our platform.
We’ll notify users of major updates through email or in-app notifications. The date on which this notice was last updated is included at the beginning of this Notice
Contact Us
If you have any questions, concerns, or complaints about how we handle your data, please reach out to: [email protected]
However, you also have the right to make a complaint at any time to the Office of the Data Protection Commissioner (ODPC), which is the supervisory authority for data protection issues in the Republic of Kenya. You may lodge a complaint with the ODPC through: https://www.odpc.go.ke/file-lodge-a-complaint/.