Privacy Policy

1. Who we are

pima is a product of Health Intel Ltd, a company registered in Kenya.

• Registered address: 90 JGO, James Gichuru Road, Lavington, Nairobi, Kenya
• Contact: hello@pima.co.ke

Health Intel Ltd is the data controller for the information described in this policy.

2. What this policy covers

This policy covers the sites and the app we operate:

It does not cover pima installations run by someone else. pima is normally deployed by the organisation that uses it, such as a health facility, a ministry or a financial institution, onto infrastructure it controls. In those deployments they are the data controller, they hold the data, and their privacy policy applies — not this one. We have no access to those installations.

3. When you browse these sites

We do not use analytics, advertising, tracking pixels, or third-party scripts of any kind. These sites make no requests to any other company's servers. There is no cookie banner because there are no tracking cookies to consent to.

What does happen, as on any web server:

• Server access logs. Our web server records the request: your IP address, the page requested, the time, the browser's user-agent string, and the response status. These are kept for security and troubleshooting — investigating errors, abuse, or attacks. They are not used to build a profile of you and are not combined with anything else.
• pima.co.ke sets no cookies and stores nothing in your browser.
• docs.pima.co.ke may store a light/dark theme preference in your browser's local storage. It stays on your device and is never sent to us.
• app.pima.co.ke, being an application you log into, stores a session token and interface preferences in your browser. These are necessary for you to stay signed in.

4. When you request evaluation access

To ask for access to our demo, we collect:

• Required: your name and email address.
• Optional, if you choose to give them: company, job title, industry, country, and what you want to use pima for.
• Recorded automatically: the page you applied from, your IP address and browser user-agent, the time you accepted the evaluation terms, and which version of this policy was in force.

Why. To decide whether to grant access, to create your account if we do, to contact you about your request, and to keep a record of the decision.

Where it is stored. In a separate database from the pima application itself. Information about our commercial relationships never sits inside a pima instance — not ours, and never one belonging to a customer. This is an architectural rule for us, not a preference.

Marketing is separate and opt-in. The registration form has an unticked box for occasional product updates. Leaving it unticked has no effect on your application. If you tick it you can unsubscribe at any time, and we will still send you the transactional email described in section 7.

5. When you sign in with Google

You may request access or sign in using a Google account. If you do:

We ask Google for two things only: your email address and basic profile information (email and profile). Google classifies both as non-sensitive.

We cannot see, and never request, your Gmail, Google Drive, Calendar, Contacts, photos, or any other Google service. The permission we ask for does not grant access to them.

From Google we receive your Google account identifier, email address, and display name. We use them to:

• match you to an existing pima account, if you already have one; or
• create a pending access request for a human to review.

Signing in with Google does not create an account. An unrecognised Google identity produces a request awaiting approval, and nothing more. There is no automatic sign-up.

We do not use Google user data for advertising or profiling, and we do not sell it, share it, or transfer it to anyone, except to the infrastructure providers in section 9 who process it on our instructions.

6. Evaluation accounts and the demo

If your request is approved, we create an account on the demo you asked for, app.pima.co.ke (health) or app.mfi.pima.co.ke (microfinance), with:

• a viewer's access: you can explore the figures and reports and make your own notebooks, but you cannot change the demo's data or its settings;
• no permission to view personal identifiers: the identifiers of patients and borrowers are masked for evaluation accounts;
• an automatic expiry after 90 days, after which the account stops working.

The demos contain synthetic data only. The patients, borrowers and staff you will see are computer-generated for demonstration. No real person's information is present in either demo, and none is ever loaded into them.

7. Email we send you

We send only transactional email connected to your request or account:

• acknowledgement that we received your request;
• our decision;
• account set-up and password-reset messages.

Product-update email is sent only if you opted in (section 4). Our hosted services send mail through Microsoft Azure Communication Services.

8. How long we keep things

9. Who else is involved

We keep this list short deliberately. Your information is handled by:

• Microsoft Azure — hosting for our own instances, the service that delivers our email, and an AI model the assistant may use, run in Azure AI Foundry (section 13).
• Anthropic — the Claude AI models the assistant may use (section 13).

They act on our instructions and may not use your information for their own purposes, except that the AI providers may keep a request their systems flag, to check it against their rules on abuse (section 13).

We do not sell personal information. We have never done so and have no plans to.

10. Your rights

You may ask us to:

• tell you what information we hold about you;
• correct anything inaccurate;
• delete it;
• stop using it for a given purpose, including marketing;
• give you a copy in a portable form.

Write to hello@pima.co.ke and we will respond. If you are unsatisfied, you may complain to your national data-protection authority — in Kenya, the Office of the Data Protection Commissioner.

Deleting a demo account is straightforward: ask, and we will remove it. You do not need a reason.

11. How we protect information

• Traffic to our sites, and between the app and a pima server, is encrypted in transit (HTTPS).
• Access to the demo is decided by a policy engine, and personal identifiers are masked from accounts that hold no permission to see them — evaluation accounts hold none.
• Passwords are stored hashed. Password-reset links are single-use, expire, and are only ever sent over an encrypted connection.
• Commercial records are held in a database separate from the application (section 4).

No system is perfectly secure, and we do not claim otherwise. If a breach affects you we will tell you and the relevant authority as required by law.

12. The pima app for iPhone and iPad

The app is a companion to a pima server. It talks only to the server you connect it to. When that server is one of our demos, this policy applies. When your organisation runs pima, or we host it on the organisation's behalf, the organisation is the data controller and its privacy policy applies to what the server holds.

What the app sends to that server:

• the user name and password you sign in with, and a second-factor code if your account has one;
• an enrolment for the device: an identifier the app creates for itself and the device's name, so that you can see the device under Your devices on the web and remove it;
• the questions you ask, kept as conversations you also see on the web. To answer one, the server sends it to an AI provider (section 13). The app names the provider and asks for your permission before your first question is sent, and you can withdraw it in Settings;
• which notifications you have read.

What stays on the device:

• the session, in the iOS Keychain. The app never stores your password;
• the server's address and your choice of home screen;
• the last figures read, so that the app opens without waiting. iOS keeps them unreadable after a restart until the device is first unlocked, and they are left out of iCloud backups. The app's widgets read the same copy.
• the notebooks you have opened in the app, with each chart's figures, so that a notebook opens again without a connection. They are kept on the same terms as the figures, and the widgets do not read them. A notebook holds only what your account can read on the web.

Signing out, or a session the server ends, removes the session, the figures and the notebooks from the device. To end the session from elsewhere, remove the device under Your devices on the web.

What the app leaves to iOS:

• Speech. When you tap the microphone, iOS recognises your words on the device. The audio never leaves it. Only the text you choose to send goes to the server, as a question.
• Camera. Used only to read the code on the web that connects the app to a server. Nothing is recorded.
• Face ID and Touch ID. iOS unlocks a session you already hold. The app learns only whether the unlock succeeded, and no biometric data reaches the app or us.

The app contains no analytics, advertising or tracking, and no third-party code that sends data anywhere. Apple's App Store and TestFlight have their own privacy policies. If you choose to share crash reports with app developers in your device's settings, Apple may send us reports of the app's crashes, which we use only to fix them.

13. The assistant

pima's assistant answers questions about an organisation's figures, on the web and in the app, where it is called Ask. Its answers are written by an AI model that runs at a model provider, so a question leaves our servers for that provider, and the answer comes back to our server.

What is sent to the provider:

• your question, and the earlier questions and answers in the same conversation;
• the figures the assistant reads from the organisation's data to answer it. If your account may see people's details, such as names or phone numbers, those can be part of what it reads. Evaluation accounts on our demos may not see them (section 6), and the demos hold no real person's data;
• instructions on how to answer, which carry the date and nothing about you.

What is not sent: your name, email address and account details, and nothing that identifies your device.

Why. Only to answer your question. Our server keeps the conversation so that you can read it again, on the web and in the app.

Which provider. An administrator chooses the models an account may use, so the provider depends on your account. On the web the model is named where you ask. The app names the provider and asks before your first question is sent, and asks again if the provider changes. For our demos:

Leaving Kenya. Both providers process requests outside Kenya, mainly in the United States. They do so under their data-processing terms: Anthropic's Data Processing Addendum, with standard contractual clauses, and Microsoft's Products and Services Data Protection Addendum.

When your organisation runs pima, or we host it on its behalf, the organisation chooses the providers and its privacy policy applies. A model can also run on the organisation's own servers, and then nothing is sent to another company.

14. Changes to this policy

This policy carries a version. When it changes materially we will publish a new version and update the date. Where you have given us information, we record which version was in force at the time.

Version 2026-10-29. Superseded versions are available on request.