06/01/2026
Briefing
6/Jan/2026
For Public Interest
has made life faster and easier. When a question crosses your mind at 2am, you can reach for your phone and within seconds an can offer advice, reassurance, or a next step. In , this is not just convenience it is . With high pe*******on and woven into daily transactions, for , apps, and symptom checkers have become part of how people pay for treatment, track records, and make decisions about their bodies.
But every digital handshake involves two movements. One is what you receive, and the other is what quietly leaves your phone, often protected by you never read and permissions you never had a chance to shape. The real questions, therefore, are not philosophical. They are intensely practical: what is being collected, who owns it, who can share it, who profits from it, and who carries responsibility when something goes wrong. Data is no longer just personal, it is monetisable. And when a system is built to absorb information from millions of users without returning control, value, or to them, it starts to resemble a new kind of economy.
In many African countries, Kenya included, digital scale rapidly but oversight frameworks, consumer protection doctrines, and contract law principles struggle to reach the engine room of these products. One of the most familiar examples is , a mobile health wallet launched in 2016 through a partnership involving and corporate technology firms. It was designed to help families save for healthcare and pay hospitals or clinics directly using mobile money. For many Kenyans, especially informal workers or households outside the reach of traditional insurance, it became a gateway into healthcare financing that felt modern and empowering.
Yet the very features that made it scale fast also reveal the governance tension.
M-TIBA’s of allow broad sharing of user personal and medical data with undefined service providers, business partners, and group companies that are not individually named in the contract. In data governance, ambiguity is power. When partners are not specified, users cannot realistically assess what the data will be used for, how far it will travel, or whether it will be repurposed for analytics or commercial gain. Even if is formally referenced in the terms, it becomes difficult to enforce when the recipients of the data are undefined.
Then there is the question of data . Users who have stored records or payment histories on the wallet cannot easily export that information to an alternative platform. This means that even if a user loses trust in the service, the practical ability to move elsewhere is constrained. Portability is not just a technical design choice it is a market design choice. Without it, switching costs rise and competition weakens.
Another deeper layer is ownership. The rights over the platform’s , , and are held by the corporate group behind the product and its external technology licensors. This means Kenyan adoption contributes to scale and market dominance, but local users, clinics, or regulators cannot inspect or influence how the underlying technology evolves. The doctrine of privity in contract law traditionally assumes a contract binds only its parties. But in digital finance, the true power holders may be in the infrastructure or external software licences, not in the app you signed up for. Those actors have access to and system logic without being visible parties to the contract, and without owing duties of care to the user.
Finally, the question of accountability. Kenya has a Data Protection Commissioner, but enforcement in the sector has largely depended on individual complaints. When harm arises from design, not misconduct, complaint-driven enforcement is a weak remedy. It responds to problems, it does not prevent them. SHIF or other health agencies can accredit or reimburse facilities, but they do not oversee onward data flows or software embedded in private contracts. When platforms sit on essential services like healthcare payments, remedies for outages or algorithmic error are often shielded by clauses that make it harder for users or small clinics to seek recourse.
So, is this about digital/data colonialism and surveillance? Yes, but not in the abstract.
Digital today is not about flags or armies. It is about legal over data sharing, ownership of software intellectual property, control over routing infrastructure, and immunity from liability, especially where markets provide scale but not governance leverage. footprints are also not tied to cafés or the identities of founders, but to the infrastructure that logs device identifiers, payment rails that centralise routing, cloud hosts that aggregate analytics, and contract terms that deny portability or liability. When these protections are weak, users become exposed not because they lack technology, but because the contracts governing the technology were not built to protect them.
The way forward is not to reject documentation but to challenge it with better evidence baskets, and to regulate not the phones, but the contracts and infrastructure that sit above them. The world has shifted. It is time governance shifted too. So read the terms of apps you sign up to!
