9 November 2026 · 4 min read
From Advisory to Accountability: Training Kenya's Community Accountability Team on Digital Health Rights
On 4 and 5 November 2026, in Naivasha, we spent two days helping a youth-led team prepare for a harder job than the one it came in with. Since 2023, the Kenya Community Accountability Team (K-CAT) has advised on digital health rights. Now it is learning to document harms and take them to the right place.
The inception meeting and paralegal training was convened by KELIN, the Kenya Legal and Ethical Issues Network on HIV and AIDS, in commemoration of Digital Health Week 2026. DPO 360 facilitated. Here is what we covered and what the room taught us.
Why this work matters
Health information is among the most sensitive data a person holds. When it is exposed, the result can be stigma, violence or lost work. When it is exposed through an app or a clinic system, it is not always clear who to turn to. That gap is what KELIN's youth-led project, Protecting Health Equity in the Digital Age: Youth-Led Community Accountability, sets out to close. It looks at harm to people's health and dignity through technology and the misuse of their health data, including non-consensual disclosure of HIV status, and it builds on the Digital Health and Rights Project. K-CAT moves from an advisory role to a youth-led accountability team: documenting harms, taking cases to the right institution, tracking the response and using the evidence to push for reform.
Day one: from advice to action
We framed the shift as a loop: evidence, redress, response and reform. Document the harm, take it to the right place, track what happens, and use what you learn to change policy.
We were just as clear about the limits of the paralegal role. A paralegal can listen and document with consent, explain options in plain words, help prepare a complaint, refer for support and follow up. A paralegal cannot represent clients in court, give legal advice beyond their training, promise an outcome, share case details or pressure anyone to file.
Then we mapped where a complaint can go in Kenya. One harm can fit more than one route, so the skill is matching the harm to the place best able to act:
- Office of the Data Protection Commissioner (ODPC): misuse or unlawful sharing of personal data, including health data.
- HIV and AIDS Tribunal: civil complaints about breaches of HIV law, such as confidentiality and discrimination.
- Digital Health Agency: complaints about digital health systems and apps under the Digital Health Act, 2023.
- Police and DCI: crimes such as threats, blackmail and cyber harassment.
- Civil Court: damages and enforcing rights such as privacy.
- Ombudsman: delays or failure to act by public bodies.
- KE-CIRT/CC: cyber attacks and harmful online content.
In groups, members then sorted scenarios, such as an app sharing health data without consent or a clinic disclosing a person's HIV status, choosing a route and a back-up route for each.
Consent and data protection come first
Our rule of the day was simple: ask before you record, and use codes, not names.
Health status is sensitive personal data under the Data Protection Act, 2019, so it needs extra care: use data fairly and lawfully, take only what is needed, and keep it safe, and not forever. Consent must be freely given, specific, informed and open to withdrawal. It is a process, not just a signature.
We also practised anonymisation: replace the name with a code such as Person A, group the age, keep to the county, and leave out the condition unless it is needed. K-CAT will hold cases, so its own records must set the example.
Day two: safeguarding and practice
Day two was about doing. We opened with safeguarding: informed consent, confidentiality, and when and how to refer a case that raises safety concerns. Some cases need support before, or alongside, a complaint.
Members then worked through a case documentation form, a complaint submission form and a way to track responses. In pairs, they picked a harm and a route, completed a case form, drafted a complaint and set out the follow-up. The day closed with a debrief on what was hard and whether the forms did the job.
What stayed with us
What stayed with us was how honest and sharp the conversations were. These are people who know their communities and are ready to stand with them.
It reminded us that data protection is not only about the law. It is about whether a person feels safe enough to tell their story, and whether the one who hears it knows how to look after it. A harm documented badly can cause a second harm, so the habits matter as much as the routes.
Looking ahead
DPO 360 is so glad to be part of Protecting Health Equity in the Digital Age: Youth-Led Community Accountability, and we look forward to seeing how this journey from advisory to accountability unfolds. Thank you, KELIN and K-CAT, for the trust, and for two days of hard work and honest talk.
If your organisation handles sensitive health data, or supports communities who trust you with their stories, we would be glad to hear from you. Talk to us.
