Privacy policy
How we collect, use and protect your personal data.
Last updated: 2 September 2026
This policy explains how Kuula Microfinance Company Limited ("we", "us"), the provider of TibaPay, handles personal data when you use the TibaPay app or this website. Kuula Microfinance Company Limited is based in Kampala, Uganda.
What we collect
- Identity data — your name, date of birth, National ID details and the document images you upload for verification.
- Contact data — your phone number and, where you provide it, your email address.
- Financing data — the hospital bill being financed, the terms you were offered, what you accepted and your repayment history.
- Payment data — the mobile money account used for repayment and the record of each payment.
- Technical data — information needed to keep accounts secure, such as sign-in events and the device or network used.
We collect the hospital bill and treatment description needed to finance care. We do not ask for clinical records beyond what is required to verify the bill.
Why we use it
- To verify who you are and prevent someone else applying in your name.
- To assess an application and decide what, if anything, can be offered.
- To pay the partner hospital for a bill you have accepted financing for.
- To collect repayments and keep your balance accurate.
- To meet our legal, regulatory and record-keeping obligations.
- To detect and prevent fraud and misuse of the service.
How identity documents are protected
Identity documents are encrypted before they are stored, and they are never served from a public web address. Access is restricted to reviewers who need a document to assess an application, and each access is recorded. Where a document is replaced, the earlier version is retired and later removed.
Who we share it with
- Partner hospitals — only what is needed to confirm the bill and the payment relating to your treatment.
- Payment providers — the mobile money provider processing a disbursement or repayment.
- Service providers — organisations that host or support our systems under contract.
- Authorities — where we are legally required to disclose information.
We do not sell your personal data.
How long we keep it
We keep financing records for as long as required by applicable Ugandan law and our regulatory obligations, which continue after an account is closed. Identity documents that are no longer needed are retired and then deleted according to our retention schedule.
Your rights
- Ask what personal data we hold about you.
- Ask us to correct information that is wrong.
- Ask us to erase your account and personal data.
- Object to, or ask us to restrict, certain uses of your data.
You can request deletion directly in the app. Where financing is still outstanding, or where the law requires us to keep a record, erasure is deferred or partial — and we tell you which records are retained and why.
Contacting us
For any privacy question or request, write to privacy@tibapayapp.com. If you are not satisfied with our response, you may raise the matter with the relevant data protection authority in Uganda.
Changes to this policy
If we change this policy we will update the date above and, where the change is significant, tell you in the app.