Security and privacy
MuTindo handles health-system information for ministries, districts and partners. These are the protections built into how it works.
- Access follows role and area
- Every request is checked by the server against the person’s role, organisation, programme and geography. A partner working on one programme in one district sees only facilities in both.
- Two-step sign-in
- Accounts that manage users, approve funding or see national data must use a code from an authenticator app at sign-in, with single-use recovery codes.
- Minimum necessary data
- No patient records. The workforce is counted by cadre, never named. Funders receive aggregate figures only. Platform administrators run the system without access to health data.
- Citizen protection
- Reports are anonymous unless the citizen chooses to be contacted. A contact is kept apart from the report and shown only to an independent reviewer. Confidential reports are hidden from the facility concerned.
- Separation of duties
- The person who proposes an action cannot approve it; the person who does the work cannot verify it; the person who requests funding cannot approve it.
- Audit
- Sign-ins, access changes, decisions and every Ask MuTindo question are recorded with who, when and in which role.
- AI boundaries
- Ask MuTindo answers only from evidence already filtered to the person’s access, marks every answer as assistive, and never makes a protected decision.
Before a live deployment
Each deployment needs its own data-sharing agreements, hosting in an approved location, backup and recovery testing, and an independent security assessment. MuTindo does not claim certification it has not been through.