The Kenyatta National Hospital, the county referral system, KEMRI, and the community health information infrastructure collectively generate substantial volumes of clinical data. That data is increasingly valuable — not merely for clinical governance but for commercial AI development. The Data Protection Act of 2019 governs the conditions under which health data may be collected and processed (Republic of Kenya 2019). What neither the Data Protection Act nor the Kenya National Artificial Intelligence Strategy adequately addresses is the question of secondary value: who captures the commercial benefit when Kenyan health data is used to train AI tools deployed globally, and whether Kenya has any framework for negotiating that benefit.
The Gap in the Literature
The emerging literature on data governance in African contexts has focused substantially on data localisation requirements (Greenleaf 2022) and on consent mechanisms for data collection (Abdi 2021). Substantially less examined is the concept of data benefit-sharing — the question of whether, and how, a country whose clinical data is used to train commercially deployed AI tools should receive a structured return on that resource. This gap in the literature reflects a gap in policy: most African data governance frameworks were drafted before commercial AI training had become a significant use case for clinical data, and none addresses benefit-sharing in systematic terms (Abebe et al. 2021). This article proposes a framework for Kenya.
The Value Chain Kenya Is Not Positioned In
An AI diagnostic tool trained on East African clinical data and sold to healthcare systems globally captures value from a resource — population health data — that was generated by Kenyan patients, clinicians, and public institutions. The Data Protection Act requires lawful processing on specified bases and explicit consent for sensitive health data (Republic of Kenya 2019, s. 30). It does not require that the commercial value chain flowing from that data return any proportion of value to the public system that generated it. This is not unique to Kenya; it is a structural feature of the current global AI development economy. It is, however, a gap Kenya is positioned to address before the commercial extraction becomes too entrenched to regulate.
Kenya's health data is not a passive resource waiting to be discovered. It is infrastructure. The question is who owns the infrastructure and who pays to use it.
South Africa's Emerging Data Sovereignty Framework
South Africa offers the most developed regional precedent for data governance reform in this area. The Protection of Personal Information Act and subsequent guidance from the Information Regulator have begun to address the conditions under which health data may be shared for research and commercial purposes (South Africa 2013). More directly relevant is South Africa's emerging National Digital and Future Skills Strategy, which explicitly links data governance to economic benefit — positioning data as a national strategic resource rather than merely a subject of privacy regulation (South Africa, Department of Communications 2020). The limitation of the South African precedent is that it has not yet produced binding benefit-sharing requirements for commercial AI use cases; the framework remains aspirational in precisely the domain most relevant to this analysis.
Three Steps Available Now
First, the Office of the Data Protection Commissioner can issue a binding regulatory guidance note establishing that the secondary use of Kenyan health data for AI training constitutes a distinct processing purpose requiring fresh lawful basis assessment and documented benefit-return commitments from commercial actors — extending the existing Guidance Note on Health Data processing without waiting for primary legislative reform.
Second, the Ministry of Health and the ODPC can jointly develop a model data-sharing agreement for commercial AI developers accessing Kenyan clinical datasets, requiring as a standard term that a defined proportion of net revenue attributable to AI tools trained on those datasets be reinvested in Kenya's public health information infrastructure.
Third, KEMRI can establish a national clinical AI dataset registry — cataloguing the health datasets Kenya holds, their potential commercial value, and the terms on which they may be accessed — giving Kenya a documented negotiating position in commercial data-sharing arrangements rather than negotiating each arrangement from scratch.