Who Controls Tanzania’s Health Data?

Tanzania is rapidly expanding digital health systems that collect enormous amounts of information about its citizens, but the growing role of foreign-funded technology and technical partners is raising a difficult question: who ultimately controls, stores and accesses Tanzania’s health data?

The question has become more important as Tanzania increasingly relies on digital platforms for collecting, storing, analysing and sharing health information.

The Ministry of Health says Tanzania uses the District Health Information Software 2 (DHIS2) as part of its health information infrastructure. The platform supports the collection, storage, analysis, reporting and dissemination of health information. The ministry also describes its Data Use Partnership (DUP), implemented with PATH, as a government-led initiative intended to strengthen digital health, establish governance bodies and support policy reforms. The partnership grew out of work supported by the Bill & Melinda Gates Foundation and PATH.

DHIS2 itself says countries using the platform operate their own separate instances and retain ownership of their local systems and data. It also says the global DHIS2 team does not have access to local systems or data unless the local system owner deliberately grants access.

That distinction is important because using foreign-supported technology does not automatically mean that foreign organisations own the information stored in it.

Health data can include highly sensitive information about a person’s medical history, HIV status, laboratory results, reproductive health, genetic information and other personal details. Once such information moves through digital platforms, databases, cloud infrastructure, technical-support arrangements and data-sharing agreements, questions arise over who determines the purpose of processing, who can access the information, where it is stored and under what circumstances it can be transferred outside the country.

The issue has become particularly relevant following Tanzania’s 2026 health cooperation agreement with the United States, under which Washington committed more than $1.3 billion to Tanzania’s health sector over five years while Tanzania committed $1.8 billion of its own resources. The agreement focuses on strengthening Tanzania’s ability to finance, manage and sustain essential health services.

During the signing, Tanzania’s Health Minister Mohamed Mchengerwa specifically said the agreement did not provide for sharing laboratory specimens with the United States and that Tanzanian specimens would be tested, stored and governed within Tanzania.

That statement addresses biological samples, but it also highlights a wider issue that governments increasingly face: health information can be just as strategically sensitive as physical samples.

Kenya provides one of the clearest recent examples of why health-data governance can become politically and legally contentious.

Read More: Why Africa Still Imports Its Medicine

In December 2025, a Kenyan court temporarily suspended a $1.6 billion U.S.-Kenya health cooperation agreement while considering a case concerning the privacy and oversight of citizens’ health data.

The Consumers Federation of Kenya argued that decisions based on Kenyan health data should be publicly accountable, auditable and subject to joint and independent oversight. President William Ruto, meanwhile, said the agreement had been reviewed by the Attorney General and that Kenyan law would govern data belonging to Kenyan citizens.

The Kenyan dispute demonstrates that the central question is not simply whether data are collected digitally.

It is who has legal authority over the data and what safeguards apply when foreign partners participate in health programmes involving that information.

Kenya’s Office of the Data Protection Commissioner has separately warned about risks associated with health-data processing, including unauthorised access, disclosure, cyberattacks and the way technology vendors may use information to which they have access.

Its guidance specifically identifies cloud-based systems as presenting challenges because healthcare institutions may have limited control over the cloud infrastructure and the terms imposed by service providers.

Its data-protection law explicitly treats health and medical information as sensitive personal data. The law defines privacy as an individual’s right to decide who can access personal information, when, where, why and how it can be accessed.

Rwanda also imposes specific requirements for transferring personal information outside the country.

Under its data-protection framework, international transfers can require authorisation from the supervisory authority, appropriate safeguards or other legally recognised grounds. Rwanda’s law also provides that personal data should be stored in Rwanda unless the controller or processor has obtained authorisation to store it outside the country.

This gives Rwanda a clearer legal framework for answering a question that becomes increasingly important as digital health expands: when health information crosses borders, which country’s rules and institutions remain responsible for protecting it?

Tanzania has its own personal-data protection framework, but the rapid expansion of digital health means that laws must operate alongside procurement contracts, technology agreements, cloud arrangements, donor agreements and technical-support relationships.

The European Union is taking the issue even further through the European Health Data Space.

The EU framework, which entered into force in March 2025, is designed to give individuals greater control over their electronic health data while establishing rules for the secure use and reuse of health information for healthcare, research, innovation and policymaking. It also creates a harmonised framework for electronic health-record systems.

The European model recognises that health data have two competing characteristics.

They are extremely valuable for improving healthcare and conducting research, but they are also highly sensitive personal information requiring strong safeguards..

A digital health system can help government identify disease trends, monitor medicine supplies, track treatment outcomes and respond to outbreaks faster. But the same system can create significant privacy and security risks if access controls, contracts, cybersecurity and data-sharing rules are weak.

The critical issue is therefore not whether Tanzania should use foreign-supported digital health systems.

Foreign partnerships can provide technology, financing, expertise and infrastructure that would otherwise take years to develop.

The more difficult question is whether every partnership leaves Tanzania with stronger permanent control over its own health information.

That means clearly identifying the Tanzanian institution responsible for each dataset, establishing who qualifies as a data controller and processor, determining where information is physically stored, limiting foreign access, documenting every permitted data transfer and ensuring that contracts give Tanzanian authorities meaningful control over sensitive information.

It also means ensuring that Tanzanian institutions have the technical capacity to maintain and secure systems after donor-funded projects end.

Otherwise, a country can achieve digital transformation without achieving genuine data sovereignty.

Tanzania’s own government describes the Data Use Partnership as an effort to establish governance bodies and build local capacity, suggesting that institutional ownership is already part of the digital-health agenda.

But the experiences of Kenya and Rwanda show why clear rules matter when foreign money, international organisations, technology companies and government health systems operate together.

Kenya’s court dispute demonstrates how quickly questions about health-data access can become matters of public accountability. Rwanda’s framework demonstrates the importance of explicit rules governing sensitive information and cross-border transfers. The EU’s health-data framework shows how detailed governance can become when governments attempt to balance healthcare innovation with individual control and privacy.

It is ensuring that the information generated by Tanzanian patients, hospitals and health workers remains subject to clear Tanzanian ownership, accountability and protection.

The country’s health data are becoming one of its most valuable national resources.

The question is whether Tanzania’s institutions will develop fast enough to ensure that the technology may be internationally supported, but the authority over the data remains clearly and demonstrably in Tanzanian hands.