Rology—Kenyan court suspended Rology's teleradiology operations for exporting patient scans abroad without consent or licensing
On June 12, 2026, Kenya's High Court (Milimani Constitutional and Human Rights Division), ruling on a petition by the Kenya Association of Radiologists, ordered the immediate suspension of Rology's Kenyan operations. The court found Rology had operated in over 40 public health facilities serving more than 60,000 patients without registering as a data controller/processor under Kenya's Data Protection Act, without Digital Health Act compliance, and without verifying that all reviewing radiologists held Kenyan licenses. Patient medical imaging (X-rays, CT scans, MRIs) with identifying metadata was transferred to Rology's Cairo-based cloud infrastructure without explicit patient consent. The court found violations of the constitutional rights to privacy, consumer protection, fair labor practices, and health, and ordered regulators to cancel any licenses issued to Rology for handling patient data.
Scoring Impact
| Topic | Direction | Relevance | Contribution |
|---|---|---|---|
| Consumer Protection | -against | primary | -1.00 |
| Data Security | -against | secondary | -0.50 |
| User Privacy | -against | primary | -1.00 |
| Overall incident score = | -0.369 | ||
Score = avg(topic contributions) × significance (high ×1.5) × confidence (0.59)× agency (negligent ×0.5)
Evidence (2 signals)
Business Daily Africa: Court freezes AI-powered radiology platform over privacy and registration failures
Business Daily Africa reported the Milimani court's finding that Rology's lack of clear registration and oversight mechanisms raised concerns for healthcare quality, consumer protection, and patient privacy, rejecting the company's defense that its service expanded access to specialist care in underserved areas.
Standard Media: Court blocks Rology operations over health data compliance failures
Kenya's Standard Media reported that the High Court suspended Rology Medical Kenya's operations 'forthwith' until it complies with the Data Protection Act, Digital Health Act, and Digital Health (Data Exchange Component) Regulations 2025, and ordered regulators to cancel any licenses issued to it for handling patient health data.