# Is it safe to keep client notes on paper, WhatsApp or a personal laptop?

URL: https://tymirahealth.com/resources/faqs/is-it-safe-to-keep-client-notes-on-paper-whatsapp-or-a-laptop
For: Clinicians | Data protection and privacy | Last reviewed 8 November 2026

**Answer:** Each carries real risk. Paper can be lost, read by others or damaged, WhatsApp chats sit on personal phones and backups outside your control, and a personal laptop may be shared, unencrypted or stolen. Under Kenya's Data Protection Act 2019, health data is sensitive personal data, so practitioners need access controls, a record of who sees what, and a way to keep and dispose of records safely.

### A safer set-up for a small practice

Practitioners want to keep notes safe without drowning in paperwork. Moving everything into one secure place is usually simpler than protecting many scattered copies.

This is general information, not legal advice. Check your obligations with a qualified adviser.

- Keep records in one system with individual logins and role-based access.
- Use strong passwords and screen locks on every device.
- Do not send client details over personal messaging apps.
- Store any remaining paper files in a locked cabinet with a sign-out log.
- Agree how long records are kept and how they are destroyed.

Read more: [Role-based access for therapy notes and mental health records](https://tymirahealth.com/resources/blog/role-based-access-for-therapy-notes-and-mental-health-records)

## More questions

### Can I use WhatsApp to book appointments?

Booking messages are lower risk if they contain no clinical detail. Never share notes, assessments or diagnoses over WhatsApp, and remember phones are often shared.

### Do I need to register with the ODPC as a solo practitioner?

Most practitioners who process health data must register as data controllers with the Office of the Data Protection Commissioner. Check the current thresholds on the ODPC website.

## Related reading

- [Role-Based Access for Therapy Notes and Mental Health Records](https://tymirahealth.com/resources/blog/role-based-access-for-therapy-notes-and-mental-health-records)
- [Digital Consent Management for Mental Health Clinics](https://tymirahealth.com/resources/blog/digital-consent-management-for-mental-health-clinics)

## Related questions

- [Do I need parental consent to keep records for a child I counsel?](https://tymirahealth.com/resources/faqs/do-i-need-parental-consent-to-keep-records-for-a-child-i-counsel)
- [How can clients access their own therapy records in Kenya?](https://tymirahealth.com/resources/faqs/how-can-clients-access-their-own-therapy-records-in-kenya)
- [How long should a mental health practice keep client records, and how should it dispose of them?](https://tymirahealth.com/resources/faqs/how-long-should-a-mental-health-practice-keep-client-records-and-how-should-it-dispose-of-them)

---

**About Tymira Health:** Tymira Health is a healthcare technology company based in Nairobi, Kenya. It builds Tymira360, a practice management and EHR platform for mental health, physiotherapy and dental providers, clinics, hospitals, NGOs and insurers across Africa.

- Book a demo: https://tymirahealth.com/demo
- Contact: https://tymirahealth.com/contact (info@tymirahealth.com)
- All resources: https://tymirahealth.com/resources/all