# What should vendor due diligence cover for a mental health EHR or app?

URL: https://tymirahealth.com/resources/faqs/what-should-vendor-due-diligence-cover-for-a-mental-health-ehr-or-app
For: Digital health teams | Digital health and technology | Reviewed by Independent clinical reviewer, Registered mental health clinician, Kenya | Last reviewed 8 November 2026

**Answer:** Check the vendor's Digital Health Agency certification status and ODPC registration, and sign a data processing agreement covering purposes, sub-processors, breach notice to you, hosting location, deletion and audit rights. Request security evidence such as a recent penetration test, an ISO/IEC 27001 certificate or equivalent, and backup and recovery policies. Confirm role-based access, audit logs, restricted-note support and data export in standard formats. Plan your exit: how you retrieve all records if the contract ends.

Sources: Kenya Law: https://new.kenyalaw.org/akn/ke/act/ln/2025/76/eng@2025-04-11 - Kenya Law: https://new.kenyalaw.org/akn/ke/act/2019/24/eng@2022-12-31 - ISO: https://www.iso.org/standard/27001 - ISO: https://www.iso.org/standard/84647.html

## Related questions

- [Can an AI chatbot be used to detect suicide risk or triage mental health crises?](https://tymirahealth.com/resources/faqs/can-an-ai-chatbot-be-used-to-detect-suicide-risk-or-triage-mental-health-crises)
- [Can generative AI be offered to clients for emotional support between sessions?](https://tymirahealth.com/resources/faqs/can-generative-ai-be-offered-to-clients-for-emotional-support-between-sessions)
- [Can PHQ-9 and similar screening tools be delivered digitally and scored automatically?](https://tymirahealth.com/resources/faqs/can-phq-9-and-similar-screening-tools-be-delivered-digitally-and-scored-automatically)

---

**About Tymira Health:** Tymira Health is a healthcare technology company based in Nairobi, Kenya. It builds Tymira360, a practice management and EHR platform for mental health, physiotherapy and dental providers, clinics, hospitals, NGOs and insurers across Africa.

- Book a demo: https://tymirahealth.com/demo
- Contact: https://tymirahealth.com/contact (info@tymirahealth.com)
- All resources: https://tymirahealth.com/resources/all