A health worker uses a tablet during a patient consultation in Zimbabwe. As medical records move online, who controls the information patients leave behind? Photo: Zimbabwe Ministry of Health and Child Care
By Dr Blessing Ivan VavaHealth data is deeply personal. It records illnesses I have suffered, medicines I take, tests I have undergone, my blood type and perhaps even my genetic characteristics. Increasingly, it can also reveal patterns from which algorithms make predictions about my health. In other words, my health data does not simply record what has happened to my body. It can be used to anticipate what might happen next.
Governments understand the value of such information, sometimes in extraordinary ways. In 2022, Paris Match reported that Vladimir Putin's security officers collected his urine and excrement during some foreign trips and carried it back to Russia, apparently to prevent foreign intelligence services from analysing his biological waste for clues about his health. The claim has never been officially confirmed, but the security logic behind it is revealing.
I remember similar talk in Harare when Chinese President Xi Jinping visited Zimbabwe in December 2015. Stories circulated that his delegation had brought his own toilet, and that his bodily waste would not be left behind. I cannot verify those claims, and they should be treated as the kind of security folklore that often surrounds powerful leaders. But viewed alongside what has since been reported about the extraordinary precautions states take to protect the biological traces of their leaders, the story no longer sounds quite as eccentric as it did then.
Other leaders take precautions against leaving biological traces abroad. Reporting on the elaborate preparations surrounding meetings between American and Chinese presidents, including Xi Jinping, has described measures intended to prevent inadvertent DNA leaks through objects used by leaders. After Kim Jong Un met Putin in Beijing in 2025, North Korean officials were filmed wiping his chair and table and removing his drinking glass. Kim has also been reported to travel with his own toilet.
There is a serious point beneath these unusual rituals. Powerful states understand that biological material is information. A drinking glass, a strand of hair, saliva, blood, urine or human waste can reveal things about a person they may never have intended to disclose.
If governments go to such lengths to protect the biological traces of one leader, what should African states make of agreements potentially involving health information and biological material belonging to millions of their citizens?
Hospitals across Africa are digitising patient records. Laboratories are producing genomic and pathogen data. Governments are building electronic health systems, while artificial intelligence is moving into diagnostics, epidemiology and pharmaceutical research. Information that once sat in a doctor's file is entering systems capable of storing, combining and analysing it at enormous scale.
So who ultimately controls Africa's health data?
When health assistance meets sovereignty
In 2026, several African governments pushed back against proposed bilateral health arrangements with the United States over provisions dealing with health data, biological specimens, privacy and sovereignty.
Zimbabwe declined to proceed with its proposed arrangement. Ghana rejected a proposed agreement after its authorities raised concerns about access to sensitive health information. Ghana's Data Protection Commission said the contemplated access went beyond ordinary health statistics and could extend to datasets, metadata, dashboards, reporting tools, data models and data dictionaries.
Namibia also rejected proposed arrangements involving health data and biological specimens. Zambia raised objections to data-sharing provisions during negotiations. Kenya took a different route: it signed an agreement, but its implementation faced a legal challenge over privacy, transparency, data protection and foreign access to sensitive health information.
This is not a rejection of international health cooperation. African health systems have benefited enormously from international partnerships, research collaboration and external financing. The dispute is about the terms on which that cooperation takes place.
For decades, debates about foreign assistance centred largely on money: who provides it, how much and under what conditions. In the digital age, data has entered that negotiation. An African country may receive millions of dollars in health assistance, but if an agreement also gives external actors access to valuable datasets, biological samples or analytical systems, we cannot measure the relationship only by what comes in. We must also account for what goes out.
A barrel of oil leaving an African port can be counted. Copper leaving Zambia can be weighed. Lithium leaving Zimbabwe can be valued. Millions of data points can cross borders almost invisibly. Unlike a mineral, they can be copied, combined and reused.
The raw material may be us
Africa knows this story in another form. For generations, the continent exported raw materials while much of the processing, technological development and value creation happened elsewhere. Copper left Zambia, gold left Ghana, diamonds left Zimbabwe and Botswana, oil left Nigeria and Angola.
Now some of the raw material sits inside African bodies, hospitals and databases: medical histories, genomic information, pathogen samples, disease-surveillance data and demographic patterns.
There are precedents worth remembering. In 2010, an international team sequenced the genomes of four elderly San men from Namibia alongside that of Archbishop Desmond Tutu and published the findings in Nature. The Working Group of Indigenous Minorities in Southern Africa later objected that San leadership had not been properly consulted and that the paper used language some San people considered offensive. Communities whose DNA had contributed to new scientific knowledge had little say in how it was subsequently used. Once sequenced, that genetic information could circulate indefinitely.
The Omicron episode exposed a different problem. In November 2021, Dr Sikhulile Moyo and colleagues at the Botswana-Harvard HIV Reference Laboratory detected an unusual pattern of mutations in COVID-19 samples and quickly shared their findings with the world. Within days, Botswana and South Africa faced travel restrictions imposed by some of the countries that had benefited from that scientific openness. Moyo's question at the time was pointed: “Is that how you reward science? By blacklisting countries?”
The data travelled faster than the solidarity.
None of this is an argument against sharing data. Modern medicine depends on scientific cooperation. The concern is what happens afterwards: who participates in the research, who owns the resulting intellectual property, what limits apply to secondary use and whether African institutions share fairly in the benefits.
Otherwise, an old economic relationship risks returning in digital form: Africa supplies the raw material, others develop the industries, and Africa later buys the finished product.
Only this time, the raw material may be us.
When health data feeds the machine
Large and diverse health datasets are becoming increasingly valuable to artificial intelligence. They can contribute to diagnostic systems, pharmaceutical research, epidemiological modelling and precision medicine. African patients could supply data used to develop valuable medical technologies that their hospitals may later be unable to afford or control.
Privacy is only one part of the problem. The larger issue is who has the computing power to turn African data into knowledge, who owns the algorithms and intellectual property produced from it, where those systems are hosted and where the value eventually settles.
Data centres belong in this conversation. Africa needs more of them, but governments do not need to build or own them all. Private investment can expand capacity, improve connectivity, develop technical skills and reduce dependence on offshore hosting.
A server located in Harare, Lusaka or Accra, however, does not automatically create sovereignty. A patient's medical record could be physically stored in Harare while the cloud architecture, software, encryption keys or administrative access remain controlled elsewhere.
Where a server sits is only part of the question; ownership can matter just as much. Legal authority, control of the software and encryption, and the ability of domestic regulators to enforce the rules are equally important. A country can host data within its borders while exercising remarkably little control over it.
Africa needs a mixed system: private investment, African technology companies, international firms operating under enforceable domestic laws, public-private partnerships and public infrastructure for particularly sensitive information.
Data cannot all be treated alike either. A supermarket's customer database is not equivalent to genomic information, medical records, passport databases, electoral systems or national-security information. Sensitive data requires stronger safeguards around hosting, encryption, access, onward transfer and cybersecurity.
Australia offered a live warning this week. Prime Minister Anthony Albanese revealed that an OpenAI agent had gained unauthorised access to the Medicare Statistics Reporting Service portal, a public-facing government site, while researching medical spending in June. OpenAI and the Australian government both stress that no patient records appear to have been reached but that framing understates the problem. A government database is not meant to be entered without authority; whether the agent reached patient records is beside the point once it crossed that boundary. Who bears responsibility when an AI agent goes rogue, code pursuing a task it was set, then crossing a line nobody authorised? OpenAI took nearly three months to tell the government, and did so by email to a public inbox, raising questions about who was answerable for its agent’s conduct. If that question has no clear answer for a government like Australia’s, African governments negotiating health-data agreements should insist on one before they sign.
The lesson is not to isolate Africa technologically. It is to ensure that dependence does not become surrender of control.
Saying no is not enough
Rejecting unacceptable agreements is one thing. Building credible alternatives is another.
Zimbabwe, Ghana and Namibia can refuse arrangements they consider unacceptable. Zambia can demand different terms. Kenyan citizens can test an agreement through their courts. But refusal means little if countries lack secure cloud infrastructure, domestic data centres, interoperable health systems, research computing facilities and the expertise to run them.
Africa has to build that capacity: universities need to produce data scientists, cybersecurity specialists, health-informatics experts and cloud architects; African technology companies should be developing health systems; governments need reliable digital public infrastructure; and researchers need the computing capacity to work with African datasets instead of merely supplying them to better-resourced institutions elsewhere.
Africa cannot spend the next decade regulating algorithms developed elsewhere without developing the capacity to build some of its own, drawing on African languages, data and epidemiological realities.
Whereas, African ownership alone guarantees nothing. An African-owned database can still be abused. A surveillance system does not become benign because its servers happen to sit in Harare, Lusaka, Nairobi or Accra.
The patient cannot disappear behind claims of national sovereignty. Citizens need enforceable rights over how their information is collected, stored, accessed and reused. Health information must be protected from political surveillance, discrimination and uses unrelated to legitimate healthcare.
Sovereignty should protect the state from external dependence without giving the state unlimited power over its citizens.
Taken together, these cases reveal a geosociotechnopolitical problem: the San genome controversy, the Omicron experience, today's health agreements and the scramble to build African data centres may appear to be separate stories, but they are not. Each turns on the relationship between technology and power — who produces knowledge, where information travels, whose laws follow it, who owns the infrastructure through which it moves, and who is strong enough to set the terms.
Consent given today cannot become a blank cheque for uses nobody contemplated years later. Scientific openness, as the Omicron episode showed, also requires some expectation of reciprocity. And sovereignty on paper means little when governments lack the technical capacity to exercise it.
Africa's health-data question, then, reaches beyond privacy. It concerns the terms on which the continent enters an economy increasingly built on information extracted from human beings.
Africa does not need to retreat from international scientific cooperation. It needs to negotiate from a stronger position. Governments should know what information is leaving their countries, why it is being transferred, how long it will be retained, who can access it and which jurisdiction governs it. Limits on secondary use and onward transfer must be clear. Where African biological samples or datasets contribute to commercially valuable discoveries, benefit-sharing should be part of the agreement. Deals involving sensitive information belonging to millions of citizens deserve proper legal and public scrutiny.
There is also strength in negotiating together. Fifty-four states separately facing global technology companies, pharmaceutical corporations, cloud providers and powerful governments create an obvious imbalance. National sovereignty matters, but so does Africa's collective bargaining power. The African Union should help turn that collective bargaining power into common terms for health-data agreements.
The twentieth century taught Africa what happens when strategic resources leave the continent while processing, knowledge and value creation happen elsewhere. Data presents that old problem in a new form.
Health data deserves particular attention because it comes from us. It records our bodies, illnesses, vulnerabilities and communities. Increasingly, it can feed technologies capable of generating enormous scientific and economic value.
Africa should share health data where doing so saves lives and advances science. But sharing cannot be detached from the terms: the limits placed on its use, the institutions that gain access and whether the people and countries from which it comes participate in the knowledge and value eventually created.
Africa should neither become a digital fortress nor remain a digital mine. It needs the capacity to protect its citizens, negotiate fair partnerships, build infrastructure and turn African data into African knowledge and innovation.
Perhaps those strange precautions surrounding presidential biological traces contain a lesson after all. If powerful states worry that the DNA on a drinking glass, or even the bodily waste of one leader, could reveal strategically valuable information, African governments should think carefully about the value contained in the health information of more than a billion people.
The question is no longer whether that information has value. It is who controls it, what is built from it, and who benefits. Ends//
About the Author
Dr Blessing Ivan Vava is a researcher and civic leader working on democracy, technology and digital sovereignty in Africa. He holds a doctorate in Communication Studies from the University of Johannesburg, where his research examined Chinese ICT investment in Zimbabwe and the intersection of technology, geopolitics and power. He is the founder of the Southern Africa Coalition for Democracy and Accountability (SACDA) and writes The Thursday Briefing, a weekly commentary on politics, technology and governance in Africa.
