AI raises the stakes for African health data protection

Health data is becoming a strategic resource in the AI era. In South Africa and across the continent, the question is not simply who has access to data, but who controls it, who benefits from the technologies built from it, and whether countries generating the data have the capacity to use it themselves.

Paper data repositories present a great challenge for pooling health data and tracking a patient's medical history; digitising public health data is an effective solution. Photo: RDNE Stock Project

In the subterranean room of a public clinic in Diepsloot, one of the most populous and lowest-income townships in Johannesburg, South Africa, lie boxes stacked with years of patient histories, all damp, greying, and decaying.

“This is a data repository—how we have always kept paper records over the last 100 years in South Africa’s public clinics—torn manilas, water-rusted booklets, clinical notes [becoming] unreadable over time,” explains Bhaizani Bonza, a veteran nurse at Diepsloot South Clinic.

Paper health databanks like this are common across most public hospitals that serve low-income communities in South Africa, a nation of 60 million. If a woman is treated for maternal syphilis in Gauteng, the country’s highest-income province, and relocates to low-income Eastern Cape, doctors would struggle to draw the pattern of her medical history, Bonza says.

From 2024, a nascent revolution has been underway, as a trial model, to discard South Africa’s hospital data’s “paper prison” dilemma and replace it with an integrated digital architecture known as the Electronic Medical Record (EMR) system, or e-Impilo (a Zulu word meaning life and health).

This is a blueprint for digitising public health data that the rest of Africa has also been working towards, with varying degrees of success. But as health data becomes an increasingly valuable resource in the age of AI, a pressing question is emerging: who gets to decide how that data is used?

The America First Global Health Strategy, launched by the Trump administration in 2025, has prompted debate over US efforts to expand access to African digital health information, including electronic medical records, epidemiological data, and high-risk pathogen samples.

Countries like South Africa that have not signed a memorandum of understanding risk losing access to US-backed health programmes and funding streams. Those that do sign must weigh the benefits of continued health cooperation against questions about data governance, sovereignty, and who ultimately controls and benefits from the information generated by their populations.

Risk to African data sovereignty

The America First Global Health Strategy places disease surveillance and health data at the centre of US global health cooperation. The strategy has produced bilateral agreements with more than 30 partner countries so far, most of them low- and middle-income and a majority in Africa. These agreements aim to strengthen health security by improving access to health information, but there are significant concerns about data ownership and whether countries generating valuable health data will retain control over how it is used.

The legal texts underpinning these bilateral requests also do not make clear whether African countries will receive reciprocal access to US medical, pathological, and genetic data to train their own AI models and support homegrown biopharmaceutical innovation.

“Africa has high-quality raw data—hence the US request for Africa’s medical pathogens and genetic data mirrors the deeply entrenched patterns of old extractive industries in metals, forests, and ocean products.”

“It’s a classic divide-and-rule strategy, the most potent weapon in the colonial playbook,” Tatenda Chatikobo, a research fellow at the University of Warwick's School of Law, says of the asymmetrical powerplay that has resulted in countries like Zimbabwe refusing a US$367 million offer and Ghana a deal worth US$109 million due to worries about digital sovereignty and data protection. Judges in Kenya briefly blocked the country’s US$2.5bn agreement due to lawsuits over medical privacy.

Chatikobo is part of a Wellcome-funded project focusing on global health law, bioethics, epidemiology, and governance and co-authored the widely cited 2024 journal article, "Colonialism in the new digital health agenda", in BMJ Global Health. The proposed deals are “extractive,” he says. “It’s not really sharing because the corresponding value is not really [clear]. We understand there’s vague talk of an exchange of aid on top of data.”

Valuable source of medical data

Africa has become an increasingly valuable source of medical data because many of the datasets used to develop AI tools today are heavily biased towards Western populations. They often fail to capture Africa's genetic diversity, making African data essential for building more accurate and reliable AI tools.

“Africa has high-quality raw data—hence the US request for Africa’s medical pathogens and genetic data mirrors the deeply entrenched patterns of old extractive industries in metals, forests, and ocean products,” Chatikobo says.

Africa's genetic diversity, represented through digital biometric identifiers such as facial scans, provides great potential for advancements in global genomic medicine. Photo: cottonbro

Dr Joe Phaahla, the South African Deputy Minister of Health, speaking in his personal capacity, says Africa is home to some of the world’s highest genetic diversity. He believes the continent is sitting on a “treasure trove” of genomic and medical data that is “highly precious”. Domestic governments have been collecting health information in various forms for decades, he says, and are now increasingly linking those records to digital biometric identifiers such as fingerprints and facial scans. “Our data could really unlock a lot of things,” Phaahla adds.

The Trump administration has also proposed providing African health agencies with proprietary, US-hosted digital health software at no cost. Critics, however, argue that the licensing arrangements deserve closer scrutiny. If health data must be stored on cloud servers outside Africa and governed by foreign legal jurisdictions, countries could have less practical control over how that data is accessed, managed, and reused.

Precision medicine and commercial collaborations

Donrich Thaldar, a prominent South African specialist litigator in reproductive law cases, is currently principal investigator of a National Public Health Institute of South Africa-funded project that examines the legal aspects of data science in health innovation in Africa. He takes a contrarian view to wholesale criticism of the US requests.

Thaldar says Africa has long argued that precision medicine has been shaped by research and innovation that underrepresent people of African ethnicity, leaving many populations without treatments tailored to their genetic diversity. Now, as African countries build valuable genomic datasets, he believes the continent needs to explore methods to share this information with global biomedical innovators while ensuring that the resulting discoveries benefit African populations.

“If African populations are to have access to precision medicine, then they must offer their data so that research can be done on their data,” Thaldar says, adding that he believes the continent must move beyond the traditional aid-based model towards more equitable commercial collaborations. “For example, tell the US: ‘You can have access to this [information] on the following conditions—licence payment and any [intellectual property] generated from it, [to which] we must have certain access.’”

A US-Africa collaboration should empower African clinical scientists, enrich local clinical skills, and keep a vast amount of intellectual property in Africa. Photo: National Cancer Institute

Thaldar says countries have an ethical responsibility to ensure high-quality data about their populations exists and that this data is shared with researchers who can use it to advance knowledge and improve health outcomes. “From a public health perspective, we want our populations to be healthy and have access to the best possible, newest kind of treatments and medicines,” he says.

For Thaldar, part of setting ethical and legal benchmarks for this kind of collaboration means insisting that African clinical scientists do more than draw blood for genetic samples. They should be empowered to extract the DNA, sequence the genetic data and map it, and store the data locally. That kind of model creates meaningful jobs on the continent, enriches local clinical skills, and keeps a lot of the intellectual property at home in Africa. “Hopefully from there, a local bioeconomy can flourish,” he argues.

Plan to protect health data

Between fears of extraction and calls to negotiate, what is clear is that Africa must have a plan for its health data. What is needed, Deputy Minister of Health Phaahla argues, is for African countries to have a clear strategy for protecting and using their health data. “To refuse the Americans, or grant them access, we need to first ask ourselves: what actually are we going to do with this data as Africans to safeguard our interests?”

That question is arguably sharpest for countries without a digitised health data system. The US could offer these countries a lucrative sum to build a digital system from scratch, then attach a clause ensuring that once the repository is live, the US government and allied organisations get priority access to the genetic data it holds.

“We would need to give our nod of approval in a sort of referendum as citizens before our government can do a wholesale handover of sensitive health data to Americans.”

South Africa’s new EMR system offers a contrast as the country is pursuing its development aggressively and largely on its own terms. Indeed, South Africa is, arguably, the best-positioned African nation to push back against the America First Global Health Strategy. Its Protection of Personal Information Act (POPIA)—a robust framework for protecting citizens' personal data, similar to the EU’s General Data Protection Regulation—gives government and courts legal grounds to resist a wholesale handover of health data to the US.

“We would need to give our nod of approval in a sort of referendum as citizens before our government can do a wholesale handover of sensitive health data to Americans,” explains Bonza, the nurse at Diepsloot South Clinic. “Such preparedness in terms of domestic data protection is arguably one of the reasons why the US has not had an easy time trying to arm-twist us in South Africa.”

For the rest of Africa, the current US strategy marks a sobering moment and a time for reflection, Chatikobo says. “We are yet to come up with very much African-owned, AI-driven health data tech infrastructure—and that’s a weak link.”