Open code, public numbers, careful data
Anyone can read how Khanya Visit works, check the rules it follows and see how it is being used. The answers a mother gives stay private.
The code
Khanya Visit will be public on GitHub, with its full build history. The code is under the MIT licence, and every source file carries a licence header. Our own question flows, guidance, training material and illustrations are under CC-BY 4.0.
It is an installable web app built with React and TypeScript. It works offline, stores answers encrypted on the phone and bundles its open-source fonts and icons, so it loads nothing from outside servers.
Forks are welcome. Because the app gives safety advice, a modified version must use a different name and icon so it can't pass as ours, and it may say "based on Khanya Visit". The details are in TRADEMARKS.md in the repository.
The rules
The next steps come from one published rules file, which partners and clinicians can read and challenge line by line. Only two answers can make a visit urgent: a sign that the mother may harm herself, or a sign that she is in immediate danger. When the Baby check arrives, a sign that the baby is ill becomes the third, with its own screen. Every rule has an automated test, and eight practice cases check that the whole plan comes out as expected; each rule that reads the baby's answers with the mother's will get a practice case of its own.
The current thresholds are practice values. A clinical advisor will set the real ones before the app is used in a real visit, and until then the app says "Practice thresholds. Not for real visits." on screen.
The AI
The AI explains plans and summarises the dashboard. It never chooses a step, a level or a referral. We use an open-weight model, and switching to another model is a configuration change, so no single company's service holds the product up. The instructions we give the model are published in the repository under CC-BY 4.0, next to the code that checks its answers.
The app talks to the model only through our own server, and only when it has signal. The model never receives a mother's answers, her age, the health worker's identity, the area or the date of a visit. For the dashboard note it receives the same weekly totals anyone can already see, with small counts removed. Our server doesn't store the requests or the replies.
The public dashboard
Any count under five reads "fewer than 5", so no one can be recognised from it. The dashboard never shows urgent cases, anything for a single health worker or phone, or dates finer than a week. While the app holds practice data, every page of the dashboard says so at the top.
How we handle data
Answers about mental health, violence at home and HIV are special personal information under POPIA, so we keep as little as we can. Everything the mother says, her plan, her referral choices and her age band are encrypted on the phone before they are stored. Only neutral codes, yes or no values, counts and timestamps travel in readable form, because the dashboard needs them.
On the server, the app can add visits but cannot read them back, and the public can read only the dashboard totals. Consent is recorded before any question, in the mother's language. She can decline any check, and she chooses every referral, except where the law requires a report.
We will not collect fingerprints, face scans or any other biometric from a mother or a baby. The clinic card planned for next year uses a random number on a sticker instead. The sticker holds that number and nothing else, the link between a baby's number and the mother's record is never on the sticker and sits behind role-based access, and nothing is ever sent to the mother's phone.