Privacy Policy

1. Data Controller

The data controller for all personal information collected through this website and our clinical services is:

2. Information We Collect

We collect two categories of information:

3. Lawful Basis for Processing

Under the Kenya Data Protection Act, 2019, we process your data on the following lawful grounds:

• Consent: You have given explicit consent for specific uses such as appointment booking or receiving health tips via email.
• Contractual necessity: Processing is necessary to deliver the clinical services you have requested.
• Legal obligation: We are required to maintain patient records under the Kenya Health Act (Cap. 241) and KMPDC guidelines.
• Vital interests: In emergency situations, we may process your data to protect your life or that of another person.
• Public health: Certain disease notifications are legally required under the Public Health Act (Cap. 242).

4. How We Use Your Information

• To schedule, confirm, and manage your medical appointments
• To provide safe, accurate, and continuous clinical care
• To process insurance and SHA/SHIF claims on your behalf
• To communicate with you regarding your treatment, results, or follow-up care
• To fulfill mandatory disease notification and public health reporting
• To improve operational efficiency and quality of care at our facility
• To send health awareness communications (only with your explicit consent)

5. Disclosure of Your Information

We do not sell, rent, or trade your personal data. We may share your information only with:

• Treating clinicians and specialists involved in your care, both within and at referred facilities
• Insurance providers and SHA/SHIF for claims processing, under your authorization
• Government health authorities (e.g., County Health Department, Ministry of Health) as required by law
• Clinical laboratories or diagnostic partners engaged for test processing
• Legal authorities when compelled by a valid court order

6. Data Retention

Medical records are retained for a minimum of 10 years after your last clinical contact, or for 10 years after a minor reaches 18 years of age, in accordance with Kenyan health regulations. Website interaction data is retained for no longer than 24 months.

7. Your Rights

Under the Kenya Data Protection Act, 2019, you have the right to:

• Access — Request a copy of your personal data we hold
• Rectification — Request correction of inaccurate or incomplete data
• Erasure — Request deletion of your data where no legal obligation to retain it exists
• Restriction — Request that we limit processing of your data in certain circumstances
• Objection — Object to processing where we rely on legitimate interests
• Data portability — Receive your data in a structured, machine-readable format
• Withdraw consent — Where processing is based on consent, you may withdraw at any time

To exercise any of these rights, contact us at tanakanursinghome@gmail.com. We will respond within 21 days. You may also lodge a complaint with the Office of the Data Protection Commissioner of Kenya (ODPC).

8. Data Security

We implement appropriate technical and organizational measures to protect your personal and health data from unauthorized access, disclosure, alteration, or destruction. These include: restricted access controls, staff confidentiality obligations, secure physical records storage, and encrypted digital transmission where applicable.

9. Cookies and Website Data

Our website uses essential cookies for functionality only. We do not use tracking, advertising, or third-party analytics cookies. By using this website you consent to the use of strictly necessary cookies.

10. Changes to This Policy

We may update this Privacy Policy to reflect changes in law or our practices. Any material changes will be posted on this page with a revised "Last Updated" date. Continued use of our services following such changes constitutes acceptance of the updated policy.