Privacy notice

Who we are

the hospital is responsible for the personal and health information we hold about you (the “data controller” under Kenya’s Data Protection Act, 2019).

What we collect

• Identity and contact details: name, date of birth, sex, ID or passport number, phone, email, address, next of kin.
• Health information: symptoms, vital signs, diagnoses, test and scan results, prescriptions, allergies and treatment notes.
• Payment and insurance details: insurance or SHA membership, bills, and M-Pesa payment references.
• For online bookings: the details you type into the form and the date you sent it.

Why we use it

• To diagnose and treat you, and to keep a safe, accurate medical record.
• To bill you or your insurer and to process payments.
• To meet legal duties, such as reporting notifiable diseases and health statistics to the Ministry of Health.
• With your agreement only: sharing through the national Health Information Exchange, and anonymised research.

We do not sell your information or use it for advertising.

Who we share it with

• Health workers at the hospital who are involved in your care. Staff only see what their role needs, and every look at your record is logged.
• The Social Health Authority (SHA) and your insurer, to check cover and pay claims.
• The Digital Health Agency’s national Health Information Exchange, if you agree, so other facilities treating you can see your history.
• The Ministry of Health and public health authorities, where the law requires it.
• Service providers who work for us under contract: Safaricom (M-Pesa payments) and a cloud storage provider that keeps encrypted backup copies, which may be located outside Kenya.

How long we keep it

Medical records are kept for as long as Kenyan law requires for health records, then securely destroyed. Online booking requests are kept with your record; the internet (IP) address a booking was sent from is deleted after 30 days. Records of who accessed your information are kept permanently.

How we protect it

Access is limited by job role and protected by passwords and two-step sign-in. Backups are encrypted. If your information is ever exposed, we will report it to the Data Protection Commissioner and tell you where required.

Your rights

You can ask us to:

• give you a copy of the information we hold about you;
• correct information that is wrong or incomplete;
• stop sharing through the Health Information Exchange at any time;
• delete information we no longer need. Medical records the law requires us to keep cannot be deleted early;
• object to or restrict a particular use of your information.

Ask at reception or contact us below. We will check your identity and reply within 7 days for copies and 14 days for other requests. If you are unhappy with our answer you can complain to the Office of the Data Protection Commissioner (www.odpc.go.ke).

Children

For patients under 18, a parent or guardian gives consent on their behalf.

Contact