Data Protection & Privacy Notice

1. Introduction

Eldoret Hospital ("the Hospital", "we", "us", "our") respects your privacy and is committed to protecting your personal data in compliance with the Kenyan Data Protection law and attendant regulations. This Privacy Notice explains who we are, what personal data we collect, how we collect it, how we use it, how we safeguard it and what rights you have under the Data Protection Act, 2019 (Cap. 411C).

We are dedicated to transparency and ensuring that your personal data, especially sensitive medical data, is handled lawfully, fairly, and with utmost confidentiality.

2. Who We Are

We are Eldoret Hospital, a premier, fully-fledged private Level 6 medical facility located along Makasembo Road in Eldoret, Kenya. Established in 1975, we have grown over the past 50 years into one of the largest and most trusted healthcare providers in the Rift Valley and Western region. Our website is https://www.eldorethospital.com/

3. Data Controller

For the purposes of the Data Protection Act, 2019; Eldoret Hospital Limited P.O BOX 2234 – 30100, Makasembo Road, Eldoret Kenya is a duly registered Data Controller. Our Data Protection Officer can be reached through the details in the Contacting Us section.

4. Personal Data We Collect

We may collect, store, and process the following categories of personal data:

• Identity Data: Full name, national ID/passport number, date of birth, gender, and next of kin details.
• Contact Data: Physical address, email address, telephone numbers, emergency contacts.
• Medical & Health Data (Special Category): Patient medical history, diagnoses, test results (lab/radiology), prescriptions, treatment plans, surgical records, insurance claims, and any other health-related information. This data is processed under strict confidentiality as required by medical ethics and the DPA.
• Financial & Insurance Data: Insurance policy numbers, SHA details, billing information, payment history.
• Technical Data: IP address, browser type, device identifiers, cookies, and usage statistics when you browse our website, operating system, time zone.
• Communication Data: Any correspondence via phone, email, social media, or contact forms.

5. How We Collect Your Data

We collect personal data through the following lawful means:

• Direct interactions: When you fill patient registration forms, admission documents, consent forms, book appointments online, call our call center, or visit the hospital physically.
• Automated technologies: Cookies, server logs, and analytics tools when you browse our website (e.g., to improve user experience).
• Third parties: Referring doctors, diagnostic laboratories, insurance companies, SHA or emergency services — only with your explicit consent or as permitted by law for treatment continuity.

6. How We Use Your Personal Data

We process your personal data only for legitimate purposes related to healthcare and hospital administration:

• Providing medical diagnosis, treatment, nursing care, and rehabilitation.
• Managing appointments, admissions, discharges, and billing.
• Communicating test results, treatment updates, health reminders, and follow-ups.
• Processing insurance claims, SHA reimbursements and payments.
• Enhancing patient safety, medical research (anonymized), and quality improvement.
• Complying with legal obligations (e.g., notifiable disease reporting to Ministry of Health, court orders).
• Website analytics to improve navigation and patient experience.
• Security: CCTV surveillance for the safety of patients, staff, and hospital property.

7. Legal Basis for Processing of Personal Data

Under the Kenya Data Protection Act, we rely on the following lawful bases:

• Consent: For processing sensitive medical data (where not necessary for treatment) or marketing communications.
• Contractual necessity: Processing required to provide medical treatment and healthcare services you requested.
• Legal obligation: Compliance with Kenyan laws (e.g., Public Health Act, Medical Practitioners Act).
• Vital interests: Where it is strictly necessary that life is preserved or serious harm is prevented.
• Legitimate interests: For improving our services, fraud prevention, physical security (CCTV) and internal administration, provided your rights are not overridden by such interests.

8. Data Sharing & Disclosure

We do not sell or rent your personal data. However, we may share your data with:

• Healthcare providers: Consultants, specialists, labs, pharmacies and radiology partners involved in your care (under strict confidentiality agreements).
• Insurance companies & SHA: For claim verification and payment processing.
• Legal & regulatory authorities: When required by Kenyan law or court order.
• IT service providers: Third-party vendors hosting our website or electronic medical records (only under data processing agreements compliant with DPA).

Any transfer of data outside Kenya (e.g., cloud backup) will only occur with adequate safeguards and your consent where required by the DPA.

9. Data Security

We implement appropriate technical and organizational measures to protect your data from unauthorized access, loss, alteration, or disclosure. These include:

• Encryption of electronic medical records and website data (SSL/TLS).
• Role-based access controls: Only authorized medical staff can view patient data.
• Regular security audits, staff training on data protection, and incident response protocols.

10. Is Providing Your Data Mandatory?

Most of the personal data we request from you is necessary for us to register you as a patient, provide safe medical treatment, process billing and insurance claims and meet our legal reporting obligations. If you do not provide requested information – for example identity or next of kin details – we may be unable to proceed with registration, certain treatments, insurance claims or adhere to legal reporting obligations and we will tell you when this is the case. Where personal data is requested for a voluntary purpose such as marketing communications, you are free to decline without any effect on your care.

11. Data Retention

We retain your personal data only for the length of time necessary to complete the purposes set out in this policy and to comply with legal obligations. After the retention period elapses, data will be securely anonymized or deleted.

12. Your Rights

Except for certain limitations, you have the following rights under the existing Data Protection Act:

• Right to access – Request a copy of your personal data held by us.
• Right to rectification – Correct inaccurate or incomplete data.
• Right to erasure – Request deletion of your data, subject to legal retention requirements (e.g. medical records).
• Right to restrict processing – Limit how we use your data in certain circumstances e.g. marketing purposes.
• Right to data portability – Receive your data in a structured, machine-readable format.
• Right to object – Object to processing based on legitimate interests or direct marketing.
• Right to withdraw consent – Withdraw previously given consent at any time (without affecting lawfulness of processing done before withdrawal).

To exercise any of these rights, please contact our Data Protection Officer using the details in the Contacting Us Section. A request may be limited or refused only where the Act permits – for example, where it would reveal another person's data without their consent. Any such refusal is documented, explained to you in writing, and comes with notice of your right to complain.

13. CCTV

14. Cookies & Tracking Technologies

Our website uses cookies to enhance user experience, analyze site traffic, and remember your preferences. When you first visit the site, a consent notice lets you Accept non-essential cookies or Decline (in which case only strictly necessary cookies are used). Your choice is stored on your device and respected on subsequent visits. We do not use cookies to collect sensitive data. You may also control or delete cookies at any time through your browser settings; disabling cookies may affect some functionality of the site. You can review or change your cookie choice at any time.

Manage Cookie Preferences

15. Automated Decision Making

We do not currently use your personal data for any decision based solely on automated processing or profiling that produces legal or similar significant effects on you. If this changes we will update this notice accordingly.

16. Children's Privacy

Our services are directed to individuals of all ages, but for minors (under 18 years), personal data will be collected with the consent of a verified parent or legal guardian. All processing involving minors is conducted in a manner that protects the rights and best interests of the child as per Kenyan law (Children's Act). We do not knowingly collect data from children without parental consent.

17. Complaints

In the event of a formal written request or complaint, we will follow up with the party making the request or complaint. To the extent required by the law, should we fail to properly address your request or complaint, you have the right to lodge a complaint with the Office of the Data Protection Commissioner.

Website: www.odpc.go.ke

18. Changes to This Privacy Policy

We review this Privacy Policy from time to time and may update it to reflect changes in legal requirements, our data practices or operational needs. The revised version will be posted on this page with an updated "Last Updated" date. We encourage you to review this policy periodically. Material changes will be notified via a notice on our website or direct communication where required by law.

19. Contact Us / Data Protection Officer (DPO)

We have a designated Data Protection Officer whom you can reach out to if you have any questions and concerns regarding this Privacy Policy or requests in exercise of your data subject rights, as follows:

You also have the right to lodge a complaint with the Office of the Data Protection Commissioner (ODPC) at:
www.odpc.go.ke | P.O Box 3098-00100, Nairobi, Kenya.