Privacy Policy

Introduction

PathCare Kenya Limited (“we,” “our,” or “us”) is committed to protecting your personal and health information in accordance with the Kenya Data Protection Act, 2019 (DPA) and related regulations. This Privacy Policy explains how we collect, use, disclose, store, and safeguard your personal data and informs you about your rights with respect to your data.

Data Controller Information

Data Controller: PathCare Kenya Limited
Address: Regal Plaza, Limuru Road, Nairobi, Kenya
ODPC Registration Number: 185-4111-1498
Phone: 0111 121 500
Email: enquiries@pathcarekenya.com

Scope and Application

This policy applies to all personal data collected from patients, clients, employees, website users, contractors, and other individuals (“data subjects”) in connection with our medical laboratory services, whether collected offline or online. It governs how all PathCare Kenya staff, contractors, and third-party service providers process your data.

Information We Collect

Personal Identification Data: Name, date of birth, national ID or passport number, postal and physical addresses, telephone numbers, email addresses.
Health and Medical Data: Laboratory test results, medical history, referring healthcare provider details, insurance and claim information.
Billing and Payment Information: Payment card details, insurance provider information, billing addresses.
Usage and Technical Data: IP addresses, device type, browser information, cookies and website analytics data.
Security Data: CCTV footage, access logs, and other monitoring data for the security of our premises.

Sources of Data

We collect data directly from you when you provide it, from referring healthcare providers, insurers, and via our website and other online platforms. Some data may also be obtained from publicly available sources, with your consent.

Use of Cookies and Tracking Technologies

Our website uses cookies and similar tracking technologies to enhance user experience, analyze website usage, and for security purposes. You can control cookie preferences via your browser settings.

Purpose and Legal Basis of Processing

Providing and managing laboratory and diagnostic services accurately and efficiently.
Communicating test results and associated health information to you and your healthcare providers.
Appointment scheduling, billing, claims processing, and payment collection.
Compliance with legal and regulatory obligations, including accreditation requirements.
Improving our services, medical practices, and website usability.

Consent

We seek your explicit, freely given, informed consent before processing sensitive personal health data unless there is another lawful basis under the Kenya DPA.
You may withdraw your consent at any time; however, this may limit our ability to provide certain services or process your information as needed.

Data Subject Rights

Right to be informed about the collection and use of your personal data.
Right of access to see the data we hold about you and obtain copies.
Right to correction of inaccurate or incomplete data.
Right to deletion where lawful and applicable.
Right to restrict or object to certain processing activities.
Right to withdraw consent where processing is based on consent.
Right to data portability to receive your personal data in a structured, commonly used format.
Right to lodge complaints with our Data Protection Officer or the Office of the Data Protection Commissioner.

Data Retention

We retain your personal data only for as long as necessary to fulfill the purposes for which it was collected or as required by laws or regulatory guidance. Data that is no longer needed is securely deleted or anonymized.

Data Sharing and Disclosure

With referring healthcare providers to support your care continuum.
With insurance companies or payers for claims and billing purposes.
With government agencies, regulators, and authorities as required by law or court orders.
With accredited third-party service providers (such as IT, billing, quality control providers) under strict confidentiality and data protection agreements.

Transfers of data outside Kenya occur only with adequate protections or your explicit consent, complying with Kenya DPA requirements.

Data Security

Encryption of electronic data both in transit and at rest.
Role-based access controls limiting data access to authorized personnel only.
Regular staff training on data protection, confidentiality, and security.
Physical security measures such as secure premises and CCTV monitoring.
Procedures for responding promptly to any data breaches and providing necessary notifications.

Data Breach Notification

In the event of a personal data breach, we have procedures to promptly assess and notify affected individuals and the Office of the Data Protection Commissioner as required by law.

Policy Updates

This Privacy Policy may be updated periodically to reflect changes in legal requirements, our practices, or technology. We will publish updated policies on our website and communicate material changes appropriately. Continued use of our services after such updates constitutes acceptance of the new policy.

Contact Information

Phone: 0111 121 500
Email: enquiries@pathcarekenya.com