Legal

Privacy Policy

Last updated: 20 July 2026

Kabati Medicare Health Centre ("Kabati Medicare", "we", "us" or "our"), located in Kabati Town, Kitui County, Kenya, is committed to protecting the privacy and personal data of our patients, website visitors and other individuals we interact with. This Privacy Policy explains how we collect, use, disclose and protect personal data in accordance with the Data Protection Act, 2019 (Kenya), its subsidiary regulations, and other applicable Kenyan laws, including the Health Act, 2017 where patient health information is concerned.

By using our website at kabatimedicare.co.ke or by visiting our facility and receiving services from us, you acknowledge that you have read and understood this Privacy Policy.

1. Data Controller

For purposes of the Data Protection Act, 2019, Kabati Medicare Health Centre is the data controller and, in respect of laboratory and diagnostic processing carried out on our premises, may also act as data processor for referring practitioners. Our contact details are set out in the "Contact Us" section below.

2. Information We Collect

We may collect the following categories of personal data:

• Identification information: full name, date of birth, national ID or passport number, gender, next of kin details.
• Contact information: phone number, email address, physical or postal address.
• Health and medical information: medical history, symptoms, diagnoses, laboratory results, prescriptions, treatment records and other clinical notes, which constitute "sensitive personal data" under the Data Protection Act, 2019.
• Payment information: billing details, insurance or Social Health Authority (SHA) membership details, M-Pesa or other payment references.
• Website usage information: IP address, browser type, device information and pages visited, collected through cookies and similar technologies (see our Cookie Policy).
• Enquiry and communication information: details you submit through our contact form, phone calls, email or WhatsApp.

3. How We Use Your Information

We use personal data to:

• Provide outpatient consultation, laboratory, pharmacy, maternal and child health, and other clinical services;
• Maintain accurate patient medical records for continuity of care;
• Process billing, insurance and Social Health Authority (SHA) claims;
• Communicate with you about appointments, results and follow-up care;
• Respond to enquiries submitted through our website or other channels;
• Comply with legal, regulatory and public health reporting obligations, including those under the Ministry of Health and the Kenya Medical Practitioners and Dentists Council or relevant professional bodies;
• Improve our website, services and patient experience; and
• Protect the safety, rights and property of our patients, staff and the public.

4. Legal Basis for Processing

We process personal data on one or more of the following legal bases recognised under the Data Protection Act, 2019: your consent; performance of a contract for medical services; compliance with a legal obligation; protection of your vital interests (for example, in a medical emergency); and our legitimate interests in operating and improving our health centre, provided these do not override your fundamental rights and freedoms.

5. Health Data (Sensitive Personal Data)

Health information is treated as sensitive personal data and is handled with heightened confidentiality. Access to patient medical records is restricted to authorised clinical and administrative staff who require the information to provide or support your care, consistent with professional codes of medical confidentiality and the Health Act, 2017. We do not sell, rent or use your health data for marketing purposes.

6. Sharing and Disclosure of Data

We do not sell personal data. We may share personal data, on a need-to-know basis, with:

• Referral hospitals, laboratories or specialists involved in your treatment;
• The Social Health Authority (SHA), National Health Insurance Fund successors, or private insurers for claims processing, where applicable;
• Government agencies and regulators, where required by law (for example, notifiable disease reporting to the Ministry of Health);
• Our service providers, such as IT, hosting or payment processors, who are bound by confidentiality obligations; and
• Law enforcement or courts, where legally compelled to do so.

7. Data Retention

We retain patient medical records for the period required under Kenyan health record-keeping guidelines and professional practice standards, and other personal data only for as long as necessary to fulfil the purposes described in this Policy or as required by law, after which it is securely disposed of or anonymised.

8. Data Security

We implement reasonable technical, physical and organisational safeguards -- including restricted access, secure storage and staff confidentiality obligations -- to protect personal data against unauthorised access, loss, misuse or disclosure. No system is completely secure, and we encourage you to also take care when sharing personal information with us, particularly over unsecured channels.

9. Your Rights Under the Data Protection Act

Under the Data Protection Act, 2019, and subject to applicable exemptions, you have the right to:

• Be informed of the use to which your personal data is to be put;
• Access your personal data, including your medical records, held by us;
• Request correction of inaccurate or outdated personal data;
• Request deletion or destruction of personal data that is no longer required, subject to our legal and clinical record-keeping obligations;
• Object to or restrict certain processing of your personal data;
• Withdraw consent, where processing is based on consent, without affecting processing already carried out; and
• Lodge a complaint with the Office of the Data Protection Commissioner (ODPC), Kenya.

To exercise any of these rights, please contact us using the details in the "Contact Us" section below. We may need to verify your identity before actioning a request.

10. Cookies

Our website uses cookies and similar technologies to operate correctly and to understand how visitors use our site. Full details are set out in our Cookie Policy.

11. Children's Data

We provide maternal and child health services and may process personal data relating to minors where this is necessary for their care, always with the involvement and consent of a parent or guardian, in line with the Data Protection Act, 2019 and the Children Act.

12. Cross-Border Data Transfers

Where personal data is transferred outside Kenya (for example, where a website hosting or technology provider stores data on servers located abroad), we take steps to ensure such transfers comply with the Data Protection Act, 2019, including verifying that the recipient country or entity provides an adequate level of data protection, or that appropriate safeguards are in place.

13. Changes to this Policy

We may update this Privacy Policy from time to time to reflect changes in our practices or in the law. The "Last updated" date at the top of this page indicates when it was last revised. We encourage you to review this page periodically.

14. Contact Us / Complaints

If you have questions, requests or concerns about this Privacy Policy or how we handle your personal data, please contact us at:

Kabati Medicare Health Centre
Kabati Town, Kitui County, Kenya
Telephone: +254 726 824 349
Email: info@kabatimedicare.co.ke

If you are not satisfied with our response, you may lodge a complaint with the Office of the Data Protection Commissioner (ODPC), Kenya, via www.odpc.go.ke.