Privacy Policy

1. Introduction

Lymph & Pelvic Care Kenya Limited ("we", "us", "our", or "the Clinic") is a specialist physiotherapy clinic in Parklands, Nairobi. We have been treating pelvic health, lymphatic, and post-cancer conditions since 2003.

This Privacy Policy explains how we collect, use, share, and protect personal data when you visit lymphpelviccare.com (the "Site"), book an appointment, or otherwise interact with us. It is written to comply with the Kenya Data Protection Act 2019 (the "KDPA") and the Data Protection (General) Regulations 2021. Where you reach us from outside Kenya, we apply equivalent protections under the EU General Data Protection Regulation (GDPR).

By using our Site or services, you confirm you have read and understood this Policy.

2. Who is the Data Controller

The Data Controller for personal data processed via this Site is:

Lymph & Pelvic Care Kenya Limited
Park Medical Centre, Opposite Aga Khan Hospital
3rd Parklands, 2nd Floor, Room 205
Nairobi, Kenya

Email: info@lymphpelviccare.com
Phone: +254 743 669 653 / +254 722 356 053

ODPC Registration Number: [VERIFY WITH LEGAL — pending registration confirmation]

Data Protection Officer (DPO): For questions about your data or this Policy, contact us at info@lymphpelviccare.com. [VERIFY WITH LEGAL — formal DPO appointment pending]

3. What personal data we collect

3.1 Data you provide directly

When you complete the booking form on our Site, we collect:

• Your full name
• Your phone number
• Your email address
• The condition or service you are enquiring about
• Your preferred appointment time
• Any free-text health information you choose to share with us in the message field

When you contact us via the contact form, email, phone, or WhatsApp, we collect the contact details and message content you share.

3.2 Data we collect automatically

When you visit the Site we collect technical information through standard server logs and (with your consent) analytics tools, including:

• Device type, operating system, and browser
• Pages visited, time spent, and navigation paths
• Referring URL
• Approximate location derived from IP address (we do not store full IP addresses)

3.3 Sensitive personal data

Health information shared during booking, contact, or treatment is "sensitive personal data" under KDPA Section 25. We process this category only with your explicit consent or where a legal basis under KDPA Section 30 applies (for example, the provision of healthcare).

3.4 We do NOT collect

We do not knowingly collect data from children under 18 via the Site without parental or guardian consent. Paediatric patients are treated with the consent and presence of a parent or legal guardian; their treatment records are governed by clinic policy rather than this Site Privacy Policy.

4. Why we collect it (lawful basis)

We rely on the following lawful bases under KDPA Section 30 and, where applicable, GDPR Article 6:

5. How we use your personal data

We use your personal data to:

• Respond to your booking, enquiry, or contact request
• Schedule, deliver, and follow up on your treatment
• Send you appointment reminders and care instructions
• Process payments and issue receipts
• Improve our Site and our services
• Communicate with you about our courses, events, or services where you have asked us to (you can opt out at any time)
• Meet our legal, tax, and regulatory obligations
• Defend or pursue legal claims where necessary

6. Who we share your personal data with

We share personal data only where necessary and with the following categories of recipients:

6.1 Within the Clinic

The clinical staff treating you (named physiotherapist, supporting clinical team) access your data on a need-to-know basis to provide care.

6.2 Service providers (data processors)

We use third-party services to operate the Site and clinic. Each is bound by a data processing agreement (where required):

• Hosting: Vercel Inc. (United States) — Site hosting and content delivery
• Enquiry persistence: Supabase (eu-central-1, European Union) — booking and enquiry submissions are stored in our Supabase project, protected by row-level security, and only readable by the clinic team
• Email delivery: Resend (United States) — transactional email used to notify the clinic team when you submit a booking or enquiry form
• SMS delivery: Africa's Talking Limited (Kenya) — appointment reminders when implemented
• Booking platform: Cal.com Inc. (United States) — appointment scheduling when implemented
• Web analytics: Plausible Insights OÜ (Estonia / European Union) — privacy-preserving analytics when implemented and only with your consent

6.3 Insurers and medical bodies

Where you ask us to bill an insurer or refer you to another medical practitioner, we share the minimum necessary data with that party with your consent.

6.4 Regulators and law enforcement

Where required by law, court order, or to protect our or others' rights, life, or property, we may disclose data to the Office of the Data Protection Commissioner (ODPC), the Kenya Medical Practitioners and Dentists Council (KMPDC), tax authorities, or law enforcement.

6.5 We do NOT sell your data

We do not sell, rent, or trade your personal data to third parties for their own marketing.

7. International data transfers

Some of our service providers (e.g. Vercel, Resend, Cal.com) are based outside Kenya. When personal data is transferred outside Kenya, we apply safeguards under KDPA Section 49, which may include:

• Transfer to a country the ODPC considers adequate
• Standard contractual clauses approved by the ODPC or equivalent
• Your explicit consent after being informed of the risks

You can ask us for a copy of the safeguards in place by contacting info@lymphpelviccare.com.

8. How long we keep your data

After these periods we securely delete or irreversibly anonymise the data.

9. Your rights

Under KDPA Section 26 you have the right to:

• Be informed of how your data is processed (this Policy)
• Access the personal data we hold about you
• Rectify inaccurate or incomplete data
• Erase your data (subject to legal retention obligations)
• Restrict processing in certain circumstances
• Object to processing based on legitimate interests
• Data portability — receive your data in a structured, machine-readable format
• Withdraw consent at any time, where consent is the lawful basis
• Not be subject to automated decision-making that produces legal effects

To exercise any of these rights, email info@lymphpelviccare.com. We will respond within 30 days.

If you are not satisfied with our response, you may lodge a complaint with the Office of the Data Protection Commissioner of Kenya:

Office of the Data Protection Commissioner
Britam Tower, Hospital Road, Upper Hill
Nairobi, Kenya
Email: info@odpc.go.ke
Website: www.odpc.go.ke

10. Cookies and similar technologies

We use cookies and similar technologies to operate the Site and (with your consent) to understand how it is used.

We group cookies into three categories:

• Strictly Necessary: required for the Site to function. These cannot be disabled.
• Analytics: help us understand how visitors use the Site so we can improve it. Set only with your consent.
• Marketing: used to deliver relevant communications. Set only with your consent.

You can change your cookie preferences at any time by clicking "Cookie preferences" in the Site footer.

11. Security

We protect your personal data with appropriate technical and organisational measures, including:

• HTTPS encryption in transit
• Encrypted storage at rest where technically feasible
• Access controls limiting who can view sensitive data
• Regular review of our service providers' security practices
• Staff training on data protection

If a personal data breach occurs that is likely to result in a risk to your rights and freedoms, we will notify the ODPC within 72 hours of becoming aware, and we will inform you without undue delay where the breach is high risk, in accordance with KDPA Section 43.

12. Children

We treat patients of all ages, including paediatric patients. Treatment of children is provided only with the consent and presence of a parent or legal guardian. The Site is not directed at children under 18 without parental supervision; if you are under 18 please ask a parent or guardian to interact with the Site on your behalf for booking purposes.

13. Changes to this Policy

We may update this Policy from time to time. The "Last Updated" date at the top of the page tells you when. Where changes are material — for example, new categories of data, new processors, or changes to the legal basis — we will tell you by email (where we hold one) or by a prominent notice on the Site before the change takes effect. The cookie consent banner will also re-prompt where the analytics or marketing categories meaningfully change.

14. Contact us

If you have questions about this Policy or how we handle your data:

Email: info@lymphpelviccare.com
Phone: +254 743 669 653 / +254 722 356 053
Post: Park Medical Centre, Opposite Aga Khan Hospital, 3rd Parklands, 2nd Floor, Room 205, Nairobi, Kenya

— Lymph & Pelvic Care Kenya Limited