1. Introduction

This Privacy Notice ("Notice") shall apply to any and all personal information of our customers and visitors held by employees, assignees and agents of HealthX Africa. This privacy policy is to provide information to you, our patient, on how your personal information (which includes your health information) is collected and used within our practice, and the circumstances in which we may share it with third parties.

It continues to apply even if your agreement for health care services or other products and services with us ends. It should also be read alongside our Terms and Conditions, as these include sections relating to the use and disclosure of information.

In this document, wherever we have said "you" or "your", this shall mean you (the customer), any authorised person on your account, anyone who deals with us on your behalf (such as agents, advocates, trustees or executors, attorneys under a Power of Attorney) and other related people (including authorised signatories, partners, members). If you are an insurance customer it also means you, named insured parties or beneficiaries under your policy, dependants, claimants and other third parties involved in an insurance policy or claim.

2. Why and When Consent is Necessary

When you register as a patient of our practice, you provide consent for our physicians and practice staff to access and use your personal information so they can provide you with the best possible healthcare. Only staff who need to see your personal information will have access to it. If we need to use your information for anything else, we will seek additional consent from you to do this.

3. Why We Collect Your Data

We collect your information to enable us to provide you with health care services. Our main purpose for collecting, using, holding and sharing your personal information is to manage your health. Our staff will check your details with you to ensure they are up-to-date and correct.

4. What Data Do We Collect?

We collect Personal Data and Special Categories of Data that include but are not limited to:

•Names, date of birth, addresses, contact details, gender, registration number, career/work details, photographs.
•Medical information including medical history, medications, allergies, adverse events, immunizations, social history, family history, risk factors and other relevant details.
•Healthcare identifiers and health fund details.
•User login and subscription data, such as login credentials for phone and online site access.
•Information about your device or the software you use, such as its IP address, technical specification, and unique identifying data.
•Cookies and similar technologies we use to recognise you, remember your preferences and tailor the content we provide to you.
•Records of correspondence and other communications between us, including email, live chat, instant messages, and social media communications.
•Information from third parties where you purchase any of our products or services through such third parties.

Personal Data collected shall be adequate, relevant and limited to what is necessary in relation to the purpose for which the data will be processed, which majorly involves providing medical services to you.

5. When, Why and with Whom We Share Your Data

We share your personal information:

•With a health care provider who shall handle your case subject to the obligation of professional secrecy under law.
•With third parties who work with our practice for business purposes, such as pharmacies, laboratories or information technology providers.
•Via SMS or an Interactive Voice Phone call to obtain feedback on your experience in using our services.
•When it is required or authorised by law.
•When it is necessary to lessen or prevent a serious threat to a patient's life, health or safety or public health or safety, or it is impractical to obtain the patient's consent.
•When we need to do so in connection with regulatory reporting, litigation or asserting or defending legal rights and interests.
•When we have asked you for your permission to share it, and you have agreed.
•When we wish to send marketing information to you or others, as long as you have given us your consent, or it's within our legitimate interest to do so.

Only people who need to access your information will be able to do so. Other than while providing medical services or as otherwise described in this policy, our practice will not share personal information with any third party without your consent. We will not share your personal information with anyone outside Kenya unless the circumstances described in Section 7 apply.

6. How Long We Retain Your Data

Your personal data shall not be kept for longer periods than is necessary to achieve the purpose for which the data was collected and processed. HealthX Africa's data retention period is 25 years. If we don't need to retain information for this period of time, we may destroy, delete or anonymize it more promptly.

7. Where We Hold Your Data

At all times we will endeavour to hold your data on servers only within Kenya. Whenever your information is held by HealthX Africa or on its behalf, HealthX Africa shall take reasonable and appropriate administrative, physical and technical safeguards to keep your information safe and secure, which may include anonymization, encryption and other forms of security. Nevertheless, transmission via the internet is not completely secure and we cannot guarantee the security of information about you.

We may transfer data outside Kenya only in the following instances:

•For the performance of a contract between you and HealthX Africa or implementation of pre-contractual measures taken at your request.
•For the conclusion or performance of a contract concluded in your interest between HealthX Africa and another person.
•For any matter of public interest.
•For the establishment, exercise or defence of a legal claim.
•In order to protect your vital interests or those of other persons, where you are physically or legally incapable of giving consent.
•For the purpose of compelling legitimate interests pursued by HealthX Africa which are not overridden by your interests, rights and freedoms.

8. Your Acknowledgment of this Notice and Your Rights

Under the General Data Protection Regulation and the Kenya Data Protection Act 2019, you are entitled to the following rights:

Right to Be Informed

The General Data Protection Regulation sets out the information we must provide to you about your data. All the information we are required to give you is contained within this Privacy Notice. If you do not understand any part of this, please contact us and we will be happy to explain.

Right of Access

You have the right to access and obtain a copy of the personal data we hold about you. This will be provided free of charge (unless your request is unfounded, excessive, or repetitive) within 30 days of your request.

Right to Rectification

You have the right to request that we correct any inaccuracies in the personal data we hold about you. This will be corrected within 30 days.

Right to Erasure

You have the right to request erasure of your personal data where it is no longer necessary, where you withdraw consent, where it was unlawfully processed, or where erasure is required for legal compliance.

Right to Restrict Processing

You have the right to restrict our processing of your personal data in certain circumstances, such as when accuracy is contested or where processing is unlawful but you prefer restriction over erasure.

Right to Data Portability

You have the right to receive your personal data in a structured, commonly used, machine-readable format (such as CSV) within one month of your written request, where applicable.

Right to Object to Processing

In certain circumstances you have the right to object to our processing of your personal data, including for direct marketing or profiling purposes.

Right to Object to Automated Decision-Making

You have the right not to be subjected to decisions made solely by automated means without human involvement, except where necessary for a contract or where you have given explicit consent.

Right to Withdraw Consent

Where consent is the legal basis for processing, you may withdraw it at any time. Data processed before withdrawal remains valid. You may opt out of marketing messages at any time.

9. Your Responsibility

You are responsible for making sure the information you give us is accurate and up to date, and you must tell us if anything changes as soon as possible. If you provide information for another person (such as a beneficiary under an insurance policy or a dependant), it is your responsibility to direct them to this notice.

10. Updates to this Privacy Policy

We reserve the right to make updates and revisions to this Policy at our discretion and at any time. When we make changes, we will post the updated notice on our website and applications and update the Effective Date. Your continued use of our website and applications following the posting of changes constitutes your acceptance of such changes.

If you would like to exercise any of your rights above, please contact our Data Protection Officer at support@healthxafrica.com.

11. Virtual Clinics

Our Virtual Clinics are a revolutionary way to access healthcare services, installed in convenient locations such as organisations, schools, hospitals and hotels. These clinics may be standalone or managed by a nurse, providing a range of health services to meet your needs.

In a HealthX Africa Virtual Clinic, you can take critical vital signs and readings using our easy-to-use smart devices. These devices automatically sync with our 24/7 Digital Operation Centre, where our doctors, clinical psychologists, and clinical nutritionists continuously monitor your health in real time. For more personalised care, you can have a live video consultation with one of our licensed practitioners.

Our Virtual Clinics are designed to be as accessible and comfortable as possible, giving you peace of mind that high-quality healthcare is always within reach.