Privacy & Cookie Policy

Effective date: 1 January 2026  ·  Last updated: 10 July 2026

1. Introduction

St. Vincent de Paul Mission Hospital ("we", "us", "our", "the Hospital"), located at Muhoroni, Kisumu County, Kenya, respects your privacy and is committed to protecting your personal data. This Privacy Policy explains how we collect, use, share and safeguard personal data in compliance with the Kenya Data Protection Act, 2019 (No. 24 of 2019) and its regulations, and other applicable laws.

2. Who We Are (Data Controller)

Data Controller: St. Vincent de Paul Mission Hospital
P.O. Box 542-40107, Muhoroni, Kisumu County, Kenya.
Email: stvincentdepaulhealthcentre@gmail.com · Tel: +254 714 767 237 / +254 737 463 139.

3. Personal Data We Collect

• Identity data: full name, date of birth, gender, national ID / passport number.
• Contact data: phone number, email, postal and physical address, next of kin.
• Health data (sensitive): medical history, diagnoses, laboratory and imaging results, treatment records, prescriptions, HIV/VCT records, maternity records.
• Insurance & billing data: SHA number, insurance scheme, payment records.
• Digital data: IP address, browser type, pages viewed, cookies (see Cookie Policy below), form submissions on this website.

4. How We Collect Your Data

We collect personal data directly from you during registration, consultations, admission or when you fill any online form; from authorised representatives (parents, guardians, next of kin); from referring facilities; from insurance and government bodies (e.g. SHA, MOH); and automatically through cookies when you use this website.

5. Lawful Basis & Purposes of Processing

We process personal data only where a lawful basis under Section 30 of the Data Protection Act, 2019 applies, including:

• Consent — for elective care, marketing, cookies and other optional processing.
• Provision of medical treatment — including diagnosis, prescription, follow-up and referrals.
• Compliance with legal obligation — statutory reporting to MOH, KEMSA, SHA, notifiable diseases surveillance, etc.
• Vital interests — emergency care where consent cannot be obtained.
• Legitimate interests — hospital administration, quality improvement, fraud prevention, IT security.

6. Your Rights as a Data Subject

Under Part IV of the Data Protection Act, 2019, you have the right to:

• Be informed of the use of your personal data;
• Access your personal data held by us;
• Object to processing of all or part of your personal data;
• Correction of false or misleading data;
• Deletion of false, misleading or unlawfully-obtained data;
• Data portability where technically feasible;
• Withdraw consent at any time (without affecting the lawfulness of prior processing).

To exercise any right, contact our Data Protection Officer at stvincentdepaulhealthcentre@gmail.com. We will respond within 30 days.

7. Sharing Your Data

We share personal data only when necessary, with parties bound by confidentiality obligations, including: attending clinicians and staff; referral facilities; the Ministry of Health, SHA and other regulators as required by law; insurance partners (AON/MINET, Madison, Kenindia, Tuishi); IT service providers; and law enforcement where legally compelled. We do not sell personal data.

8. Cross-Border Transfers

Where we transfer personal data outside Kenya (e.g. cloud services), we do so only if the recipient jurisdiction offers adequate protection, or on the basis of appropriate safeguards and your consent, as required by Sections 48–50 of the Data Protection Act.

9. Data Retention

Medical records are retained for a minimum of ten (10) years from the last patient encounter, in line with Ministry of Health guidelines. Other personal data is retained only for as long as necessary for the purpose collected. Website cookie consent is retained for up to 12 months.

10. Data Security

We apply appropriate technical and organizational measures — access controls, staff confidentiality obligations, secure physical storage, encryption for electronic data — to protect your personal data from unauthorized access, loss, alteration or disclosure.

11. Children's Data

Where a patient is under 18, we process personal data with the consent of a parent or legal guardian, in line with Section 33 of the Act.

12. Complaints

If you believe we have violated your data rights, you may lodge a complaint with our Data Protection Officer, or with the Office of the Data Protection Commissioner (ODPC), Kenya at www.odpc.go.ke.

13. Cookie Policy

This website uses cookies — small text files stored on your device — to help the site function, remember your preferences and analyze traffic. In line with the Data Protection (General) Regulations, 2021, we ask for your consent before setting non-essential cookies.

Categories of cookies we use

• Strictly necessary cookies — required for the site to work (e.g. remembering your cookie preference). These do not require consent.
• Preference cookies — remember choices like language or last-viewed page.
• Analytics cookies — help us understand how visitors use the site (aggregated, non-identifying).

Managing your consent

When you first visit, our cookie banner lets you Accept all or Reject non-essential cookies. You can change your choice at any time by clearing your browser storage for this site, or by clicking the button below:

Reset cookie preferences

14. Changes to This Policy

We may update this Privacy Policy from time to time. The "Last updated" date at the top reflects the latest revision. Significant changes will be communicated on this page.

15. Contact

For any questions about this policy or how we handle your data, contact:
Data Protection Officer
St. Vincent de Paul Mission Hospital
P.O. Box 542-40107, Muhoroni, Kisumu County
Email: stvincentdepaulhealthcentre@gmail.com