Privacy Policy

Orthocraft Hospital Limited (“Orthocraft,” “we,” “us,” or “our”) is a specialist orthopaedic and surgical facility located in Eldoret, Kenya. We take the privacy of our patients, visitors, staff, and business partners seriously, and we are committed to handling personal data responsibly and in line with Kenya’s Data Protection Act, 2019 and its accompanying regulations.

This Policy explains what personal data we collect, why we collect it, how we use and protect it, and what rights you have over it. It applies to anyone who interacts with us — patients, their families or guardians, website visitors, job applicants, suppliers, and members of the public.

If you have questions about this Policy, you can reach us using the contact details in Section 11.

Orthocraft Hospital Limited is a Level 4B specialist orthopaedic and surgical hospital based at Serani Mall, 2nd Floor, Old Plateau Road, Eldoret, Kenya. For the purposes of the Data Protection Act, we act as a data controller for the personal data we collect directly, and in some cases as a data processor when handling data on behalf of another party (for example, an insurer or referring facility).

Depending on your relationship with us, we may collect:

a)

Identity and contact information — such as your name, date of birth, gender, national ID or passport number, phone number, email address, and physical address.

b)

Health information — including medical history, symptoms, diagnoses, imaging and lab results, treatment plans, medication records, and other clinical notes needed to provide safe and effective care.

c)

Next of kin and emergency contact details — for use in urgent situations.

d)

Payment and insurance information — such as billing details, insurance scheme membership (including SHA), and payment records.

e)

Communications — records of calls, emails, WhatsApp messages, or other correspondence you have with us, including appointment requests and follow-ups.

f)

Website and digital interaction data — such as IP address, browser type, and pages visited, if you use our website or online booking tools.

g)

Employment and supplier data — for job applicants, staff, and contracted suppliers, including CVs, qualifications, and contract details, where relevant.

We only collect what we reasonably need for the purpose in question, and we do not collect sensitive information beyond what is necessary for your care or our legal obligations.

We may collect personal data:

• Directly from you — when you book an appointment, register at reception, fill in a form, or contact us by phone, email, or WhatsApp.
• From referring doctors, other healthcare providers, or your insurer, with appropriate authorisation.
• Automatically, if you use our website (e.g., through standard technical logs).
• From next of kin or guardians, where you are unable to provide information yourself.

We process personal data for purposes including:

• Providing diagnosis, treatment, and ongoing clinical care.
• Scheduling and managing appointments and surgical procedures.
• Billing, insurance claims, and SHA empanelment processes.
• Communicating with you about your care, including reminders and follow-up.
• Maintaining accurate medical records as required by law and professional regulation.
• Complying with reporting obligations to regulatory bodies (e.g., KMPDC, PPB, NCK, KMLTTB, SHA).
• Improving our services, including basic website and operational analytics.
• Recruitment and management of staff and supplier relationships.

We rely on one or more of the following grounds, consistent with the Data Protection Act, 2019:

• Your consent, particularly for treatment and for any marketing communications.
• Performance of a contract, such as a service agreement with a supplier or insurer.
• Legal obligation, including regulatory reporting and record-keeping requirements for healthcare providers in Kenya.
• Vital interests, where processing is necessary to protect your life or health in an emergency.
• Legitimate interest, such as maintaining hospital security or improving our services, balanced against your rights.

We do not sell personal data. We may share it, only where necessary, with:

• Other treating clinicians or facilities involved in your care (e.g., for referrals or second opinions).
• Insurers or SHA, for claims and billing purposes.
• Laboratories and imaging partners for diagnostic services.
• Regulatory or government authorities, where required by law.
• IT and service providers who support our systems (e.g., our hospital management system or website host), under confidentiality obligations.

Any third party we work with is expected to protect your data to a standard consistent with this Policy and Kenyan law.

If you contact us through WhatsApp — including through the enquiry form on our website, which opens WhatsApp with your message pre-filled — your message and phone number are transmitted through WhatsApp, a service operated by Meta Platforms, Inc., and are handled under WhatsApp's own privacy policy in addition to ours. Nothing is sent to WhatsApp until you press send in the app. Please share only the details needed to arrange your visit; our team can take full medical details by phone or in person at the clinic.

We store patient records in our hospital management system and, where applicable, in secure physical files. We apply reasonable technical and organisational safeguards — such as restricted system access, staff confidentiality obligations, and secure hosting — to protect your data against loss, misuse, or unauthorised access.

We retain medical records for the period required by Kenyan health regulations and professional guidelines, and other personal data only for as long as necessary to fulfil the purpose it was collected for, or as required by law.

Under the Data Protection Act, 2019, you have the right to:

To exercise any of these rights, please contact us using the details below. Where a request is made on behalf of a minor or a patient unable to act for themselves, we may ask for proof of authority to act on their behalf.

If you have questions, concerns, or requests regarding this Policy or your personal data, please contact:

We may update this Policy from time to time to reflect changes in our practices or legal requirements. The latest version will always be available on our website, with the “last updated” date shown above.