Privacy Policy

1. Who we are and scope of this Policy

Luton Medical Hospital Limited respects privacy and is committed to handling personal data lawfully, fairly, transparently and securely.

This Privacy Policy applies when you visit or use our website, submit an appointment request, contact us by telephone, email, WhatsApp or another available channel, receive or enquire about healthcare services, or otherwise interact with Luton Hospital.

This Policy should be read together with any more specific privacy notice provided when personal data is collected. A specific notice will supplement this Policy and take priority for the processing activity it describes.

2. Personal data and sensitive personal data

Personal data is information relating to an identified or identifiable person. Sensitive personal data includes information that Kenyan law gives additional protection, including health data and other legally protected categories.

Health information may reveal a person’s physical or mental health, medical history, symptoms, diagnosis, treatment, medication, disability, laboratory or imaging results, health-cover details or the fact that a person is seeking healthcare.

• Identity and contact information.
• Appointment and enquiry information.
• Health and medical information.
• Payment, insurance and cover information.
• Communications and documents.
• Website and device information.
• Information provided about another person where there is lawful authority.

3. How we collect personal data

We collect personal data in ways that are relevant to the hospital service, communication channel or interaction involved.

• Directly from you through online forms, telephone calls, email, WhatsApp, in-person interactions and documents you provide.
• From a parent, guardian or authorised representative acting for you.
• From healthcare professionals or organisations involved in your care, where lawful and necessary.
• From an insurer, SHA, employer or corporate-cover administrator where relevant to authorisation, billing or claims.
• From public authorities or other persons where disclosure is required or permitted by law.
• Automatically through the website where necessary technologies or lawfully enabled optional technologies are in use.

4. Why we process personal data

We process only the personal data reasonably required for a lawful and specified purpose.

• Responding to enquiries and appointment requests.
• Arranging, coordinating and providing healthcare or related services.
• Communicating about appointments, care, service availability, follow-up or administration.
• Verifying SHA, insurance, corporate-cover or payment information and administering billing or claims.
• Managing complaints, incidents, quality assurance, clinical governance, audit and service improvement.
• Operating, securing, maintaining and troubleshooting our website, communications and information systems.
• Complying with legal, regulatory, professional, public-health, reporting and recordkeeping duties.

5. Disclosure, retention and security

We may disclose the minimum personal data reasonably necessary to recipients who have a lawful need to receive it. We do not sell personal data.

We keep personal data only for as long as reasonably needed for the purpose for which it was collected and for applicable legal, clinical, professional, accounting, reporting, insurance, claims or dispute-resolution requirements.

We apply technical, organisational and physical safeguards appropriate to the nature of the data, the processing and the risks involved.

6. Your data-protection rights

Subject to applicable conditions, exemptions and verification requirements, you may have data-protection rights under applicable law.

• Be informed about how personal data is used.
• Request access to personal data held about you and receive a copy.
• Request correction of inaccurate or incomplete personal data.
• Request erasure where there is a lawful basis for deletion.
• Request restriction of processing in qualifying circumstances.
• Object to processing based on particular grounds, including direct marketing.
• Request data portability where the legal requirements are met.
• Withdraw consent for future processing that depends on consent.

7. Contact and complaints

For questions, requests or complaints about this Policy or our handling of personal data, contact the Privacy and Data Protection Contact at info@lutonhospital.co.ke or write to Luton Medical Hospital Limited, P.O. Box 34444–00100, China Centre, Ngong Road, Nairobi, Kenya.

Please contact us first if you have a privacy concern so that we can investigate and respond. You may also have the right to lodge a complaint with the Office of the Data Protection Commissioner of Kenya.