1. Introduction
Novalee Skin Tech Clinic (“Novalee”, “we”, “our”, or “us”), is committed to protecting the privacy, confidentiality, integrity, and availability of all personal data entrusted to us.
As a healthcare and aesthetic medicine provider, Novalee processes personal information and sensitive personal data relating to patients, employees, suppliers, contractors, and other individuals in the course of delivering healthcare and business services.
This Data Protection Policy establishes the organisational framework governing the collection, processing, storage, sharing, retention, protection, and disposal of personal data handled by Novalee Skin Tech Clinic.
The Policy demonstrates Novalee’s commitment to complying with the requirements of the Data Protection Act, 2019 and promoting a culture of accountability, transparency, confidentiality, and responsible information management throughout the organisation.
2. Purpose
The purpose of this Policy is to:
- Protect the privacy and rights of individuals whose personal information is processed by Novalee.
- Ensure compliance with applicable Kenyan data protection legislation.
- Establish clear responsibilities for employees and authorised personnel.
- Protect sensitive medical information against unauthorised access, disclosure, alteration, or destruction.
- Reduce the risk of data breaches and cybersecurity incidents.
- Promote secure handling of patient information throughout its lifecycle.
- Build patient confidence in the clinic’s commitment to safeguarding personal information.
3. Scope
This Policy applies to all personal information processed by Novalee Skin Tech Clinic regardless of format, including paper records, electronic records, emails, photographs, video recordings, cloud storage systems, portable storage devices, and any other medium used to store or process information.
This Policy applies to:
- Directors
- Medical practitioners
- Nurses
- Reception staff
- Administrative personnel
- Finance personnel
- Marketing personnel
- Consultants
- Contractors
- Temporary staff
- Interns
- Third-party service providers processing information on behalf of Novalee
Every individual who has access to personal information is required to comply with this Policy.
.
4. Legal and Regulatory Framework
This Policy is developed in accordance with:
- The Constitution of Kenya
- The Data Protection Act, 2019
- The Data Protection (General) Regulations, 2021
- The Data Protection (Registration of Data Controllers and Data Processors) Regulations, 2021
- The Health Act, 2017
- The Computer Misuse and Cybercrimes Act, 2018
- Any other applicable legislation, regulations, guidelines, or standards issued by the Office of the Data Protection Commissioner (ODPC).
5. Definitions
For the purposes of this Policy:
Personal Data means any information relating to an identified or identifiable natural person.
Sensitive Personal Data includes health records, medical history, consultation notes, treatment information, biometric information, clinical photographs, laboratory reports, and any other category recognised under the Data Protection Act, 2019.
Processing means any operation performed on personal data, including collecting, recording, organising, storing, retrieving, consulting, using, sharing, updating, archiving, deleting, or destroying information.
Data Subject means the individual whose personal data is processed.
Data Controller means the organisation that determines the purpose and means of processing personal information. For purposes of this Policy, Cloudless Medical Limited is the Data Controller.
Data Processor means any person or organisation that processes personal information on behalf of Novalee.
6. Data Protection Principles
Novalee processes personal information in accordance with the following principles.
6.1 Lawfulness, Fairness and Transparency
Personal information shall only be collected and processed where there is a lawful basis for doing so. Individuals shall be informed about how their information is collected, used, stored, and shared through appropriate privacy notices.
6.2 Purpose Limitation
Personal information shall only be collected for specified, explicit, and legitimate purposes.
Information collected for medical treatment shall not be used for unrelated purposes unless authorised by law or with the individual’s consent.
6.3 Data Minimisation
Only personal information that is adequate, relevant, and necessary for the intended purpose shall be collected.
Employees shall avoid collecting excessive or unnecessary personal information.
6.4 Accuracy
Reasonable steps shall be taken to ensure that personal information remains accurate, complete, and up to date.
Patients may request correction of inaccurate information at any time.
6.5 Storage Limitation
Personal information shall only be retained for as long as necessary to fulfil the purposes for which it was collected or as required by applicable laws and professional obligations.
6.6 Integrity and Confidentiality
Appropriate technical and organisational safeguards shall be implemented to protect personal information from accidental loss, destruction, unauthorised disclosure, alteration, or access.
6.7 Accountability
Novalee accepts responsibility for ensuring compliance with this Policy and maintaining appropriate governance structures to demonstrate compliance with data protection legislation.
7. Categories of Personal Information Processed
Novalee may process the following categories of personal information.
Patient Information
- Full name
- National Identification Number or Passport Number
- Date of birth
- Gender
- Contact details
- Medical history
- Consultation records
- Treatment plans
- Surgical records
- Clinical photographs
- Laboratory reports
- Consent forms
- Payment information
Employee Information
- Employment records
- Payroll information
- National identification documents
- Training records
- Performance records
Supplier Information
- Business contact information
- Contracts
- Banking information
- Tax information
Website Information
- IP addresses
- Cookies
- Website usage statistics
- Device information
- Online enquiry forms
8. Lawful Basis for Processing
Novalee processes personal information where one or more of the following legal bases applies:
- The individual has provided informed consent.
- Processing is necessary for the provision of healthcare services.
- Processing is necessary to comply with legal obligations.
- Processing is necessary to protect the vital interests of an individual.
- Processing is necessary for the performance of a contract.
- Processing is necessary for the legitimate interests of the clinic, provided such interests do not override the rights and freedoms of the individual.
9. Roles and Responsibilities
The management of Novalee Skin Tech Clinic is responsible for ensuring that appropriate resources, systems, and controls are available to support compliance with this Policy.
Managers are responsible for ensuring that employees understand and comply with data protection requirements relevant to their duties.
Employees are responsible for protecting personal information, maintaining confidentiality, reporting suspected breaches promptly, and complying with all applicable policies and procedures.
Third-party service providers processing personal information on behalf of Novalee shall be required to maintain appropriate confidentiality, security, and data protection standards through contractual obligations.
10. Security of Personal Information
Novalee implements appropriate technical, organisational, and physical security measures designed to protect personal information throughout its lifecycle.
These measures include:
- Secure physical access controls.
- Locked filing cabinets for paper records.
- Visitor access controls.
- CCTV in designated areas where appropriate.
- SSL encryption for website communications.
- Firewall protection.
- Antivirus and anti-malware software.
- Strong password requirements.
- Multi-factor authentication where appropriate.
- Role-based system access.
- Device encryption.
- Secure cloud storage.
- Encrypted backups.
- Audit logging and monitoring.
- Regular software updates and security patching.
- Staff confidentiality agreements.
- Information security awareness training.
These controls are reviewed periodically to ensure continued effectiveness.
11. Sharing and Disclosure of Personal Information
Personal information shall only be disclosed where necessary and lawful.
Information may be shared with:
- Healthcare professionals involved in patient care.
- Medical laboratories.
- Pharmacies.
- Payment service providers.
- Information technology service providers.
- Website hosting providers.
- Professional advisers.
- Regulatory authorities.
- Law enforcement agencies where required by law.
Novalee does not sell personal information.
Where third parties process personal information on behalf of Novalee, appropriate contractual safeguards shall be implemented.
12. Retention and Disposal of Personal Information
Personal information shall be retained only for the period necessary to fulfil legal, regulatory, medical, contractual, and operational requirements.
When information is no longer required, it shall be securely destroyed or permanently anonymised using approved disposal methods to prevent unauthorised recovery.
Separate retention schedules may be established for different categories of information.
13. Rights of Data Subjects
Individuals whose personal information is processed by Novalee have the right to:
- Request access to their personal information.
- Request correction of inaccurate or incomplete information.
- Request deletion where permitted by law.
- Withdraw consent where consent is the legal basis for processing.
- Object to certain processing activities.
- Request restriction of processing.
- Receive information regarding how their personal data is processed.
- Lodge a complaint with the Office of the Data Protection Commissioner.
Requests shall be handled in accordance with applicable legal requirements.
14. Personal Data Breaches
Novalee maintains procedures for identifying, reporting, investigating, containing, documenting, and responding to actual or suspected personal data breaches.
Any employee who becomes aware of a suspected breach shall immediately report the matter to management.
Where required by law, the Office of the Data Protection Commissioner and affected individuals shall be notified within the applicable legal timeframes.
Lessons learned from incidents shall be incorporated into future security improvements.
15. Training and Awareness
Novalee recognises that effective data protection depends on informed and responsible employees.
All personnel shall receive appropriate training on:
- Data protection principles.
- Patient confidentiality.
- Information security.
- Password management.
- Cybersecurity awareness.
- Phishing prevention.
- Secure handling of patient information.
- Data breach reporting procedures.
Training shall be conducted during employee induction and refreshed periodically.
16. Monitoring, Review and Compliance
Compliance with this Policy shall be monitored through periodic reviews, security assessments, internal audits, and management oversight.
Where deficiencies are identified, corrective actions shall be implemented to strengthen compliance and reduce risk.
This Policy shall be reviewed annually or whenever significant changes occur in legislation, technology, business operations, or organisational structure.
17. Policy Violations
Failure to comply with this Policy may result in disciplinary action, suspension of system access, termination of employment or contractual relationships, legal proceedings, or any other action considered appropriate under applicable law.
18. Contact Information
Questions relating to this Policy or the processing of personal information may be directed to:
Email: info@novaleeskintechclinic.com
Phone: +254 712 859 410
