1. Introduction
Novalee Skin Tech Clinic (“Novalee”, “we”, “our”, or “us”), is committed to protecting the privacy, confidentiality, integrity, and security of all personal information entrusted to us.
As a healthcare and aesthetic medicine provider, we collect and process personal information, including sensitive personal data, to deliver safe, effective, and professional healthcare services.
This Privacy Policy explains how we collect, use, disclose, store, protect, and retain personal information when you:
- Visit our website;
- Book an appointment;
- Attend consultations or receive treatment;
- Purchase products or services;
- Contact us by telephone, WhatsApp, email, or social media;
- Participate in promotions or events;
- Apply for employment; or
- Otherwise interact with Novalee Skin Tech Clinic.
We process personal information in accordance with:
- The Constitution of Kenya;
- The Data Protection Act, 2019;
- The Data Protection (General) Regulations, 2021;
- The Data Protection (Registration of Data Controllers and Data Processors) Regulations, 2021;
- The Health Act, 2017;
- The Computer Misuse and Cybercrimes Act, 2018; and
- Any other applicable laws and regulations.
2. Scope
This Privacy Policy applies to:
- Patients
- Prospective patients
- Website visitors
- Customers purchasing skincare products
- Suppliers and contractors
- Employees
- Job applicants
- Business partners
- Any individual whose personal information is processed by Novalee Skin Tech Clinic.
3. Definitions
For the purposes of this Policy:
Personal Data means any information relating to an identified or identifiable natural person.
Sensitive Personal Data includes health information, biometric information, medical records, clinical photographs, genetic information, and any other category protected under Kenyan law.
Processing means collecting, recording, storing, using, sharing, updating, deleting, or otherwise handling personal data.
Data Subject means the individual to whom the personal data relates.
4. Personal Information We Collect
Depending on the services you receive, we may collect the following information.
4.1 Identification Information
- Full name
- National ID or Passport Number
- Date of Birth
- Gender
- Nationality
- Residential Address
4.2 Contact Information
- Mobile phone number
- Alternative phone number
- Email address
- Postal address
- Emergency contact information
4.3 Medical Information
- Medical history
- Previous treatments
- Surgical history
- Current medications
- Allergies
- Skin assessments
- Consultation notes
- Clinical observations
- Laboratory reports
- Treatment records
- Follow-up notes
4.4 Clinical Images
With your consent, we may collect:
- Before-treatment photographs
- After-treatment photographs
- Progress photographs
- Facial assessment images
- Body assessment images
- Videos documenting treatment progress
These images form part of your confidential medical record.
Clinical photographs will never be used for marketing or promotional purposes without your separate written consent.
4.5 Financial Information
- Payment records
- M-Pesa transaction information
- Bank transfer details
- Card payment confirmations
- Invoices
- Receipts
Novalee does not store complete payment card information.
4.6 Website Information
When you visit our website, we may automatically collect:
- IP address
- Browser type
- Operating system
- Device information
- Pages visited
- Referral source
- Cookies
- Website usage statistics
5. How We Collect Your Information
We collect information directly from you when you:
- Complete consultation forms;
- Book appointments;
- Complete medical questionnaires;
- Sign consent forms;
- Purchase products or services;
- Contact us by phone, WhatsApp, email, or social media;
- Subscribe to newsletters;
- Apply for employment.
We may also receive information from:
- Referring healthcare professionals;
- Laboratories;
- Insurance providers;
- Lawfully authorised representatives; or
- Public authorities where required by law.
6. Why We Process Your Information
Your personal information is processed for legitimate healthcare and business purposes including:
- Patient identification;
- Medical assessment;
- Treatment planning;
- Delivery of healthcare services;
- Appointment scheduling;
- Clinical follow-up;
- Customer support;
- Processing payments;
- Managing patient records;
- Improving healthcare services;
- Regulatory compliance;
- Fraud prevention;
- Security monitoring;
- Website administration.
7. Legal Basis for Processing
We process personal information where:
- You have given consent;
- Processing is necessary for the provision of healthcare;
- Processing is required to comply with legal obligations;
- Processing protects your vital interests;
- Processing is necessary for our legitimate business interests and does not override your rights.
8. Sharing Personal Information
We do not sell your personal information.
Your information may be shared only where necessary with:
- Healthcare professionals involved in your care;
- Medical laboratories;
- Pharmacies;
- Payment service providers;
- IT service providers;
- Website hosting providers;
- Professional advisers;
- Government regulators;
- Law enforcement agencies where legally required.
Every third party receiving personal information is expected to maintain appropriate confidentiality and security standards.
9. Cookies and Website Technologies
Our website uses cookies and similar technologies to:
- Improve website functionality;
- Remember user preferences;
- Enhance website security;
- Analyse website traffic;
- Improve user experience.
You may disable cookies through your browser settings, although some website functions may not operate correctly.
10. Protection of Personal Information
Novalee implements appropriate technical, organisational, and physical safeguards to protect personal information against accidental or unlawful destruction, loss, alteration, unauthorised disclosure, or access.
These measures include:
- SSL encryption for website communications;
- Firewalls protecting network infrastructure;
- Anti-malware and antivirus software;
- Strong password controls;
- Multi-factor authentication where applicable;
- Role-based access controls;
- Secure cloud storage;
- Encrypted backups;
- Audit logging;
- Regular software updates;
- Staff confidentiality obligations;
- Controlled access to patient records.
No security system is completely immune from risk. We continually review and improve our security measures to reduce potential threats.
11. Data Retention
Personal information is retained only for as long as necessary to fulfil the purposes for which it was collected or as required by law.
Medical records, financial records, consent forms, and related documentation are retained in accordance with applicable legal, medical, and regulatory requirements.
Once retention periods expire, information is securely destroyed or permanently anonymised.
12. Your Rights
Subject to applicable law, you have the right to:
- Access your personal information;
- Request correction of inaccurate information;
- Request deletion where legally permissible;
- Withdraw consent where consent is the legal basis for processing;
- Object to certain processing activities;
- Request restriction of processing;
- Request information regarding how your data is processed;
- Lodge a complaint with the Office of the Data Protection Commissioner (ODPC).
13. International Transfers
Where personal information is processed or stored outside Kenya through secure cloud service providers or technology partners, Novalee will ensure that appropriate safeguards are implemented in accordance with applicable data protection laws.
14. Children's Privacy
Where treatment involves minors, personal information will be collected and processed with the consent of a parent or legal guardian, except where otherwise permitted by law.
15. Changes to this Privacy Policy
We may update this Privacy Policy from time to time to reflect changes in legal requirements, technology, or our business operations.
The latest version will always be available on our website and at the clinic.
16. Contact Us
If you have questions regarding this Privacy Policy or how your personal information is processed, please contact:
Novalee Skin Tech Clinic
Email: info@novaleeskintechclinic.com
Phone: +254 712 859 410
17. Complaints
If you believe your personal information has been processed unlawfully or your rights have been infringed, you may first contact Novalee Skin Tech Clinic so that we may attempt to resolve your concern.
If you remain dissatisfied, you have the right to lodge a complaint with the Office of the Data Protection Commissioner (ODPC) in accordance with the Data Protection Act, 2019.
