Privacy Policy

Owner: HealthNaro Contact: info@healthnaro.com

1. Who we are

HealthNaro operates healthnaro.com, a directory of healthcare clinics and practitioners, and a free consulting service that helps people find a suitable clinic. HealthNaro is the data controller for the personal information described in this policy. HealthNaro is not a healthcare provider and does not provide medical care.

Legal name: Registration number: Data protection contact: info@healthnaro.com (messages to privacy@healthnaro.com reach the same team).

This policy is written to meet the Kenya Data Protection Act, 2019 and, for visitors in Iceland and other countries of the European Economic Area, the General Data Protection Regulation (GDPR). Where the two differ, we apply the rule that gives you more protection.

2. What we collect and why

Lead form ("Help me find a clinic")

When you ask us to help you find a clinic we collect your name, a phone number or email address, whether you prefer to be contacted by WhatsApp, phone, SMS or email, your city, the type of clinic you are looking for (for example dental) and a short message. We also record the page you sent the form from, a reference code, the exact consent wording you agreed to and the time.

We use this to contact you, understand what you need and suggest suitable clinics. We ask you not to include medical records, identity numbers or detailed medical history. The type of clinic you ask about may say something about your health. We process it only with your explicit consent, keep it to the minimum, and do not use it for anything else.

Inquiries sent to a provider

When you send an inquiry to a listed clinic or practitioner we collect the same details and pass them to that provider only, with your consent. We record what was shared, when and with whom.

Provider accounts and claims

Name, email address, password (stored as a one-way hash), role at the practice, business contact details and any documents you choose to submit to verify a claim or credentials.

Contact, report and privacy request forms

The details you enter, including the provider you are reporting and your reason.

Technical information

IP address stored as a one-way hash for security and rate limiting, browser type, the pages you visit and the time. This is used to keep the site working, to detect abuse and to understand which pages are used. It is not linked to your lead or inquiry.

Analytics (only with your consent)

If you accept analytics cookies in the cookie banner we use Google Analytics 4 to count page views, form views and form submissions per page. Analytics never receives your name, contact details, message or any other information you type into a form. If you decline, no analytics is loaded. See the Cookie Policy.

Marketing (only if you opt in)

If you tick the separate marketing box we send occasional emails about new providers and health guides. You can unsubscribe from every email or by writing to us.

3. Lawful basis

• Lead form and inquiries: your consent, which you may withdraw at any time. Withdrawal does not affect what was done lawfully before.
• Provider accounts: performance of our agreement with you under the Terms of Service and the Listing and Provider Policy.
• Security, fraud prevention, audit records: our legitimate interest in running a safe service and our legal obligations.
• Analytics and marketing: your consent.

We do not make decisions about you by automated means and we do not profile you.

4. Who we share information with

• The clinic or practitioner you chose, or that you later approved after we suggested it, so that they can respond to you. We record each share.
• Service providers that host the site, store files and deliver email, under contracts that limit what they may do with the data.
• Authorities when the law requires it.

We never sell personal information. We never show your details on a public page. Clinics do not see other clients' details.

Transfers outside Kenya and the EEA

5. How long we keep information

Full detail is in the Data Retention and Deletion Policy. In short:

• Lead and inquiry records are anonymised one year after they are closed, unless a legal hold applies. The referral and consent history is kept without identifiers.
• Contact form messages are deleted after one year.
• Provider account data is kept while the account is active and deleted or anonymised after it is closed, subject to legal retention duties.
• Security and audit records are kept for up to five years.
• Expired login sessions are purged within 30 days; expired one-time tokens are purged when they expire.

6. Your rights

Under the Kenya Data Protection Act (section 26) you have the right to be told how your data is used, to access it, to object to processing, and to have false or misleading data corrected or deleted. Under the GDPR (Articles 15 to 22) you also have rights to restriction, to data portability and not to be subject to automated decisions. In both cases you can withdraw consent at any time, as easily as you gave it.

How to exercise them

Use the privacy request form or email info@healthnaro.com with the address you gave us and, if you have it, your reference code (HN-XXXXXX). We may need to confirm it is you; we will not ask for identity documents unless there is no other way. Requests are free. We respond without undue delay and within one month, as the GDPR requires; if a request is complex we tell you within the month why we need longer.

Complaints

You can complain to us first at info@healthnaro.com. You can also complain to a supervisory authority:

• Kenya:
• Iceland:
• Other EEA countries: the supervisory authority in your country of residence.

7. Security

Passwords are hashed, access to lead and inquiry data is restricted to staff who need it and every access is logged, forms are protected against cross-site request forgery and automated abuse, uploaded documents are stored outside the public web root, and data is sent over encrypted connections. No system is perfectly secure; if a breach affects you we will tell you and the regulator as the law requires.

8. Children

HealthNaro is for adults. We do not knowingly collect information from anyone under 18. A parent or guardian may contact a clinic on a child's behalf; the adult's details are the ones we collect.

9. Changes

We post changes on this page. If a change affects how we use information you have already given us, we will ask for your consent again where the law requires it.

See also: Cookie Policy, Data Retention and Deletion Policy, Terms of Service.