MEDITEST DIAGNOSTIC SERVICES LTD

Privacy statement

Our commitment to safeguarding personal information and upholding privacy is paramount. This statement, aligned with the Data Protection Act (DPA) of 2019, serves to clarify how we collect, process, utilize, and securely maintain personal data. We respect your privacy and are committed to protecting your personal information that is collected or disclosed to us. Since we want to empower you to make the best decisions about your privacy and personal data, we have made this Privacy Policy as clear and as transparent as possible to ensure that you understand your rights under the law.

It is important that you read this Privacy Policy carefully in conjunction with any other related privacy policy we may provide on specific occasions when we collect or process personal data about you, so that you are fully aware of how and why we are using your data.

1. Types of Personal Data we Collected

The personal data Meditest Diagnostic Services collect vary according to the circumstances surrounding our relationship with you. We may collect, use, store, transfer or otherwise process various types of personal data about you or persons close to you. We have categorized the personal data, as follows

1. Identification Information: We might request government-issued identification documents like passports, driver’s licenses or Identification Cards.
2. Contact Information: They include details as names, physical address, phone number, and email address.
3. Financial Information: Including bank account particulars, mobile number details
4. medical Information: Details concerning medical insurance coverage, including coverage specifics, might be required for medication procedures and processing.
5. Usage Information: Data concerning interactions with our website or mobile applications may be logged for analysis.
6. Authorized partners; these are information shared from our partners, local and International.
7. Next of kin data; there Names, location, residence and phone number. Gender etc

The highlights above are non-exhaustive. They reflect varied nature of personal information we may collect. If we require information about other people connected to you, we may request you to provide such information about those people. If you provide information about another person, we expect you to ensure that they are aware of your actions and consent to the disclosure of their information to us. It might be helpful to show them this Privacy Policy and encourage them to contact us if they have any concerns.

 

2. Denial to provide needed Services as requested

In the event you don’t provide us with the requested personal data needed to meet our obligations, we may not be able to provide you with the services you require. In some instances, we may be forced to cancel a medical service or contract you currently have with us but we will notify you if this is the case at that time.

 

3. How We Collect Your Personal Information

We may collect or receive your personal data in a number of different ways; where you provide the personal data directly to us, for example

1. When you correspond with us by phone or email or on prem visit to our Hospitals.
2. When you make an application or use any of our services or from third parties on our electronic and digital platforms
3. When you ask us for more information about a service or contact us with a query or a complaint
4. When you visit, access or use any of our online platforms
5. When you enter into a business contract with us
6. When you visit or access our premises
7. Where you have applied for employment at Meditest Diagnostic Services Ltd
8. Where you have been identified as a next of kin by our member or employee
9. By authorized business partners/data processors.

 

We may also collect your personal information from other sources i.e. organizations such as government agencies and business directories under the following circumstances.

1. When we require your personal information in order to fulfill a statutory or contractual requirement, where such information is necessary to enter into a contract or is otherwise an obligation.
2. Where we receive the personal data from our employee or service providers.
3. From third parties, such as people who work on our behalf, whether as a paid consultant.
4. From publicly available sources including but not limited to internet search engines, public records and registers, and social media accounts (e.g. Facebook, LinkedIn, and Twitter).

Generally, you have no obligation to provide us with your personal data, but if you do not provide us with the information we need, we may be unable to assist and provide you with any services you may require. We shall minimize the amount of information we collect from you, to only that which is needed to perform the relevant function at a time.

4. How We Use Your Personal Information

This privacy policy aims to give you a complete and transparent information on how we process your personal data. We are committed to ensuring that your personal data is processed in a way that is compatible with the specified, explicit and legitimate purpose of collection. We process your personal data in accordance with the Data Protection Act.

Where the personal data relates to a child, we will process the data only where parental or legal guardian consent has been given. The processing of such data will be done in a manner that protects and advances the rights and best interests of the child.

We will only process your personal data under the following circumstances.

1. Provision of Medical Prescription Services: This involves processing of medical prescriptions and issuance of medical advice.
2. Claims Processing: Data is utilized to evaluate and process payments from medical insurance provider.
3. Customer Support: We employ information to deliver assistance and support concerning medical prescriptions.
4. Marketing: Information regarding our latest pharmaceutical products may be shared with you, subject to explicit consent.
5. Compliance: Data is used to ensure adherence to legal and regulatory obligations.

Please note that we will use your personal data solely for the purposes for which it was acquired, unless we need to use it for another purpose and that purpose is compatible with the original purpose. If we need to use your personal information for an unrelated purpose, we will seek fresh consent from you.

 

5. Data Sharing

Personal data may be disclosed to third parties such as insurances, service providers, and regulatory bodies, as mandated by law. We shall assess and review each request for information and may decline to share your sensitive data with the requesting 3^rd party if it may lead to violation of your rights.

In all the cases cited above, we require all parties we share your personal data with to respect the security of your personal data and treat it in accordance with the law. Please note that we do not allow our external service providers to use your personal data for their own purposes and only permit them to process your personal data for specified purposes and in accordance with our instructions.

 

6. Data Transfers

Your data is primarily stored in our data center located within Kenya and outside the Country on a secure Cloud platform. We have ensured cross border transfers process adhere to the laid down regulation. The data both at rest and on transit is encrypted.

 

7. Data Subject Legal Rights

Subject to legal and contractual exceptions, you have rights under data protection laws in relation to your personal data. You have the right;

1. To be informed when we are collecting your personal data and the purpose for which we are collecting your personal data

You have the right to be informed about the collection and use of your personal data. This entails us providing you with information regarding the nature, scope, purpose of processing, the retention period and the person we will share your personal data with.

1. To request access to your personal data that we have on record

You are entitled to a confirmation whether we are processing your personal data and to obtain information on and a copy of the personal data.

1. To object to and withdraw your consent to processing of your personal data

This right entitles you to request us to stop processing your personal data. The withdrawal of your consent shall not affect the lawfulness of the processing based on prior consent before its withdrawal. We may also continue to process your personal data if we have legitimate or legal reasons to do so. You can object to how we process your personal data or you can restrict how your personal data is processed in certain cases, such as when the accuracy of your personal data is contested and you require us to verify the accuracy of the personal data.

1. Request for your personal data to be transferred to another data controller or data processor: This right entitles you to receive your personal data that you have provided to us in a machine-readable format.
2. Accurate update; If you believe the personal data we hold about you is false, inaccurate, misleading, or incomplete, you can request us to amend it.
3. Request that we erase your personal data

This right entitles you to request the deletion of your personal data that we have from our database. Please note that this right will be balanced against other factors such as our legal and regulatory obligations, which means we may not always comply with your request.

1. Restrict the processing of your personal data

This right entitles you to request that we only process personal data in limited circumstances, including with your consent.

1. You have the right to lodge a complaint with the Office of the Data Protection Commissioner

To exercise these rights, kindly contact our Data Protection Officer via the email address: info@meditestdiagnostic.com.

In exercising your rights as listed above, we may request specific information from you to help us confirm your identity.

Kindly note that you will not be required to pay a fee to exercise any of your rights. However, we reserve the right to impose a reasonable fee where your request is clearly unfounded or excessive.

We will respond to your request without undue delay and no later than the 7 days from the date of receiving the request.

8. Data Security & Integrity

We have put in place appropriate security measures to prevent your personal data from being accidentally lost, used or accessed in an unauthorized way. We store your personal data on secure Servers both on premise and cloud.

They only process your personal data on our instructions and they are subject to a duty of confidentiality. We have put in place procedures to deal with any suspected personal data breach and we will notify you and the data protection regulator of a breach where we are legally required to do so.

9. The Retention & Storage of Your Personal Data

We will only retain your personal data for as long as may be reasonably necessary to fulfil the purpose for which it was collected, including to comply with any legal, regulatory, tax, accounting or reporting information requirements as per section 39

10. Contact Us and Further Information

Should you have any questions in relation to your personal data and how we protect your data rights, please contact us at: Our email address for data protection queries is info@meditestdiagnostic.com

It is important that you check this Privacy Policy frequently for updates, as we may make changes from time to time. The “Date last updated” section at the bottom of this page indicates when this Privacy Policy was last updated and any changes take effect upon our publishing of the revised Privacy Policy.

We will, however, notify you if these changes are material and, where required by applicable law, we will obtain your consent. We will notify you of these changes by email or by posting a notice of the changes on our website.

 

Last Updated: 29^th September 2026