Privacy Policy
Last updated: 1 October 2026
Who we are
Mother Theresa Medical Centre (“MTMC”, “we”, “us”) is a healthcare facility located at Tigoi Shopping Centre, off the Kisumu–Kakamega Highway, Vihiga County, Kenya. We are the data controller for personal data collected through this website.
MTMC is registered with the Office of the Data Protection Commissioner (registration no. 21024; identification no. 130-065C-F8E1).
Contact our Data Protection Officer, Dr. Polycarp Musee Muchele, at dpo@mtmc.co.ke, on 0105 620 988, or through our contact form. Our postal address is P.O. Box 269 – 50300, Maragoli.
The law we follow
We process personal data in accordance with the Constitution of Kenya (Article 31 — right to privacy), the Data Protection Act, 2019, the Data Protection (General) Regulations, 2021, the Health Act, 2017 and professional confidentiality obligations.
What data we collect
| Source | Data | Purpose | Lawful basis |
|---|---|---|---|
| Appointment form | Name, phone, email (optional), service, preferred mode/date/time, SHA status, brief reason for visit | To contact you and arrange your appointment | Your consent; steps before providing care |
| Contact / consultancy forms | Name, organisation, phone, email, message | To answer your enquiry | Consent; legitimate interest |
| Feedback form | Type of feedback, department, message; name and phone if you choose | To improve our services and respond to complaints | Consent; legitimate interest |
| Job applications | CV, contact details, qualifications | Recruitment | Consent; steps before a contract |
| Website usage (only if you accept cookies) | Pages visited, device type, approximate location, referring site | To understand and improve the website | Consent |
| WhatsApp / phone | Whatever you choose to share | To respond to you | Consent |
Health data is sensitive personal data under the Act. We ask you not to share detailed medical information through website forms. Your clinical information is recorded only in our secure medical records when you receive care.
How we use and share your data
- We use your data only for the purposes above. We do not sell your data or use it for third-party marketing.
- We share data only with: MTMC staff who need it; our website host and IT service provider, under written data processing agreements; SMS/email providers used to send appointment messages; and authorities where the law requires it.
- If we send you health information or reminders by SMS or email, you can opt out at any time.
Where your data is stored
This website is hosted by our web hosting provider, and messages sent through our forms are delivered to MTMC by email. To block spam, our forms use Cloudflare Turnstile, which checks technical details about your browser on servers that may be located outside Kenya. Where data is transferred outside Kenya, we make sure appropriate safeguards are in place as required by Sections 48–50 of the Data Protection Act.
How long we keep it
| Data | Retention period |
|---|---|
| Appointment requests (appointments mailbox) | 90 days, then deleted. Records of care are kept in the medical record in line with Ministry of Health rules. |
| Enquiries and feedback | 12 months |
| Job applications (unsuccessful) | 6 months |
| Analytics data | 14 months |
How we protect it
Encrypted connections (HTTPS); website forms are not stored on the web server but delivered to a restricted mailbox with two-factor authentication; security updates and staff confidentiality training. If a breach is likely to put your rights at risk, we will notify the Data Protection Commissioner within 72 hours and inform you without undue delay.
Your rights
Under the Data Protection Act you have the right to: be informed how your data is used; access your data; ask us to correct or delete it; object to its use; withdraw consent at any time; and data portability. To use these rights, contact our Data Protection Officer. We will respond within 7 days. If you are not satisfied, you may complain to the Office of the Data Protection Commissioner (www.odpc.go.ke).
Children
Appointments for children under 18 should be made by a parent or guardian, except where a young person may lawfully seek certain health services independently.
Changes
We may update this policy. The date at the top shows the latest version.
