The Nairobi West Hospital (TNWH) is committed to protecting the privacy and confidentiality of Personal Data and to responsibly handling personal information. The Nairobi West Hospital will collect, use, store, share, retain and dispose of personal data in accordance with the Data Protection Act, 2019, Data Protection (General) Regulations, 2021, Data Protection (Complaint Handling Procedure and Enforcement) Regulations, 2021, Data Protection (Registration of Data Controllers and Data Processors) Regulations, 2021 and the Data Protection (Civil Registration) Regulations, 2020, Laws of Kenya.

As stipulated in clause 18 of The Data Protection Act, The Nairobi West Hospital is duly registered with the Office of the Data Protection Commissioner (ODPC) as a Data Controller and Data Processor and has appointed a Data Protection Officer (DPO) to oversee compliance with applicable data protection laws and serve as the point of contact for data protection-related concerns.

“data subject” means an identified or identifiable natural person who is the subject of personal data.

Type of Data Collected and Purpose Type of Data

With the consent of the data subject, we collect necessary and relevant sensitive personal data such as natural person’s race, health status, ethnic social origin, conscience, belief, genetic data, biometric data, property details, marital status, family details including names of the person’s children, parents, spouse or spouses, sex or the sexual orientation. This information may belong to a patient, next of kin, guardian, visitor, an employee, consultant, staff, students, interns, suppliers, contractors, donor and any other person(s) whose personal data is processed by TNWH. The information will be processed in a fair and transparent manner with appropriate data protection measures in place to safeguard personal data against unauthorized access, disclosure or loss.

Purpose of Data;

1. Identity Data includes data subject’s name, marital status, title, date of birth, gender, National identification card (ID)/ passport Number or copy, birth certificate, Nationality and any other biographical information. Such information is collected for purposes of ensuring that the data subject are properly identified.
2. Contact Data includes home address, email address and telephone numbers of both the data subject and their next of kin, emergency contact(s) or guardian(s). This information is

collected to ensure that effective communication between the data subject or their next of kin and TNWH while ensuring seamless provision of quality services to the data subject;

1. Patient Care Data includes medical records, diagnoses, treatment plans, prescriptions, laboratory results, radiology reports, clinical notes, nursing records and healthcare histories required and utilized in provision of medical services;
2. Financial Data includes bank account data, payment card details, insurance policy details and details about payments;
3. Marketing and Communications Data includes the data subject’s preferences in receiving marketing and communication from the hospital and its third parties

Data Protection Principles

TNWH Undertakes that personal data shall be;

1. processed in accordance with the right to privacy of the data subject;
   1. processed lawfully, fairly and in a transparent manner in relation to any data subject;
   1. collected for explicit, specified and legitimate purposes and not further processed in a manner incompatible with those purposes;
   1. adequate, relevant, limited to what is necessary in relation to the purposes for which it is processed;
   1. collected only where a valid explanation is provided whenever information relating to family or private affairs is required;
   1. accurate and, where necessary, kept up to date, with every reasonable step being taken to ensure that any inaccurate personal data is erased or rectified without delay;
   1. kept in a form which identifies the data subjects for no longer than is necessary for the purposes which it was collected; and

h)  not transferred outside Kenya, unless there is proof of adequate data protection safeguards or consent from the data subject.

Lawful basis for processing personal data

1. Consent – The Data Subject gives permission which is clear and informed to process their data for a specific reason. All their data protection rights may apply, except the right to object. The Data subject has the right to withdraw their consent at any time.
   1. Contract – TNWH shall process the data subject’s data in order to enter into or carry out a contract with them or their next of kin.
   1. Legal Obligation – TNWH shall process the data subject’s personal data in order to comply with the law. All data protection rights may apply, except the right to erasure, the right to object and the right to data portability

• Legitimate Interests – TNWH shall process data subject’s personal data because it benefits the data subject, the hospital or a 3^rd party, without causing an undue risk of harm to anyone.
  • Vital Interests – TNWH will apply this basis when the data subject’s physical or mental health or wellbeing is at urgent or serious risk, often life-threatening.
  • Public Interest – TNWH shall process personal data if the law requires the hospital to process some data for the benefit of the public.
  • Scientific research – TNWH will collect Personal Data where it is necessary to advance knowledge on health and diseases, preserve and study historical events and Monitor trends to predict and control any disease outbreaks.

Ways of collecting Personal Data

1. Directly from the Data Subject – when filling registration or admission forms, contracts, correspondence, opt to receive marketing information, visit hospital website, application to be a consultant, apply for employment/ internship.
2. Next of Kin, Guardians, Family Members, or Guarantors.
3. Hospital Queue Management system.
4. In consultation with the medical service provider either physically or online through tele-medicine.
5. Other healthcare providers – when sharing medical records about the data subject for referral or other healthcare reasons
6. CCTV footage or other recordings – from hospital cameras which are installed to ensure security.
7. Insurance companies and corporates – when dealing with payment details or policy rules
8. Previous employers – for references and background checks.
9. Application for onboarding or granting of admission rights e.g Consultant
10. Participates in the recruitment process
11. Suppliers and service providers – procurement process and participation in tendering process.
12. Participants in events sponsored by TNWH such as medical camps etc
13. Data subject signs up for marketing and related activities.

Sharing of the Data Subject’s Personal Data

TNWH may also need to disclose/release some of the above categories of personal data to third parties such as:

1. Next of Kin/Guardian
   1. Other healthcare providers, personnel and medical practitioners in the course of service delivery.

• Insurance companies, brokers and other intermediaries.
  • Relevant legal or regulatory authorities e.g. KMPDC, National Police Service, Courts etc.
  • Suppliers and service providers – TNWH may have outsourced certain functions including but not limited to ICT (HMIS) , HR Management System, diagnostic service providers
  • Professional service providers such as legal representatives, accountants, auditors, insurers and advisors.
  • Partner organizations and affiliates of TNWH.
  • Sponsors or financiers of the hospital.
  • Prospective business partners in merger, acquisition of business or assets
  • Where disclosure is required by law or to enable products and services to be provided to data subjects
  • Educational institutions – for students
  • Future or previous employers according to Human Resource (HR) practices.
  • Any other person duly authorized by the data subject by way of Consent.

Rights of a Data Subject

A data subject has a right —

• to be informed of the use to which their personal data is to be put;
• to access their personal data in custody of data controller or data processor;
• to object to the processing of all or part of their personal data;
• to correction of false or misleading data; and
• to deletion of false or misleading data about them.

While TNWH recognizes the above rights, it also recognizes that The Data Protection Act, 2019 and its subsequent Regulations provide for instances where TNWH may decline to act as instructed or directed by Data Subjects. Should TNWH decline to act as instructed or directed by the data subject, it will communicate the reasons to the Data Subject as stipulated in the Data Protection Act.

While a data subject has a right to object to provision of any personal data that may be requested by TNWH, it is important that the data subject notes that such objection or refusal to provide requested data may lead to services either not adequately being provided.

Keeping Personal Data Secure

TNWH undertakes to take the utmost care to protect the data subject’s personal data.

That has implemented appropriate technical and security measures to prevent personal data from being accidentally lost, used inappropriately, or accessed by unauthorized persons.

TNWH anonymizes and pseudonymization data to ensure the protection of the data subject. TNWH limits access to personal data to those who have a genuine business need to know it.

Only authorized officers or agents or representatives will handle personal data and are subject to a duty of confidentiality.

Personal Data Breach

This means a breach of security leading to the accidental or unlawful destruction, loss, alteration, unauthorized disclosure of, or access to, personal data transmitted, stored or otherwise processed

TNWH has established procedures in place to deal with any suspected breach of personal data. TNWH is also required to notify the Office of the Data Protection Commissioner and to the data subject where we are legally required to do so.

Contact

The Data Protection Officer can be contacted through dpo@nairobiwesthospital.com for any complaints, queries and/or clarifications.