Privacy, with care.

1. Who is responsible

Nurture Guide Services is the data controller for information collected for our own enquiries and hospital concierge operations. This means we decide why and how that information is used.

Our service is non-clinical. We are independent of hospitals and healthcare facilities and do not control their medical records or clinical systems.

2. Information we handle

We collect only the information reasonably needed to respond to an enquiry, arrange support, deliver an authorised service, or meet a legal obligation.

Enquiries and communications

• Your name, phone number, email address, preferred contact method, and relationship to the patient.
• The hospital or general location, when support is needed, the type of practical support requested, and messages exchanged by website form, email, phone, or WhatsApp.

Service coordination

• The patient's name and contact details where necessary.
• Hospital, ward, room, admission, discharge, mobility, dietary, communication, or practical preference information needed for approved non-clinical support.
• The identities and contact details of people authorised to receive updates.
• Service notes, authorisations, receipts, and records of approved errands or payments made using the client's funds or payment method.

Information we do not ask you to submit online

Do not send diagnoses, medical records, treatment details, passwords, card numbers, PINs, or payment credentials through our website form. Nurture Guide Services does not retain national ID or passport copies, card details, or payment credentials as part of the service described in this notice.

3. Why we use information

We use personal information to respond to requests, confirm service availability, coordinate non-clinical support, complete authorised errands, communicate with approved contacts, keep service records, issue or organise receipts, and meet accounting or legal obligations.

Our lawful bases are:

• Consent: when you ask us to process information for an enquiry, or when a patient or authorised representative approves service coordination and communication.
• Contractual necessity: when information is required to provide an agreed concierge service.
• Legal obligation: when records must be kept or disclosed under Kenyan law.

We do not sell or rent personal information. We do not use sensitive patient information for direct marketing.

4. Patient and representative authorisation

An initial enquiry does not authorise Nurture Guide Services to access medical information, enter restricted hospital areas, make medical decisions, or share patient updates.

Before ongoing support or updates begin, we obtain appropriate authorisation from the patient or, where applicable, a parent, legal guardian, or other person authorised by law. Patients may change or withdraw permission for future use or sharing by contacting us.

We share updates only with people the patient or authorised representative has approved and only within hospital rules.

5. Sharing and international processing

We share the minimum information necessary with:

• Hospital staff or facilities when needed for authorised non-clinical coordination.
• Approved pharmacies, transport providers, or other service providers involved in a requested errand.
• Truehost for website and business email hosting.
• WhatsApp when you choose to communicate through that service.
• Professional advisers, regulators, courts, or public authorities where the law requires it.

Some technology providers may process information outside Kenya. Where this occurs, we use the service only where appropriate safeguards, contractual protections, consent, or another lawful transfer basis applies.

6. Website analytics

We use Cloudflare Web Analytics to understand general website traffic and performance. It provides measurements such as page views, approximate country, referring website, device type, browser, and page performance. The service is configured without analytics cookies and is not used to collect enquiry-form contents or build advertising profiles.

Information entered into our contact form is sent only when you submit the form. It is not included in the Cloudflare analytics beacon.

7. How long we keep information

• Enquiries that do not become a service arrangement: up to 12 months.
• Service-coordination records: up to 2 years after the service ends.
• Financial and tax records: 5 years from the end of the relevant reporting period.

We may keep a specific record longer when required by law, when a dispute or legal claim is active, or when you ask us to preserve it. When information is no longer needed, we delete, anonymise, or securely dispose of it.

8. How we protect information

We use reasonable organisational and technical measures appropriate to the information we handle. These include HTTPS for website traffic, collecting only necessary information, restricting access to business accounts and communications, and reviewing who may receive patient updates.

No online or communication system can be guaranteed completely secure. Please use the website form only for initial practical details and avoid submitting medical records or payment credentials.

9. Your data protection rights

Subject to Kenyan law, you may ask us to:

• Explain what personal information we hold and how it is used.
• Give you access to your personal information.
• Correct inaccurate or incomplete information.
• Stop or restrict particular processing.
• Delete information that we no longer have a lawful reason to keep.
• Provide eligible information in a portable format.

You may withdraw consent for future processing at any time. Withdrawal does not make earlier lawful processing invalid. We may ask for information needed to verify your identity and authority before acting on a request.

10. Contact and complaints

For privacy questions or to exercise your rights, contact:

If you are not satisfied with our response, you may lodge a complaint with Kenya's Office of the Data Protection Commissioner.

We may update this notice when our services, providers, or legal obligations change. The latest version will appear here with its revision date.