Privacy Policy

ZuriHemo (“ZuriHemo”, “we”, “us”) is a private limited company registered in the Republic of Kenya, with its head office in Kakamega. We provide newborn screening logistics, centralized laboratory coordination, and digital reporting for sickle cell disease.

This policy explains what personal data we collect, why we collect it, and what rights you have. It is written to meet our obligations under the Kenya Data Protection Act, 2019 and its regulations.

1. Who is responsible for your data

For enquiries made through this website, ZuriHemo is the data controller.

For newborn screening, the health facility that collects the sample is normally the data controller, and ZuriHemo acts as a data processoron that facility's written instructions. Where a county health department commissions screening across facilities, responsibilities are set out in the agreement with that county.

Data protection contact: info@zurihemo.com · +254 719 429 254 · [Registered office address] · [ODPC registration number].

2. What we collect

Website enquiries

When you use the contact form we collect your name, email address, telephone number (if you give one), organization, the role you select, and the content of your message.

Newborn screening

In delivering the screening service we process:

• Infant identifiers supplied by the facility, linked to a unique sample barcode
• The collecting facility, collection date and time, and chain-of-custody scan events
• Laboratory results, including haemoglobin phenotype, which is health data and is treated as sensitive personal data under the Act
• Contact details for a parent or guardian and the assigned community health promoter, so results and follow-up appointments can be communicated

Patient identity tokens are anonymized across our databases, and data is encrypted in transit.

3. Why we process it, and on what basis

• To reply to you. We use enquiry details only to respond to your message and to follow up on it. Basis: your consent, and our legitimate interest in responding to people who contact us.
• To deliver screening. Basis: performance of our contract with the health facility or county, and their instructions as controller.
• To protect a child's health. Where a result requires urgent clinical follow-up, processing may also rest on the vital interests of the child and the provision of health care under the Act.
• To meet legal and quality obligations. Including laboratory quality assurance and applicable health record-keeping requirements.

We do not sell personal data, and we do not use it for advertising.

4. Who we share it with

• Partner laboratories holding ISO 15189 accreditation, which perform the analysis
• Courier partners, who receive only the sample barcode and collection point, not clinical results
• The originating facility and treating clinicians, who receive the result
• Parents or guardians, and the community health promoter linked to the child, for results and appointments
• County health departments and funders, in aggregate and de-identified form only: coverage, turnaround, and burden statistics
• Service providers who host or transmit data on our behalf under written terms. Our website contact form is delivered by FormSubmit, which processes the contents of your message in order to email it to us.

5. Where data is stored

We host on cloud infrastructure selected to keep data within jurisdictions compatible with the Kenya Data Protection Act. Where any transfer outside Kenya is necessary, we rely on the safeguards permitted under Part VI of the Act.

6. How long we keep it

Enquiry data is kept for up to 24 months from our last exchange with you, then deleted. Screening records are retained for the period required by the controlling facility and by applicable health record-keeping law, after which they are deleted or irreversibly anonymized.

7. Cookies and analytics

This website sets no advertising or analytics cookies and does not track you across sites. If that changes we will update this policy and ask for consent where the law requires it.

8. Your rights

Under the Act you have the right to:

• be informed of how your data is used
• access the personal data we hold about you
• have inaccurate or misleading data corrected
• have data deleted, where there is no lawful reason to keep it
• object to processing, or ask us to restrict it
• receive a copy of your data in a portable format

To exercise any of these, write to info@zurihemo.com. We respond within the statutory timeframe. Where we act as processor for a facility, we will pass your request to that facility and support them in answering it.

You also have the right to lodge a complaint with the Office of the Data Protection Commissioner in Kenya.

9. Children

Newborn screening is by its nature about children. We process a child's data on the instruction of the health facility and with the consent of a parent or guardian obtained at the point of care, except where the law permits processing without it in order to protect the child's health.

10. Security

We apply access controls, encryption in transit, anonymized identity tokens, and audited chain-of-custody logging. No system is perfectly secure, but we will notify affected people and the Data Protection Commissioner of any breach that requires it, within the timeframes set by the Act.

11. Changes

We may update this policy. The date at the top shows when it last changed, and material changes will be highlighted on this page.

12. Contact

ZuriHemo · Kakamega, Kenya · info@zurihemo.com · +254 719 429 254