Data Protection and Privacy

YCA Kenya is committed to handling personal information responsibly and in accordance with applicable data protection laws, including Kenya’s Data Protection Act, 2019 and applicable regulations. This page provides a general summary and should be read together with any specific notice presented when you use a form or service.

Information we may process

Depending on how you use YCA, we may process information such as public professional or facility details, contact information you submit, review content, enquiries, account information, and technical information such as logs, device or browser details and website usage events.

How we use information

• To operate, maintain and improve the directory.
• To respond to enquiries, listing corrections, review submissions and provider requests.
• To verify listings and prevent spam, fraud, abuse and security incidents.
• To measure site performance and, where enabled and lawful, report advertising performance.
• To comply with legal obligations and protect our users and services.

Health information and reviews

Please do not include diagnoses, treatment details, medical records, identification numbers or other sensitive personal information in public reviews or general enquiries. Reviews should describe service experiences without identifying other patients. YCA does not intend the public directory review feature to collect patient medical histories.

Legal basis, sharing and retention

We process information only where an applicable lawful basis permits it, such as consent, legitimate interests assessed against individuals’ rights, performance of a requested service or compliance with legal obligations. Information may be shared with authorised service providers who support hosting, security, analytics or communications, or with authorities where legally required. We aim to retain information only for as long as reasonably necessary for its stated purpose, security, dispute resolution or legal compliance.

Your choices and rights

Subject to applicable law, you may request access to, correction of or deletion of personal information, object to or request restriction of certain processing, withdraw consent where processing relies on consent, or raise a complaint with the Office of the Data Protection Commissioner. We may need to verify your identity and may be legally required to retain some information.

Security and third-party services

We use reasonable technical and organisational safeguards, but no online service can guarantee absolute security. Links to third-party websites, maps, advertising or review services are governed by those providers’ own terms and privacy notices. YCA’s handling of third-party review content is subject to applicable platform terms.

Contact and accountability

Before publication, the site owner should add a monitored privacy contact email, postal or business address, details of any appointed Data Protection Officer (if required), the actual analytics and advertising technologies used, retention periods, cross-border transfer information and the process for handling data-subject requests. Do not publish placeholder contact details.

This page is a general notice, not legal advice. YCA should periodically review it against the actual data flows and applicable requirements.