Privacy notice
Version 0.9. Pending legal review against Kenyan data protection requirements.
1. Who we are
OrthoSport Health Technologies provides sports injury management, rehabilitation tracking and sports-health reporting services to organizations in Kenya. You can reach us about privacy through the contact form.
2. Information we handle
We separate four kinds of information and treat each differently.
Public enquiries
Name, organization, work email, organization type, service of interest, optional team size and your description of needs. Used only to respond and arrange a consultation. Sent by our website to our business inbox and enquiry records. Not used for unrelated marketing and never sold.
Institutional business information
Contract details, contacts, workflows and service scope for client organizations. Kept for the duration of the relationship and as required for accounting and legal purposes.
Athlete and patient health information
Never collected through this website. Handled only within a client engagement, under a written agreement that sets out roles (data controller and processor), lawful basis and consent, permitted purposes, access, retention and deletion. Treated as sensitive personal data.
Internal operational records
Our own records of enquiries, consultations and service delivery, accessible only to OrthoSport staff who need them.
Please do not submit athlete or patient medical information through our forms. If you do, we will delete it.
3. Website analytics and technical data
If analytics are enabled, we use a privacy-conscious tool that records aggregate usage, such as page visits and button clicks, without names, email addresses, message contents or health information. Our hosting provider may keep standard server logs (IP address, browser type, request time) for security and reliability.
4. How we protect information
- Data minimization: we collect only what a stated purpose needs
- Role-based access, with authentication for any system holding health data
- Encryption in transit and at rest
- Audit logging where health data is accessed or changed
- Backups, defined retention periods and deletion procedures
- An incident-response procedure, including notification where required
5. Your rights
You may ask to access, correct or delete the information you submitted, or withdraw consent to be contacted, using the contact form. Athletes whose information is held within a client engagement should contact their organization, which we will support in responding.
6. Changes
We will update this notice as our services and data flows change, and record the version and date of each revision.