This Privacy Policy explains how Rufaa collects, uses, stores, shares and protects information when you use our website, healthcare facility directory, referral tools, appointment features, maps, patient-facing services and related Rufaa services.
Rufaa is a healthcare discovery, navigation and referral platform. This Privacy Policy describes how information is handled when people search for healthcare facilities, request appointments, participate in referrals, manage facility profiles or use other Rufaa features.
The exact information we collect depends on how you use Rufaa. Some features can be used without creating an account, while others may require authentication, consent or additional information.
Depending on the service you use, you may provide information such as:
Rufaa may process facility information such as facility name, ownership, registration details, regulatory information, facility type, KEPH level, services, categories, capacity, opening indicators, contacts, location and geographic coordinates.
This information may come from public, regulatory, facility-provided, partner or other authoritative sources.
If you allow location access, Rufaa may process your approximate or precise device location to help identify nearby healthcare facilities, calculate proximity or provide directions. You can usually control location permissions through your browser or device settings.
When you use Rufaa, we may automatically receive limited technical information such as browser type, device information, IP address, pages visited, timestamps, referring pages, session information, feature interactions and error or performance data.
Some Rufaa services may involve health information or other sensitive personal data. Rufaa is designed so that health-information sharing is purpose-specific and, where applicable, controlled by the patient or otherwise handled according to an appropriate legal or clinical basis.
Rufaa does not require access to a person's entire medical history in order to provide basic facility discovery. Where health information is used for referrals, appointments or care coordination, we aim to process only information relevant to that workflow.
Where supported, Rufaa may allow patients to choose which relevant information is shared with a healthcare facility or clinician during a referral or care-navigation process.
Rufaa may record consent, sharing instructions or related audit information where necessary to support accountability, security and the operation of the referral workflow.
Rufaa may use information to:
Depending on the context, Rufaa may process personal information based on consent, performance of a requested service, legitimate interests, legal obligations, healthcare-related purposes or another lawful basis recognised under applicable law.
Where consent is the basis for processing, you may withdraw that consent subject to legal, clinical, security or operational requirements that may allow or require certain information to be retained.
Rufaa does not sell personal information. Information may be shared only where necessary for Rufaa services, where authorised by the user, where required by law, or where another valid legal basis applies.
Information may be shared with a healthcare facility or authorised professional where required for an appointment, referral, care-navigation process or another service requested by the patient.
Rufaa may use trusted service providers for infrastructure, hosting, communications, mapping, security, analytics, identity or other operational services. These providers may process information only as necessary to provide their services to Rufaa.
Rufaa may integrate with authorised healthcare infrastructure, registries, interoperability services or healthcare systems. Information exchanged through these integrations is limited to what is necessary for the relevant workflow and subject to applicable permissions and controls.
We may disclose information where required by law, court order, regulatory requirement or where reasonably necessary to protect users, patients, healthcare providers, Rufaa or the public from fraud, abuse, security threats or serious harm.
Information displayed in the Rufaa public facility directory may include information intended for public access, such as facility names, location, services, category, ownership, KEPH level, regulatory details and public facility contact information.
Rufaa does not treat publicly displayed facility-directory information in the same way as private patient health information.
Rufaa may use cookies, local storage or similar technologies for functionality, security, authentication, preferences, session management and performance.
Where required, Rufaa may provide a separate cookie notice or consent mechanism. You may also be able to manage cookies through your browser.
Rufaa may use third-party mapping or geolocation services to show healthcare facilities and provide geographic context. When these services are used, the third party may receive technical information necessary to provide the map or location service.
Third-party mapping providers operate under their own privacy policies and terms.
Rufaa uses reasonable technical and organisational safeguards designed to protect personal information against unauthorised access, loss, alteration, disclosure or misuse.
Safeguards may include access controls, authentication, encryption where appropriate, logging, monitoring, role-based permissions, secure system configuration and other security controls.
No system can guarantee absolute security. Users are also responsible for keeping their account credentials secure.
Rufaa retains information only for as long as reasonably necessary for the purpose for which it was collected, to provide the service, meet legal or regulatory obligations, resolve disputes, maintain security, support audit requirements or protect legitimate interests.
Different categories of information may have different retention periods. Health-related, referral, consent or transaction records may require longer retention where required by law, healthcare practice or organisational policy.
Subject to applicable law and any relevant exemptions, you may have the right to:
Some requests may be limited where Rufaa must retain information for legal, healthcare, security, fraud-prevention, audit or other legitimate reasons.
You can disable or change location access through your browser or device settings. Rufaa facility discovery can still be used without sharing device location by manually entering a facility or location where that functionality is available.
Where Rufaa provides user accounts, you may be able to update profile information, manage preferences, control certain consent settings or request account closure.
Rufaa services may sometimes be used in connection with healthcare for children or minors. Where personal or health information relating to a minor is processed, Rufaa expects the relevant parent, guardian, healthcare professional or other authorised person to have the necessary authority to provide information or consent where required.
Where Rufaa or its service providers process information outside Kenya, we aim to use appropriate safeguards and contractual, technical or organisational measures required by applicable data-protection law.
Rufaa may link to healthcare facilities, mapping providers or other third-party services. This Privacy Policy does not govern independent third-party websites or services. You should review their privacy policies where appropriate.
Rufaa may update this Privacy Policy as our services, technology, integrations or legal obligations evolve.
Where changes are material, we may provide notice through Rufaa or another reasonable method. The current version will show the latest "Last updated" date.
If you have a question about this Privacy Policy, your personal information or a privacy request, contact Rufaa at:
Rufaa may publish additional privacy notices for specific features, healthcare integrations or partner services where more detailed information is required.