Confidentiality is fundamental to everything we do. Healthcare facilities trust us with sensitive operational information, and we take that responsibility seriously.
This policy explains what information we collect, why we collect it, how we protect it, and the rights you have regarding your information. CRW processes personal information in accordance with the Kenya Data Protection Act 2019, the Data Protection (General) Regulations 2021, and other applicable Kenyan law.
Information we collect
What we collect depends on how you interact with us.
Website enquiries
When you contact us through our website, by email, by telephone or on WhatsApp, we may collect your name, your facility name, your job title, your telephone number, your email address, your county or location, and anything else you choose to include in your message. We only ask for what is reasonably necessary to answer you.
Client information
If your facility engages our services, we process the information needed to deliver them:
- claim administration information;
- facility operational information;
- medical record request information;
- licensing and compliance information;
- billing and payment records;
- authorisation documentation; and
- correspondence relating to the services we provide.
Where patient-related information is processed, it is handled solely to deliver the agreed service and only to the extent necessary. On that information your facility is the data controller and CRW is the data processor, which means we act on your written instruction and never on our own account.
Technical information
When you visit this website, limited technical information may be collected, including browser type, device type, pages visited, date and time of access, and general performance statistics. Where possible this is anonymised and is not used to identify individual visitors.
Cookies, storage and third parties
So you can judge this for yourself rather than take our word for it, here is exactly what this website loads.
We do not use advertising cookies, tracking pixels or cross-site identifiers, and there is nothing to consent to or switch off. Your browser does store one thing: a copy of the news headlines shown on the home page, kept for six hours so the page loads faster on your next visit. It contains nothing about you and you can clear it at any time through your browser settings.
Several services are loaded from other companies to make the site work. Each of them will see your IP address, in the same way any website you visit does. We have no control over their own practices and we encourage you to read their policies if that matters to you.
| Service | Why it is there |
|---|---|
| Cloudflare | Hosts the site and provides basic, cookieless visitor statistics. |
| Google Fonts | Supplies the typefaces the site is set in. |
| Supabase | Holds the website content and receives enquiries you choose to send. |
| EmailJS | Sends us an alert when you request a review, so nothing sits unanswered. |
| Google News and rss2json | Supply the headlines in the news strip on the home page. |
| jsDelivr | Delivers a software library the site depends on. |
How we use your information
We use information only for legitimate business purposes: to respond to enquiries, arrange consultations and facility reviews, deliver outsourced business office services, recover and manage healthcare claims, process medical record requests, track licences and regulatory renewals, improve our services, meet legal and regulatory obligations, and protect our systems against fraud and misuse.
Not now and not later. There is no arrangement under which anyone pays us for access to what we hold about you or about your facility.
Legal basis for processing
Where Kenyan data protection law requires a basis, we rely on one of the following: you have requested our services; processing is necessary to perform our agreement with you; processing is necessary to comply with a legal obligation; or processing is necessary for our legitimate business interests, provided those interests do not override your rights.
Confidentiality
Confidentiality is part of the service rather than an add-on to it.
Information relating to one facility is never disclosed to another. Where we coordinate purchasing or administrative work involving several facilities, participating organisations remain confidential to each other unless disclosure is expressly authorised. Every member of our staff is required to maintain strict confidentiality over all client information.
Information security
We apply reasonable technical and organisational safeguards against unauthorised access, accidental loss, misuse, alteration, disclosure and destruction. These include controlled staff access, authenticated user accounts, separation of each client's data from every other client's, secure databases, encrypted communications where appropriate, routine backups and internal confidentiality procedures.
No online system can promise absolute security, and we will not pretend otherwise. What we can promise is that we review and improve these practices continually, and that we will tell you promptly if something goes wrong.
Sharing information
We share information only where it is necessary, which may include the Social Health Authority where required, health insurers, authorised regulators, courts or government authorities where legally required, professional advisers acting under confidentiality obligations, and service providers supporting our operations.
How long we keep it
We retain information only for as long as needed to provide our services, meet legal and regulatory obligations, resolve disputes, enforce agreements or maintain appropriate business records. When it is no longer required it is securely deleted, or anonymised where that is appropriate.
Your rights
Subject to applicable law, you may ask to know whether we hold information about you, to access it, to receive a copy of it, to correct anything inaccurate, to update anything incomplete, to object to certain processing, to request deletion where the law permits, and to withdraw consent where processing relies on it. Some requests may be limited by legal or contractual obligations, and where that applies we will tell you which one and why.
Contact
Questions and privacy requests may be sent using the contact details on this website. We aim to respond within a reasonable period and in accordance with applicable law.
Trust begins with transparency
If you would like to review our standard service agreement or our data processing terms before engaging us, ask and we will send them. We would rather you made an informed decision than a rushed one.
Ask us anything