Privacy Policy
Last updated: 31 August 2026.
Petals Dermatology Centre & Medical Spa (“we”, “us”, “the clinic”) is committed to protecting your privacy. This policy explains what personal information we collect, why, and what rights you have.
Who we are
The data controller is Petals Dermatology Centre & Medical Spa, Nairobi, Kenya. For any privacy question, contact our Data Protection contact at privacy@petalscosmeticdermatology.co.ke or 0748 469 003.
Information we collect
- Enquiry details you submit through our contact form — name, email, phone, and the content of your message.
- Booking information processed by our appointment system provider (Cliniko) when you book online.
- Health information you provide during consultations and treatment — collected and stored under our clinical records obligations.
- Technical data — basic server logs (IP address, browser type, pages visited) used for security and to keep the site running.
How we use your information
- To respond to your enquiry and arrange appointments.
- To provide clinical care and maintain accurate medical records.
- To send appointment confirmations, reminders and aftercare information.
- To meet legal, regulatory and insurance requirements.
- With your separate consent, to send occasional clinic updates or offers. You can withdraw this at any time.
Legal basis
We process your data on the basis of your consent, the performance of a contract (providing treatment you request), our legitimate interests in running the clinic securely, and compliance with legal obligations. Health data is processed for the provision of healthcare by professionals bound by a duty of confidentiality.
Sharing your information
We do not sell your data. We share it only with: our appointment and IT service providers under written agreements; laboratories and other clinicians involved in your care (with your knowledge); and regulators, insurers or authorities where legally required.
Third-party services on this site
- Cliniko — online booking. Data you enter into the booking tool is processed by Cliniko under their privacy policy.
- Google Maps — the embedded map may set cookies from Google.
- Google Fonts — fonts are loaded from Google’s servers.
Retention
Enquiry emails are kept for up to 12 months. Clinical records are retained for the period required by Kenyan law and professional guidance. Marketing consents are kept until you withdraw them.
Your rights
Subject to law, you may request access to your data, correction of inaccurate data, deletion, restriction of processing, or a copy in a portable format, and you may object to certain processing or lodge a complaint with the Office of the Data Protection Commissioner. To exercise these rights, contact us using the details above.
Security
We use appropriate technical and organisational measures — including HTTPS, access controls and staff confidentiality obligations — to protect your information. No transmission over the internet is completely secure; please do not send sensitive medical details through the website contact form.
Changes
We may update this policy from time to time. The current version is always available on this page.