1. Who we are
Healix builds and operates a hospital management information system (HMIS) for clinics, hospitals and healthcare networks. In this policy, “Healix”, “we” and “us” refer to the Healix entity operating this website, Nairobi, Kenya.
We act in two different roles, and the distinction matters for your rights:
- As a data controller for our own business contacts, website visitors, trial applicants and customers’ account and billing details. We decide why and how that data is used.
- As a data processor (service provider) for the patient and clinical data that a healthcare facility enters into the HMIS we host for it. The facility is the controller of that data and decides what is recorded, who may see it and how long it is kept. Our processing is governed by our Data Processing Agreement and the facility’s instructions.
Where a facility runs the HMIS on its own infrastructure (self-hosted), we do not have access to its patient data at all.
2. What we collect on this website
This website is a product and information site. We do not run advertising, behavioural analytics, session recording or third-party tracking scripts, and we do not load fonts, icons or other assets from third-party servers. Your visit is served entirely from our own infrastructure.
Information you send us
- Contact form: your name, email address, telephone number, country, facility name, facility type and the content of your message.
- Trial request: your email address, facility name, country, timezone and the plan you selected. The request is passed to the Healix portal, which provisions a private trial instance and emails the sign-in credentials to that address.
Information recorded automatically
Our web servers keep standard access logs (IP address, date and time, requested URL, response status, browser user agent) for security, fraud prevention and capacity planning. We do not use these logs to build profiles of visitors.
3. Cookies and local storage
We do not use advertising or analytics cookies. What we do use:
- Strictly necessary cookies: a session cookie for staff signing in to the content administration area, and a security token cookie that protects forms against cross-site request forgery. These cannot be switched off without breaking sign-in and form submission.
- Local browser storage: a preference recording whether you chose the light or dark theme. It stays in your browser and is not transmitted to us.
Because we serve no advertising or analytics cookies, the site does not present a cookie consent banner. If that changes, this policy and the consent mechanism will change with it.
4. What we collect as a processor
When a facility uses the HMIS we host, the system processes the data the facility and its staff enter. Depending on the modules in use, that can include:
- identification and contact details of patients (name, date of birth, sex, national or passport number, telephone, address, next of kin);
- clinical records: encounters, diagnoses, prescriptions, laboratory and radiology results, vitals, maternity and inpatient records, allergies and problem lists;
- financial records: invoices, payments, insurance or scheme details and receipts;
- staff records that the facility maintains in the HR and payroll modules.
We process this data only to provide the service the facility has subscribed to, to keep it secure and available, and to comply with the law. We do not use patient data for advertising, product analytics or to train artificial-intelligence models.
5. Why we use personal data, and on what legal basis
| Purpose | Data | Legal basis |
|---|---|---|
| Answering enquiries and preparing quotes | Contact details, message content | Steps taken at your request before entering a contract; our legitimate interest in responding to business enquiries |
| Providing a trial instance | Email, facility name, country, timezone, plan | Steps taken at your request before entering a contract |
| Delivering and administering subscriptions, invoicing and taking payment | Account and billing details, transaction records | Performance of a contract; compliance with tax and accounting law |
| Securing the service, preventing abuse and diagnosing faults | Access logs, technical data | Our legitimate interest in keeping the service safe and reliable |
For the patient and clinical data described in section 4, the legal basis is determined by the facility as controller — normally the provision of healthcare, the facility’s legal obligations, or, where required, the patient’s consent. We act on the facility’s documented instructions.
6. Sharing
We do not sell personal data, and we do not share it for advertising. We share it only with:
- Service providers (sub-processors) that help us run the product — for example payment processing, message delivery and the AI providers a facility chooses to enable. Every provider is listed, with its purpose and location, in our sub-processor register, and every one is bound by written data-protection terms.
- Professional advisers and authorities where we are legally required to disclose, or where disclosure is necessary to establish or defend a legal claim.
- A successor entity in the event of a merger or acquisition, subject to this policy continuing to apply to your data.
7. International transfers
Our service is operated from Kenya and our sub-processors are located in the countries shown in the register, which include the United States. Where personal data leaves the country in which the facility operates, we rely on an appropriate transfer mechanism — an adequacy decision where one exists, or standard contractual clauses together with the security measures described in our Security & Trust statement.
8. How long we keep data
- Website enquiries and trial requests are kept for up to 24 months from the last contact, and then deleted unless they became a customer relationship.
- Customer account and billing records are kept for the life of the subscription and afterwards for as long as tax and company law requires.
- Patient and clinical data is kept according to the facility’s own retention policy, configured inside the system. The default rule retains adult records for seven years after the last encounter, extends that to fifteen years for facilities that enable it, and keeps the records of patients who were minors until their twenty-fifth birthday. Facilities can configure these periods to the rules that apply to them.
- Server access logs are rotated and deleted on a short cycle.
9. Security
We protect personal data with the measures described in our Security & Trust statement: isolated databases per tenant, role-based access control, multi-factor authentication, encryption of identifying patient fields, an append-only audit trail, encrypted transport and tested backups. No system is perfectly secure, and we will notify the affected controller and the competent authority without undue delay if a breach affecting personal data occurs.
10. Your rights
Subject to the law that applies to you, you may ask to:
- be told whether we hold your personal data and receive a copy of it (access);
- have inaccurate data corrected (rectification);
- have data erased where there is no continuing lawful reason to keep it;
- restrict or object to certain processing, including processing based on our legitimate interests;
- receive your data in a structured, commonly used, machine-readable format (portability);
- withdraw consent at any time, where processing is based on consent.
Write to support@healix.co.ke. We answer within one month, and tell you if we need longer and why. We may need to confirm your identity before acting on a request. There is no charge unless a request is manifestly unfounded or repetitive.
If you are not satisfied with our answer, you may complain to the data-protection authority where you live or work — in Kenya, the Office of the Data Protection Commissioner (ODPC) — or to the supervisory authority of the EU or EEA member state in which you are resident.
11. If your data is in a facility’s HMIS
Patient records are controlled by the healthcare facility, not by us. If you want to access, correct or delete a record held by a clinic or hospital, please contact that facility first; it is responsible for deciding on the request. We support every facility with built-in tools: a data-subject access export that produces the individual’s record in a portable format, and an erasure procedure that removes identifying details while preserving the clinical and financial records the facility is legally required to keep. Where a facility asks us for help with a request, we provide it.
12. Children
Accounts on this website are intended for adults; account holders must be at least 18 years old. The HMIS is used by healthcare professionals to record the care of patients of every age, including children. That processing is controlled by the treating facility and is governed by the facility’s obligations on consent and on the records of minors.
13. Automated decisions and artificial intelligence
We do not make automated decisions that produce legal effects or similarly significantly affect you. The artificial-intelligence features in the HMIS are decision support for clinicians: they draft text, suggest diagnoses or flag potential drug interactions, and every output must be reviewed and accepted by a clinician. No AI output changes a patient record on its own. AI features are off unless the facility enables them, and a facility can choose its provider from the register.
14. Changes to this policy
We review this policy at least annually and whenever the way we process data changes materially. The date of the last review is shown at the top of this page. If a change materially affects how we use personal data we already hold, we will tell affected customers directly before it takes effect.
15. Contact
For any question about this policy, or to exercise a right, write to support@healix.co.ke. Our registered address is Nairobi, Kenya. This policy and the agreements that accompany it are governed by the laws of Kenya.
Questions about this document? Write to support@healix.co.ke and our team will answer in writing.