1. Who We Are

The Ministry of Health (MoH)’s key mandate is to build a progressive, responsive and sustainable healthcare system for accelerated attainment of the highest standard of health for all Kenyans as enshrined in the Constitution of Kenya 2010.

The National AIDS and STI Control Program (NASCOP) is a Division under the Ministry of Health that operates the Integrated Laboratory Information Systems (ILIS) to test, track, and monitor emerging and re-emerging diseases, support patient management and enhance public health surveillance.

All data collected will be processed in accordance with the provisions of the Data Protection Act, 2019 and the Digital Health Act, No. 15 of 2023.

2. What Personal and Sensitive Data We Collect

Personal Data

This is any information that relates to an identified or identifiable natural person, collected for purposes of ensuring that you are properly identified.

This includes:

• Full name
• OP/IP or CCC/HEI identifier
• Sex
• Age or date of birth
• Physical address (county, sub-county, village)
• Contact details (telephone and email)
• Marital status

Sensitive Personal Data

This includes information revealing a person’s race, health status, ethnic or social origin, beliefs, genetic data, biometric data, property details, marital status and family details.

Information collected may include diagnostic results, clinical and medication history, symptoms, family details (including mother identifiers for infants), and laboratory results.

Health data is sensitive personal data under the Data Protection Act, 2019.

Data from Vulnerable Groups

Vulnerable groups include children, expectant mothers, persons with disabilities, prisoners and refugees. These groups receive enhanced protections.

Data collected from these categories is handled according to the provisions of the Digital Health Act, 2023.

3. Lawful Basis for Processing

We process personal data on the following lawful bases under the Data Protection Act, 2019:

• Vital interests and provision of healthcare: To protect your life and health.
• Public interest or public task: Outbreak response, disease surveillance and reporting of infectious diseases under the Public Health Act, Cap. 242.
• Legal obligation: Under the Constitution of Kenya (Article 43(1)(a)), the Health Act, 2017, the HIV and AIDS Prevention and Control Act (Cap. 246A), the Medical Laboratory Technicians and Technologists Act (Cap. 253A), the National Coroners Service Act (Cap. 89), and the Digital Health Act, 2023.
• Personal data processed without the knowledge or consent of the data subject is processed only to the extent permitted by the Data Protection Act, 2019.

4. How We Collect and Use Your Data

Data is captured at healthcare facilities through laboratory request forms and Point-of-Care (POC) or Electronic Medical Record (EMR) systems.

This information is transmitted to the Integrated Laboratory Information System (ILIS), where it undergoes pre-analytical, analytical and post-analytical processing.

A unique, de-identified sample identifier containing no direct personal data is assigned to the sample and internally linked to the patient’s record.

Laboratory results are subsequently relayed to the healthcare facility where the patient accessed services.

5. Who Can See Your Data

Personal data is shared only with authorised parties who have legitimate and clearly defined responsibilities.

Data sharing is governed by applicable data-sharing agreements or Memoranda of Understanding (MOUs) containing data-protection provisions.

Wherever appropriate, data is shared in de-identified or aggregated form to protect individual privacy.

6. International Data Transfers

Where data is shared outside Kenya, it is transferred in aggregated or de-identified form and in accordance with the applicable provisions of Part VIII of the Digital Health Act, No. 15 of 2023.

7. How Long We Keep Your Data

Health data held in the system shall be maintained for a minimum of twenty (20) years under Section 25 of the Digital Health Act, 2023.

Data may be retained for longer where required or authorised by law, by the data subject, or where reasonably necessary for a lawful purpose, including historical, statistical or research purposes.

Where the retention period is not extended, data shall be secured through de-identification, anonymisation or pseudonymisation and securely archived in accordance with the Kenya Health Data Governance Framework, Clause 5.3.2.

8. How We Protect Your Data

Technical Safeguards

• Encryption in transit using SSL/TLS and HTTPS
• Encryption at rest as a committed security measure
• Unique Client Registry Numbers
• De-identification of patient-level data
• Role-based access controls
• Document-level controls aligned with ISO 15189:2022
• LIMS certification under applicable Digital Health Act requirements
• Firewalls and network monitoring

Organisational Safeguards

• Adherence to the Kenya Health Data Governance Framework
• Compliance with ODPC guidance on processing health data
• Designation of a Data Protection Officer
• Continuous staff training and awareness
• Ethical approvals for research activities

Physical Safeguards

• Secured server rooms and data centres
• Authentication-controlled access to facilities
• Monitoring of common areas

9. Your Data Protection Rights

Under applicable Kenyan data protection and digital health legislation, you have the right to:

1. Be informed: Receive information about how your data is collected and processed, including relevant consent notifications.
2. Access your data: Request access through the Data Protection Officer.
3. Object to processing: Request that certain processing activities be reviewed and, where legally applicable, stopped.
4. Rectification: Request correction of inaccurate information with appropriate supporting documents.
5. Erasure: Request deletion of data, subject to overriding legal and public-interest obligations.
6. Restriction and portability: Exercise applicable rights concerning processing restrictions and transfer of personal data.
7. Automated decision-making: Exercise applicable protections against decisions based solely on automated processing.
8. Withdrawal of consent and complaints: Withdraw consent for consent-based processing and lodge complaints with the Office of the Data Protection Commissioner (ODPC).

10. Personal Data Breaches

If a personal data breach is confirmed, NASCOP will notify the Office of the Data Protection Commissioner and, where required, affected data subjects.

Notifications will include the nature of the breach, categories of data involved, likely consequences, and measures taken to mitigate the incident, as required by applicable law.

11. Changes to This Privacy Notice

This Privacy Notice will be reviewed and updated whenever material changes occur in personal data processing activities.

Updated versions will be published on the Ministry’s website, and material changes will be communicated to affected data subjects where appropriate.

NASCOP Laboratory Information Systems | Privacy Notice v1.0 | Effective 30 October 2026