Nanto Health Privacy Policy

Nanto Ventures Limited · APP-2026-SVMI9A · Version 1.1 · 24 September 2026

0. Document ownership and version history

Owner: Nanto Ventures Limited, Data Protection Officer of record: Darack Nanto, dpo@nanto.com. The DPO owns this policy's content and review.

Version	Date	Change	Author
1.0	17 August 2026	Initial filing version for APP-2026-SVMI9A	Nanto Ventures Limited
1.1	24 September 2026	Added this ownership and version history section, named a data-subject request contact, and stated retention periods explicitly in section 7, in response to DHA's re-upload request on APP-2026-SVMI9A	Nanto Ventures Limited

1. Purpose

This policy explains how Nanto Ventures Limited processes personal data through Nanto Health, a clinic-facing electronic medical record and claims application. It is written for the submitted outpatient and chronic-care scope and is not a promise that the system is approved for every health-service category.

2. Roles and accountability

The clinic or health facility decides why patient data is collected and is the controller for its care and claims records. Nanto Ventures Limited operates the application as a processor where the clinic gives us those instructions. Nanto may be a controller for its own account, security, billing and support records.

Nanto holds ODPC registration as both a processor and a controller. The Data Processor certificate is serial 24398, valid 22 July 2026 to 22 July 2028; the Data Controller certificate is serial 14791, valid 4 August 2026 to 4 August 2028. The processor registration record is INST-416208DC5B1. The DPO recorded on that application is Darack Nanto at dpo@nanto.com. The clinic remains responsible for providing its patients with any notice required for its care relationship.

Nanto is a controller for its own account, security, support and business records, supported by the controller certificate above.

3. Data processed

Depending on the enabled service, the application may process patient identity and contact details, clinical notes, observations, laboratory attachments, dialysis session records, authorisation and claim information, user accounts, signatures, audit records and technical security logs. Development and test environments use synthetic data.

4. Purposes and instructions

Data is processed to support care documentation, clinical review, eligibility and authorisation workflows, claim preparation and reconciliation, account security, service support, auditability, backup and recovery. Nanto does not sell patient data or use clinical records for advertising. A clinic may give a lawful written instruction for a new purpose; Nanto will assess it before processing.

5. Safeguards

Access is limited by facility, named user, role and least privilege. Sessions, administrative actions, privileged record access and exports are audit logged. Sensitive fields and backups are encrypted, transport uses TLS, and recovery is tested. Nanto keeps a paper downtime process for continuity of care. Security details are set out in the Security, Privacy and Confidentiality Policy and the supporting technical documents in this filing pack.

Data may be shared with the clinic's authorised users, contracted infrastructure and support providers, and a national or payer service when the clinic has enabled that workflow. Production hosting is currently in the European Union, not Kenya. Nanto will document the applicable transfer safeguards and will not describe the service as Kenya-resident unless the hosting arrangement changes or the relevant authority accepts the arrangement.

7. Retention and rights

Records are retained only for an approved purpose and period, per the schedule in the Nanto Health Data Retention Policy filed alongside this document:

Data class	Retention period
Clinical and patient record	Duration of the care relationship, and not less than 7 years from the date of the patient's last contact with the clinic; for a minor, not less than 7 years from the date the minor turns 18. This is the best-practice figure Nanto applies now, reflecting prevailing Kenya and East Africa clinical-records practice and a margin beyond the general limitation period under the Limitation of Actions Act, Cap 22. It is not yet a Kenya-qualified advocate's confirmed figure; if counsel sets a longer minimum for a record class, the longer period governs
Claims, authorisations and billing	7 years, Tax Procedures Act 2015 record-keeping period
Audit trail	20 years for the current system audit chain, unless a longer legal hold applies
Backups	14 recent on-host archives, 30 recent off-host archives
User account and support records	While the account or support relationship exists, then for security, billing and dispute obligations

Clinical, claims, tax and audit obligations may require retention after a user requests deletion. Requests for access, correction, export or deletion are routed through the clinic controller and may also be sent directly to Nanto's Data Protection Officer at dpo@nanto.com, who is the named contact for any data-subject request under this policy. Identity and authority are checked before disclosure.

8. Incidents and changes

Suspected unauthorised access, loss, corruption or disclosure must be reported to Nanto promptly. Nanto preserves evidence, contains the event, assesses whether it is a personal-data breach and supports the controller with the facts needed for any notification under the Kenya Data Protection Act 2019 and the applicable health-information rules. This policy is reviewed annually and after a material change.

9. Governing framework

This policy is applied with the Kenya Data Protection Act, 2019, applicable health-information requirements, the clinic's lawful instructions and the executed data-processing terms. Where this policy conflicts with an executed agreement or law, the agreement or law controls.

10. Approval

Name	Role	Signature	Date
Darack Nanto	Founder, Nanto Ventures Limited; authorised signatory; Data Protection Officer	Darack Nanto	24 September 2026