Privacy Policy

Your health information is personal. This notice explains in plain language what we collect, why, who sees it and the choices you have.

Last updated: 10 October 2026

01Who we are

NourivaLink Afya (“NourivaLink”, “we”, “us”) provides personalised nutrition and medically informed wellness guidance from Nairobi City, Kenya. We are the data controller for the personal data described in this notice.

Questions about your data go to support@nourivalink.com or +254 798 440 283.

02What we collect

  • Account details: your name, email address and password (stored securely, never in plain text) and, if you add one, a profile photo.
  • Booking details: the appointments you request, the date and time, the service chosen and any note you add.
  • Health and wellbeing information: information you or our clinicians record to give you care, such as date of birth, gender, height and weight, weight logs, blood type, lifestyle (smoking, alcohol, activity), health history, assessments, care plans and meal plans. This is sensitive personal data.
  • Payment records: invoices and the method used (for example cash, M-Pesa or card). We do not store full card numbers.
  • Newsletter: your email address, if you subscribe.
  • Technical data: basic device and browser information and your cookie choice. See our Cookie Policy.

We only ask for what we need to look after you. You can use the public pages of this site without giving us any of this.

03Why we use it and our legal basis

  • To provide care and services you request (accounts, bookings, nutrition and care plans, invoices). Basis: performance of our agreement with you and, for health data, your explicit consent and the provision of health care.
  • To keep you safe and the service secure (sign-in, fraud and abuse prevention). Basis: our legitimate interests and legal obligations.
  • To send appointment and account messages. Basis: performance of our agreement with you.
  • To send our newsletter. Basis: your consent. You can unsubscribe at any time using the link in every email.
  • To improve the site, only with analytics cookies you accept. Basis: your consent.
  • To meet legal duties, such as record-keeping and responding to lawful requests.

We do not sell your personal data and we do not use health information for advertising.

04Who we share it with

Your information is seen only by the NourivaLink team members who need it to care for you. We also use trusted service providers who process data for us under contract, including:

  • our secure database, authentication and file-storage provider (Supabase) which hosts account, booking and clinical records;
  • our website hosting and email delivery providers.

We may disclose information where the law requires it, or to protect someone’s life or safety. We will not share your health information with anyone else without your consent.

05International transfers

Some of our providers store data outside Kenya. Where that happens we take steps required by the Kenya Data Protection Act, 2019, such as contractual safeguards and, for sensitive data, your consent or another lawful basis, so that your data stays protected to the same standard.

06How long we keep it

We keep account and booking information while your account is active. Clinical and invoice records are kept for as long as needed to provide safe care and to meet professional and legal record-keeping requirements, then deleted or anonymised. Newsletter details are kept until you unsubscribe. You can ask us to delete your account at any time; we will remove what we are not legally required to keep.

07How we protect it

Data is encrypted in transit, access is limited by role and row-level security, passwords are hashed and administrative access is restricted to authorised staff. No system is perfectly secure. If a breach affects your data we will tell you and the Office of the Data Protection Commissioner as the law requires.

08Your rights

Under the Kenya Data Protection Act, 2019 you have the right to:

  • be informed about how your data is used (this notice);
  • access the personal data we hold about you;
  • ask us to correct data that is wrong or incomplete;
  • ask us to delete your data, where we have no legal reason to keep it;
  • object to or ask us to restrict certain processing;
  • receive your data in a portable format;
  • withdraw consent at any time, without affecting what happened before.

Email support@nourivalink.com and we will respond within the time the law allows. If you are not satisfied you can complain to the Office of the Data Protection Commissioner in Kenya.

09Children

Our online accounts are for adults. If a child needs care, a parent or legal guardian should create the account and give consent for them. We do not knowingly collect a child’s data without that consent.

10Changes to this notice

We may update this notice from time to time. The date at the top shows the latest version. If a change is significant we will tell you on the site or by email.