1 Who we are
Cheza is a service of Nairobi Outpatients Center ("NOC", "we", "us"), Nairobi, Kenya. NOC decides how and why your information is used, so under Kenya's Data Protection Act, 2019 we are the data controller for it.
Questions about your information, or about this policy, go to info@chezaplaytherapy.com.
2 What we collect
We only ask for what we need to run Cheza for your family:
- Your account: your name, email address, M-Pesa phone number and a password. We store only a scrambled (hashed) version of the password; nobody at NOC can read it.
- About your child: your child's name, date of birth and therapy level, and your answers to the Cheza questionnaire (what your child can and cannot do yet, and the kinds of play they like). These answers are health information, which the law treats as sensitive.
- Therapy records: the therapy games given to your child, the hours you log in the play tracker, your therapist and visit times, and Practical Family Training (PFT) bookings, homework and the therapist's session notes.
- Payments: the plan or session you paid for, the amount, the phone number used, the date and the M-Pesa receipt number. We never see or store your M-Pesa PIN.
- Technical records: when you last logged in, and short server logs of payments and emails sent, which we use to fix problems.
3 How we use it
- To create and run your account, and to let you log in.
- To choose your child's therapy games from your questionnaire answers, and to show your child's progress month by month.
- To take payments through M-Pesa and give you the games month or PFT sessions you paid for.
- So that your NOC therapist and clinic staff can plan visits and PFT sessions, check homework and follow your child's care.
- To send you service messages: for example the M-Pesa prompt when your month is up (you can turn this off in your account), and emails when a therapist is assigned or a PFT session is booked.
- To keep Cheza secure and to meet our legal duties, such as keeping payment records.
We do not sell your information, show adverts, or use advertising or tracking tools.
4 Why we are allowed to use it
We use your information because it is needed to provide the service you signed up for (our agreement with you), because the law requires some records to be kept, and, for your child's health information, because you, as their parent or guardian, give us your consent when you create an account and answer the questionnaire. Children cannot open a Cheza account; a parent or guardian always acts for the child.
You can withdraw your consent at any time by contacting us. We will then stop using the information for new purposes, but we may not be able to keep giving you therapy games without it.
7 How long we keep it
We keep your account and your child's records while your account is open, including when it is dormant or retired, so that your therapist can see your child's history if you come back. Health records and payment records may have to be kept for longer because Kenyan law requires it (payment records, for example, for the period tax law requires). When we no longer need the information, we delete it or remove anything that identifies you.
Your games stay open for 30 days after each payment. That is about access to the games, not about deleting your information.
8 Your rights
Under the Data Protection Act you have the right to:
- be told how your information is used (this page);
- get a copy of the information we hold about you and your child;
- have wrong or incomplete information corrected (you can change your name, email and phone yourself in your account);
- ask us to delete information, unless the law requires us to keep it;
- object to, or ask us to limit, how we use it;
- receive your information in a common format to take elsewhere; and
- withdraw your consent.
To use any of these rights, email info@chezaplaytherapy.com or call the clinic. We may ask you to confirm who you are first. If you are not happy with our answer, you can complain to the Office of the Data Protection Commissioner (www.odpc.go.ke).
9 How we keep it safe
The site uses an encrypted (https) connection, passwords are stored hashed, and family, therapist and administrator areas each need their own login. Only staff who care for your child, and clinic administrators, can see your child's records. No system is perfectly secure: please keep your password private and log out on shared phones or computers. If we ever learn that your information has been exposed, we will tell you and the Data Protection Commissioner as the law requires.
10 Changes to this policy
If we change this policy we will update the date at the top of this page, and tell you by email or on your dashboard if the change is important.