Last updated: 6 November 2026
1. Who We Are and What This Policy Covers
Nakasero Hospital Limited (“NHL”, “we”, “us” or “our”) is a private hospital at Plot 14, Akii Bua Road, Nakasero, Kampala, Uganda. We are the data controller for personal information collected through our website, https://nakaserohospital.com/ (the “website”).
This policy explains what personal information we collect through the website, why, who we share it with, how long we keep it and the rights you have. It covers:
- booking appointments online;
- buying from our online pharmacy and uploading prescriptions;
- contacting us through website forms, email, phone or WhatsApp links;
- browsing the website.
Care you receive at the hospital, and the medical records we keep for it, are covered by NHL’s patient privacy notice. This policy should be read together with our Cookie Policy and our Website Terms and Conditions.
We process personal information in line with the Data Protection and Privacy Act, 2019 and the Data Protection and Privacy Regulations, 2021.
2. Information We Collect
We collect the information you give us when you use the website’s services, and a limited amount of technical information that every visit produces.
| When you | What we collect |
|---|---|
| Book an appointment | Whether the visit is in person or online, the specialty and doctor chosen, and the appointment date and time. Your full name, phone number and email address. The patient’s nationality and gender. Whether you are booking for someone else, and if so the patient’s name. The name and phone number of the patient’s next of kin. Any pre-appointment notes you add. Payment status if the appointment is paid online. |
| Buy from the online pharmacy | Name, phone number, email address, billing and delivery address, delivery zone, the products ordered and order history. Payment status and a payment reference; card and mobile-money details are entered with our payment provider, Pesapal, and we do not receive full card numbers. |
| Upload a prescription or request a refill | The prescription file (PDF or image) and its details, and your refill reminder dates and preferences. |
| Contact us through a website form | Your name, contact details and message, plus the IP address and browser details recorded with the submission to prevent spam and abuse. |
| Contact us by WhatsApp, email or phone | Whatever you choose to send us. A WhatsApp chat started from the website is carried by WhatsApp (Meta), not by our website. |
| Browse the website | IP address, browser and device type, pages visited and the time of the visit, recorded in security and server logs; and cookies as described in our Cookie Policy. |
We only ask for what each service needs. If you book for someone else or give us a next of kin’s details, please make sure they know you are sharing their information with us.
3. How We Use Your Information and Why We Are Allowed To
We use personal information only for the purposes below. Under section 7 of the Data Protection and Privacy Act, each use rests on your consent or on one of the other grounds the Act allows.
| Purpose | Ground under the Act |
|---|---|
| Booking, confirming, rescheduling and reminding you of appointments | Performing our agreement with you; medical purposes |
| Processing, paying for and delivering pharmacy orders | Performing our agreement with you |
| Checking prescriptions before dispensing prescription-only medicines | Medical purposes; compliance with pharmacy laws and regulations |
| Sending refill reminders you asked for | Your consent |
| Answering enquiries and complaints | Your consent, given by contacting us |
| Sending order and booking emails | Performing our agreement with you |
| Keeping financial and tax records of payments | Compliance with a legal obligation |
| Protecting the website, our patients and our systems from fraud and attack | Compliance with legal obligations, including our duty to keep personal data secure (section 20) |
| Optional cookies: loading maps and videos, remembering booking details, measuring how visitors found us | Your consent, through the cookie banner |
We do not sell personal information, and we do not use it for advertising profiles. We do not send marketing messages by email or SMS.
We do not make decisions about you based solely on automated processing.
4. Health Information
Some information you give us through the website is about your health, for example the specialty you book, the medicines you order and the prescriptions you upload. The Act treats health information as special personal data, and we handle it with extra care.
- We collect health information only to provide the care, medicines or services you asked for, or where the law allows it for medical purposes.
- Uploaded prescriptions are stored privately, outside the public part of the website, under random file names. Only authorised pharmacy staff can open them.
- Health information is never used for marketing.
- Staff can see health information only where their role requires it, and they are bound by medical confidentiality.
Please do not send detailed medical information through the general contact form or WhatsApp. Our clinical teams will ask for what they need through a secure channel.
5. Who We Share Information With
We share personal information only with the organisations below, only as much as each needs, and only for the purposes in section 3. Service providers act on our instructions and must keep the information confidential and secure.
| Recipient | Why | What they receive |
|---|---|---|
| Kinsta (website hosting, on Google Cloud) | Runs the website and stores its database | All information held by the website |
| Cloudflare | Delivers the website quickly and blocks attacks | IP address and technical data of each visit |
| Pesapal | Takes card and mobile-money payments | Name, contact details, order amount and reference |
| Zoho Mail | Sends and receives booking and order emails, including appointment and refill reminders | Name, email address and the message |
| Kanzu Code Ltd (website developer) | Maintains and supports the website under a confidentiality agreement | Access only when needed to fix or support the website |
| Google (Maps, YouTube, Translate) | Shows the map, videos and translations, only when you choose to load them | IP address and technical data, under Google’s own policy |
| Courts, regulators and law enforcement | Only when the law requires it | What the request lawfully requires |
Pharmacy orders are delivered by NHL’s own couriers, so your delivery details stay within NHL. We do not share your information with insurers or employers through the website. If NHL is reorganised or merged, information may pass to the new owner under this policy.
6. Transfers Outside Uganda
Some of our service providers store or process information outside Uganda. The website is hosted by Kinsta on Google Cloud servers in Riyadh, Saudi Arabia, and Cloudflare, Pesapal and our email provider, Zoho Mail, operate across several countries.
Under section 19 of the Act, we transfer personal information outside Uganda only where the country or the provider gives protection at least equivalent to the Act, for example through contracts with data-protection terms, or where you have consented. You can ask us for details of the safeguards that apply.
7. How Long We Keep Information
We keep personal information only as long as the purpose needs, or as long as the law requires, and then delete or anonymise it.
| Information | How long we keep it |
|---|---|
| Appointment bookings | 2 years after the appointment; clinical notes from the visit follow NHL’s patient privacy notice |
| Pharmacy orders and payment records | 10 years |
| Uploaded prescriptions | 10 years |
| Contact-form messages | 2 years |
| Security and server logs | 12 months |
| Cookies | As listed in our Cookie Policy |
8. How We Protect Information
We use technical and organisational measures to keep personal information safe, as section 20 of the Act requires. They include:
- encrypted connections (HTTPS) for the whole website;
- a web application firewall and attack protection at Cloudflare and on the website itself;
- private, access-controlled storage for uploaded prescriptions;
- staff access limited by role, with activity logs of what administrators do;
- regular backups held by our hosting provider;
- payments handled by Pesapal, so card details never pass through our website.
No system is completely secure. If a breach puts your personal information at risk, we will notify the Personal Data Protection Office and, where required, you, as section 23 of the Act requires.
9. Your Rights
Under the Data Protection and Privacy Act, 2019 you have the right to:
- Be informed about how your personal information is used, which this policy does.
- Access the personal information we hold about you and get a copy of it.
- Correct information that is inaccurate, out of date or incomplete.
- Ask us to delete information we no longer have a lawful reason to keep.
- Object to or stop processing that causes you damage or distress.
- Stop direct marketing at any time.
- Not be subject to decisions made solely by automated processing.
- Withdraw consent at any time, where we rely on it. For cookies, use the Cookie settings link at the bottom of every page.
To use these rights, contact us using the details in section 12. We may ask you to confirm your identity before we act, to protect your information. We will respond within 30 days. Some information, such as medical and financial records, must be kept by law even if you ask us to delete it; we will tell you if that applies.
10. Children
Our online services are meant for adults. Appointments and orders for a child under 18 should be made by a parent or legal guardian, who gives consent for the child’s information on their behalf, as section 8 of the Act requires. If we learn that we have collected a child’s information without that consent, we will delete it unless the law or the child’s care requires us to keep it.
11. Cookies, Other Websites and Changes to This Policy
Cookies. We use strictly necessary cookies to run the website, and optional cookies only with your consent. Our Cookie Policy lists every cookie, and the Cookie settings link at the bottom of every page lets you change your choice.
Other websites. The website links to other sites, such as social media, WhatsApp and Google Maps. Their own privacy policies apply once you leave our website.
Changes. We will update this policy when our services or the law change. The new version will be published on this page with a new “Last updated” date. Where a change materially affects how we use your information, we will tell you on the website or by email.
12. Contact Us and Complaints
For questions about this policy, or to use your rights, contact our Data Protection Officer:
- Data Protection Officer: Jonathan Makumbi, Legal, Compliance & Data Protection
- Email: jonathan.makumbi@nhl.co.ug
- Phone: +256 (0) 701 378 763
- Post: Nakasero Hospital Limited, Plot 14, Akii Bua Road, Nakasero, Kampala, Uganda
If you are not satisfied with our response, you can complain to the Personal Data Protection Office:
- Address: Padre Pio House, Plot 32, Lumumba Avenue, Level 7, Kampala, Uganda
- Phone: 0417 801008 or 0790 807491
- Email: info@pdpo.go.ug