CERVANNA CARE – PRIVACY POLICY

Cervanna is the Data Controller for all personal data collected through the Platform unless otherwise indicated.

Identification Data

• Full name
• ID or passport number
• Date of birth
• Gender
• Nationality
• Professional licenses and certificates (for nurses, physiotherapists, or caregivers)
• Police clearance or other vetting documents

Contact Information

• Phone number
• Email address
• Physical address
• Emergency contacts

Employment & Skills Data

• Work experience
• Education history
• Skills, competencies, and references
• Ratings and reviews (submitted on the Platform)

Medical-Related Data

Collected only where relevant and with consent:

• Health permits and certifications
• Vaccination or professional training records

Platform Usage Data

• Account login information
• Device and browser details
• IP address
• Interaction logs, searches, and communications

Payment Information

• Subscription payments (domestic workers, agencies)
• Commission-related payments (nurses, physiotherapists, institutions)
• Mobile money or bank account details

Location Data

If location services are enabled for matching purposes.

Sensitive Personal Data

Only collected with explicit consent (health, biometric, or legal clearance data).

• Direct submission during registration or updates
• Automatic tracking (cookies, analytics, device metadata)
• Third-party service providers (software, payment processing, verification tools)
• Feedback, ratings, and reviews
• Consent-based verification or background checks

Cervanna processes data based on:

• Performance of a contract (subscriptions, services)
• Compliance with legal obligations
• Consent from client
• Legitimate interests (fraud prevention, analytics, service improvement)
• Public interest (for regulated professions)

We use your data to:

• Manage accounts and subscriptions
• Verify identity, certifications, and qualifications
• Match Clients and Service Providers
• Facilitate communications and transactions
• Process subscription payments and commissions
• Improve platform functionality and security
• Conduct analytics and reporting
• Provide customer support
• Comply with legal and regulatory obligations
• Send notifications and updates

We do not sell personal data.

We may share data with:

• Clients and Service Providers – relevant data for matching and engagement
• Third-Party Software Providers – hosting, analytics, payment processing, communications, verification
• Regulators or Law Enforcement – as required by Kenyan law
• Professional Bodies / Medical Councils – for verification and compliance
• Business Transfers – mergers, acquisitions, or restructuring

All third-party partners are required to comply with equivalent data protection standards.

We take the security of your personal data seriously and have implemented multiple safeguards, including:

• Encrypted storage and secure servers to protect data from unauthorized access
• Access controls and authentication to ensure only authorized personnel can access sensitive information
• Regular security audits to identify and address vulnerabilities
• Staff confidentiality agreements to prevent unauthorized disclosure

While we implement strong measures, no system can be guaranteed to be completely secure. client are encouraged to protect their own devices, accounts, and login credentials.

Some third-party service providers that support the Cervanna Care Platform may store or process personal data outside Kenya.

Where such transfers occur, Cervanna ensures:

• Appropriate safeguards consistent with the Kenya Data Protection Act (2019)
• Data is processed only for Cervanna’s agreed purposes
• Providers are contractually obligated to maintain confidentiality and security of personal data

By using the Platform, you consent to the transfer of personal data to countries outside Kenya for these purposes.

Cervanna Care retains personal data only for as long as necessary to achieve the purposes for which it was collected, including:

• Provision of services through the Platform
• Compliance with legal, regulatory, or contractual obligations
• Resolution of disputes or claims
• Enforcement of agreements

Once personal data is no longer required, it may be deleted or securely anonymized for analytics or research.

Retention periods may vary depending on the type of data, legal requirements, or business needs.

client have the following rights regarding their personal data:

• Access: request and obtain copies of data we hold
• Correction: correct inaccurate or incomplete info
• Withdrawal of Consent: withdraw consent where applicable
• Objection: object to processing for specific purposes
• Deletion (“Right to be Forgotten”): request deletion subject to legal obligations
• Data Portability: request machine-readable copies
• Complaints: lodge complaints with the Office of the Data Protection Commissioner (ODPC)

The Cervanna Care Platform is not intended for persons under the age of 18.

We do not knowingly collect, use, or process personal data of minors without explicit consent of a parent or legal guardian.

If we become aware that we have inadvertently collected data from a minor without consent, we will take steps to delete such data promptly.

Some features may use automated systems to assist with matching, recommendations, or other platform functions.

client have the right to:

• Request a human review of any automated decision affecting them
• Receive an explanation of the logic and criteria used
• Request reconsideration if an outcome is incorrect or unfair

Cervanna Care may update this Privacy Policy from time to time.

• Notification: material changes will be communicated via the Platform
• Acceptance: continued use after updates constitutes acceptance of the revised policy