Privacy policy

The data controller for this website is Kampala Dermatology Ltd, trading as Kampala Dermatology, a specialist skin, hair and nail clinic at Plot 37, Bandali Rise, Bugolobi, Kampala, Uganda. We decide how and why your personal data is used.

• Phone and WhatsApp: +256 780 907156
• Email: info@kampaladermatology.com
• Post: Kampala Dermatology, Plot 37, Bandali Rise, Bugolobi, Kampala

For any privacy question or request, write to the email address above and mark it “Privacy”. It will be handled by the person responsible for data protection at the clinic.

What we collect depends on how you use the site and contact us.

The Act allows us to process personal data only for a lawful reason. Ours are as follows.

• To reply to your enquiries and manage your appointments and orders. This is needed to take steps at your request before, and to carry out, the services or products you ask for.
• To take payment and keep financial records. This is needed to complete your purchase and to meet our tax and accounting obligations under Ugandan law.
• To provide healthcare and keep medical records. See “Health information” below.
• To understand and improve the website. Analytics cookies are used with your consent. You can withdraw it at any time (see “Cookies and analytics”).
• To keep the site secure and meet legal duties, including responding to lawful requests from authorities and regulators.

We do not sell your personal data, and we do not use it for advertising or send marketing messages unless you have asked us to.

Information about your skin, hair, nails, symptoms, treatments, photographs of the affected area and your medical history is health information, which the Act treats as special personal data that needs extra care. We collect it only when you choose to give it to us, to advise and treat you, and we use it for no other purpose.

Our staff handle it in confidence and only as far as their role requires. We ask that you do not put detailed medical information in the website contact form or in any public social media message. For a private conversation, use WhatsApp or phone us, or tell the doctor at your appointment. WhatsApp is not a replacement for a medical consultation, and in an emergency you should call the clinic or go to the nearest hospital.

Photographs of your skin are used for your care. We will not use them for teaching, publications or marketing without asking you first and getting your written consent.

We share personal data only with the service providers below, who act for us or provide the channel you chose, and only as far as needed.

• Google (Google Analytics and Google Maps). Analytics data is described above. The map on our Contact page is loaded from Google, which receives your IP address and may set its own cookies when the map is displayed.
• Meta Platforms (WhatsApp). When you message us on WhatsApp, the conversation passes through WhatsApp under WhatsApp’s own terms and privacy policy. Messages are end-to-end encrypted in transit. Facebook and Instagram links on this site take you to Meta’s services, which have their own policies, as do our X and TikTok links.
• Cliniko. Our online booking and patient-records provider, which stores appointment and patient information on our behalf.
• Pesapal. Our payment processor, once online payments are live. Pesapal is responsible for the security of the payment details you give it.
• Vercel. Hosts this website.
• Professionals and authorities, such as another doctor or laboratory involved in your care (with your agreement), our professional advisers, and regulators or courts where the law requires it.

Several of these providers (Google, Meta, Cliniko, Vercel and Pesapal) store or process data on servers outside Uganda. Where that happens we rely on providers that apply appropriate protections to personal data, or on your consent, as the Act requires. We have not given any provider permission to use your data for its own purposes beyond what its terms allow.

We keep personal data only as long as we need it for the reasons above.

• Website analytics: 14 months, after which Google Analytics deletes it automatically.
• General enquiries and kit orders that do not lead to treatment: until the matter is resolved, then up to 12 months for follow-up and complaints, after which we delete them.
• Medical records and booking details: for the period required by medical practice and applicable Ugandan law, which for medical records is normally several years after your last visit.
• Payment and invoice records: for the period required by Ugandan tax and accounting law.

When data is no longer needed it is deleted or anonymised. If the law requires us to keep something you have asked us to delete, we will tell you why.

Cookies are small files that a website stores on your device. This site uses:

• Google Analytics cookies (named _ga and _ga_ followed by letters and numbers) to tell visitors apart and count visits and page views. They last up to 2 years but the data they collect is deleted after 14 months. These are the only cookies we place ourselves.
• Third-party cookies that Google may set when its map is displayed, and that Cliniko, WhatsApp and social media sites may set once you click through to them.

To stop analytics, use Google’s opt-out browser add-on, or block or delete cookies in your browser settings. The site still works if you do. You can also write to us to withdraw your consent.

Under the Act you have the right to:

• be told what personal data we hold about you and to get a copy of it;
• ask us to correct data that is inaccurate, incomplete or out of date;
• ask us to delete or stop using your data where we no longer have a good reason to keep it (we must still keep medical and financial records the law requires);
• object to our processing of your data, including for direct marketing;
• withdraw your consent at any time, without affecting what we did before you withdrew it;
• not be subject to a decision made only by automated means that significantly affects you (we make no such decisions); and
• complain to the Personal Data Protection Office if you think we have not handled your data properly.

To use any of these rights, email info@kampaladermatology.com or speak to us at the clinic or on +256 780 907156. We may ask you to confirm who you are first, to make sure we do not disclose your information to someone else. We aim to respond within 30 days, and we do not charge for ordinary requests.

We take reasonable technical and organisational steps to protect personal data against loss, misuse and unauthorised access. The site is served over HTTPS. Access to patient and enquiry information is limited to staff who need it and who are bound by confidentiality, and we choose providers who use recognised security measures. No method of transmission or storage is completely secure, so please avoid sending sensitive details over channels you do not trust. If a breach affects your personal data in a way that is likely to harm you, we will notify you and the Personal Data Protection Office as the Act requires.

Our website is intended for adults. We treat children’s health information with particular care and, in line with the Act, process a child’s personal data only with the consent of a parent or guardian. Please contact us on behalf of a child under 18 yourself, and do not submit the child’s details without your consent as their parent or guardian.

We may update this policy as our services or the law change, for example when online payments go live. The “Last updated” date at the top shows when it last changed. If we make a significant change we will say so on this page.

If you have a question or concern about your personal data, please contact us first so we can put it right: info@kampaladermatology.com, +256 780 907156, Plot 37, Bandali Rise, Bugolobi, Kampala.

You may also complain to the Personal Data Protection Office, the regulator under the Act, which is part of the National Information Technology Authority, Uganda (NITA-U): www.pdpo.go.ug.