Privacy Policy

What this covers

This policy covers kpcirc.org and any information you send us through it, by email, by WhatsApp or in person. Where you are treated at a partner facility, that facility is a separate data fiduciary with its own policy, and we will tell you which one holds what.

What we collect

Because you gave it to us: name, contact details, the reason you got in touch, and any medical records, images or reports you send.

Because care creates it: consultation notes, board recommendations, pathology and molecular reports, correspondence with your other doctors, and the appointment and billing record.

Because the website runs: nothing beyond what your browser sends to reach the server. There is no analytics script, no advertising pixel, no session recording and no third-party tracker on this site.

What we do not do

We do not sell personal data. We do not share it for advertising. We do not use your records to train any model. We do not publish patient photographs, names or stories, with or without consent, because professional conduct regulations restrict testimonial advertising by clinical establishments.

Who sees your record

The clinicians involved in your care, the navigator holding your case, and the administrative staff who arrange and bill it. Board members see the case at the sitting it is listed for.

Molecular testing is performed by our partner laboratory, which receives the sample and the clinical information needed to interpret it. A partner hospital receives what it needs to treat you, and no more.

Anyone outside that gets your record only with your written consent, or where the law requires disclosure.

Consent, and taking it back

We ask for consent in writing for each purpose: care, molecular testing, contacting your own doctor, cascade testing letters to relatives, and research use. You may withdraw any of them at any time without affecting the others, and without affecting your care.

Withdrawing consent does not erase what has already lawfully happened, and it cannot erase a clinical record we are required to retain.

How long we keep it

Clinical records are retained for the period required of a clinical establishment, and longer where a case may recur or where a hereditary finding affects relatives. Enquiries that do not become an episode of care are deleted within twelve months.

Exact retention periods are set out in the records schedule, available on request.

Your rights

You may ask for a copy of your record, ask us to correct it, ask what we hold and who we shared it with, nominate someone to act for you, and ask for erasure where no legal or clinical duty requires us to keep it.

Write to the grievance officer below. We acknowledge within 48 hours and respond substantively within 30 days.

If something goes wrong

If personal data is exposed, we will tell the people affected and the Data Protection Board as required, describe what happened in plain language, and say what we are doing about it. We will not wait for certainty before telling you something is wrong.