Privacy notice

This notice explains how Avagrand Healthcare uses your personal information.

Who is responsible

Avagrand Healthcare is the data controller for the information you give us and the records we keep about you. Email: ilexdigital@gmail.com.

What we collect

Your name, phone number and email, and — if you give them — date of birth, address, and a parent, guardian or emergency contact.
Your appointments: what you booked, with whom, when, and whether you attended, cancelled or rescheduled.
Messages we send you and your replies, and whether you agreed to reminders and to news or offers.
Payments and deposits, including M-Pesa receipt details.
Notes and records our staff keep about the service we give you. These may include health or other sensitive information, such as: Blood group, Known allergies, Chronic conditions, Current medication.

Why, and on what basis

To book, confirm, remind you about and provide your appointments — to perform our agreement with you.
To keep accurate records of the service we give you — our legal and professional obligations.
To send news or offers — only if you agreed, and you can stop at any time.
Sensitive information, such as health details, is used only to provide your care or service, with your consent or as the law allows.

Who else handles it

We use OctoBook, provided by Octonerv Limited, to run bookings and records. OctoBook processes your information only on our instructions, under a data processing agreement, and does not use it for its own purposes.

To send messages and take payments we also use: Browser notification services, Mobitech (SMS), Our email provider.

We do not sell your information. We share it otherwise only where the law requires, or with your consent (for example a referral).

Where it is kept

Our records are hosted in United States (test server, demo data only). Some messages or payments pass through services outside Kenya: Browser notification services (United States). This happens only as the Data Protection Act, 2019 allows.

How long we keep it

We keep your records for 10 years after your last visit, unless the law requires longer, then review and delete them. The text of messages is removed after 365 days.

Your rights

You may ask to see your information, correct it, delete it, receive a copy in a usable format, object to or restrict how it is used, and not be subject to decisions made only by a computer. Withdrawing consent does not affect what was done before. Contact us at ilexdigital@gmail.com. We will reply within 30 days. You may also complain to the Office of the Data Protection Commissioner (www.odpc.go.ke).

Last updated: 29 October 2026