How Sarnio handles personal data
Last updated: 6 October 2026. This policy describes the current website implementation, including the contact form and the integrations that are not active.
1. Scope and role
This Privacy Policy applies to visits to sarnio.guru and messages sent through its contact form. Sarnio is an informational publishing project. It is not a medical provider, patient portal, pharmacy or telemedicine service. No company name, registration number or tax identifier has been provided, so this policy does not invent one.
For purposes of Kenya's Data Protection Act, 2019, the person or entity operating this website may act as a data controller for personal data collected through the site. The operator should confirm any registration or other compliance obligation applicable to its actual operations before deployment.
2. Kenyan privacy framework
Kenya's Data Protection Act, 2019 regulates the processing of personal data and establishes rights and obligations for data subjects, controllers and processors. The Data Protection (General) Regulations, 2021 provide additional rules on consent, lawful bases, collection, direct marketing and other processing activities. The Office of the Data Protection Commissioner (ODPC) is the regulatory authority responsible for oversight and enforcement.
This policy is drafted around the current site implementation and does not claim exemptions, registrations or approvals that have not been provided.
3. Data this site may process
3.1 Contact-form data
If you use the contact form, the site receives the name, email address, subject and message you submit. The form also uses a temporary server-side session token for security and a hidden honeypot field to reduce automated spam.
3.2 Technical request data
Like most web servers, the hosting environment may create server logs containing IP address, request time, requested URL, browser or user-agent information, response status and similar security/diagnostic data. The exact retention period depends on the hosting configuration and should be confirmed by the operator or host.
3.3 Data we ask you not to send
Sarnio does not need medical records, diagnoses, laboratory results, prescriptions, identification documents or detailed sexual-health information through the general contact form. Health information can be sensitive. Please do not submit it through this channel.
4. Purpose of processing
Contact data is used to respond to editorial questions, correction requests, privacy enquiries, website feedback or other non-clinical messages. Technical data may be processed to deliver pages, maintain security, investigate errors and protect the service against abuse.
5. Lawful basis and consent
The appropriate lawful basis depends on the actual communication and the operator's legal position. Where processing relies on consent, the Data Protection (General) Regulations require consent to be informed, voluntary and specific to the purpose. Where another lawful basis under Kenyan law applies, the operator should document it before processing.
The contact form includes a clear acknowledgement that the form is for website communication and links to this policy. It does not bundle consent for marketing, profiling or unrelated processing.
6. Health and other sensitive information
This is a health-information website, but the current implementation is intentionally designed not to collect a visitor's health history. Interactive reading tools operate only in the current page and are not designed to save selections. Visitors should not use the contact form to create a patient record.
7. Cookies and browser storage
This release does not load Google Analytics, Google Tag Manager, Cookiebot, reCAPTCHA, advertising pixels or Google Maps because no valid IDs or configuration were provided. A small sessionStorage value may be used in the visitor's browser to remember that the site's basic cookie notice has been acknowledged for the current browsing session. The consultation-preparation checklist does not write its selections to storage.
See the Cookie Policy for a detailed description of the current storage model.
8. Analytics and advertising
No GA4 or GTM ID is configured. No analytics or advertising tag is loaded by the supplied code when those fields remain empty. If analytics, advertising or consent-management technology is added later, this policy and the cookie mechanism should be updated before activation.
9. Affiliate tracking
The declared business model is affiliate publishing, but this release contains no live affiliate links, affiliate cookies, partner redirect URLs or external sales CTA destinations. Therefore the current website code does not intentionally transmit visitors to an affiliate partner. If that changes, the identity of relevant recipients and tracking practices should be documented here and in the Affiliate Disclosure.
10. Recipients and processors
Personal data may be handled by the website's hosting provider and email infrastructure to the extent necessary to operate the site and deliver contact messages. The specific hosting or email processor has not been provided and is therefore not named here. The operator should complete this section before production deployment if contractual processor information is available.
11. International transfers
The Data Protection Act contains safeguards concerning transfers outside Kenya. Whether a transfer occurs depends on where the actual host, email provider and any future service providers process data. Because those vendors were not supplied for this build, this policy does not claim that data remains exclusively in Kenya. The operator should verify transfer locations and safeguards.
12. Retention
Contact messages should be kept only for as long as reasonably necessary to answer the enquiry, maintain an appropriate record of the correspondence or meet a lawful requirement. Sarnio does not define an invented fixed retention period where the operational mailbox policy has not been supplied. Server-log retention is controlled by the hosting configuration.
13. Security
The site uses input validation, a honeypot field, CSRF protection and a simple anti-repeat interval for the contact form. No website can guarantee absolute security. The operator should keep PHP, the web server and hosting software patched and use HTTPS in production.
14. Your rights
The ODPC describes Kenyan data-subject rights including the right to be informed of how personal data is used, access personal data held by a controller or processor, object to processing, correct false or misleading data, and request deletion of false or misleading data. Other rights and procedures may apply under the Act and Regulations depending on the processing.
To make a privacy request relating to data held by this website, contact [email protected]. The operator may need to verify identity before disclosing or changing personal data.
15. Direct marketing
The current site does not provide a newsletter signup and does not use contact-form details for direct marketing. If direct marketing is introduced, the site should provide the notices, consent or other conditions, and opt-out mechanisms required by Kenyan law before sending marketing communications.
16. Children
Sarnio is written for adults. It is not designed as a service for children and does not intentionally create child profiles. If the operator learns that a child has submitted personal data through the general contact form, the situation should be reviewed promptly in accordance with applicable law.
17. Automated decision-making and profiling
This release does not use automated decision-making to make decisions about visitors and does not profile visitors for health, insurance, credit or advertising purposes.
18. Third-party links
The current release intentionally contains no outbound affiliate or commercial links in the interface. If external references are added later, those third parties will have their own privacy practices, which should be reviewed independently.
19. Complaints
If a concern cannot be resolved through the website contact, individuals in Kenya may have the right to raise data-protection concerns with the Office of the Data Protection Commissioner. This policy does not reproduce or hard-code regulator contact details so they can be checked from the ODPC's current official channels when needed.
20. Changes to this policy
We may revise this policy when the site changes, new integrations are enabled or legal requirements change. The “Last updated” date will be changed when a substantive revision is published.
21. Contact
Privacy questions: [email protected]. Contact address: Bogani East Road, off Langata South Road, Langata, Nairobi, Kenya. Phone: +254 722 808 193.