Who this notice applies to
This Privacy & Data Protection Notice explains how the Case Hospital and its clinics (“we”, “us” or “our”) handles personal data collected through this website and related patient-facing services in Uganda. Separate clinical consent forms, insurance documents or service-specific notices may also apply when you receive healthcare or use a Case Med Insurance product.
For privacy questions or data-subject requests, email hospital@casemedservices.org with “Data Protection” in the subject line, call 0800 211 005, or write to Case Hospital and its clinics at Plot 69–71 Buganda Road, Kampala, Uganda.
Information we may collect
Depending on how you interact with Case Hospital or one of its clinics, we may collect:
- Identification and contact details such as your name, telephone number, email address, date of birth, address and next-of-kin or emergency-contact details.
- Appointment, referral and service-request information.
- Health information and medical records, including symptoms, diagnoses, medicines, allergies, investigations, imaging, laboratory results, treatment and follow-up information.
- Payment, billing, insurer, membership and pre-authorisation information where relevant.
- Communications, complaints, compliments and feedback you send to us.
- Website and device information such as browser type, approximate network information, pages visited and privacy preferences, where collected lawfully.
- Facility security information such as CCTV or access records where applicable.
- Recruitment or professional information if you apply for a role or interact with Case Hospital or one of its clinics in a professional capacity.
Case Hospital and its clinics seek to collect information that is relevant and reasonably necessary for the purpose for which it is requested.
Health and medical information
Health status and medical records require a high level of protection under Ugandan data-protection law. Case Hospital and its clinics process health information only where there is an appropriate legal basis, including where information is necessary to provide or arrange healthcare, where valid consent has been given, or where processing is otherwise authorised or required by law.
Appropriate members of a care team may need access to information relevant to diagnosis, treatment, referral, continuity of care, patient safety, billing or insurance administration. Access is limited to people who need the information for an authorised purpose.
Why we use personal data
We may use personal data to:
- Identify and register patients, respond to enquiries and manage appointments.
- Provide clinical care, investigations, referrals, treatment, pharmacy, diagnostic and follow-up services.
- Maintain medical records and support continuity of care and patient safety.
- Process payments, insurance, membership or pre-authorisation matters.
- Operate facilities, manage complaints and feedback, and improve service quality.
- Protect patients, staff, visitors, systems and facilities.
- Meet professional, regulatory, legal, audit, public-health or reporting obligations.
- Operate, secure and improve this website.
- Send optional health updates or service communications where an appropriate lawful basis exists and where required choices have been provided.
Children’s information
Case Hospital and its clinics provide healthcare to children and may therefore process children’s personal and health information. Where consent is legally required, Case Hospital and its clinics will seek the appropriate consent of a parent, guardian or other authorised person unless another lawful basis permits or requires the processing. Clinical teams may also consider the child’s age, maturity, best interests and applicable professional duties when communicating about care.
When information may be shared
Where necessary and lawful, Case Hospital and its clinics may share relevant information with members of your Case Hospital or clinic care team; referral hospitals, laboratories, diagnostic providers or other healthcare professionals; insurers or health membership organisations; emergency-service providers; authorised technology and operational service providers; professional advisers; and public authorities, regulators or law-enforcement bodies where disclosure is permitted or required by law.
Service providers processing personal data on behalf of Case Hospital and its clinics are subject to appropriate confidentiality, security and data-protection obligations. Case Hospital and its clinics do not intend to make patient medical information available to advertisers for their independent advertising use.
Processing outside Uganda
Some technology, communications or service providers may process or store information outside Uganda. Where personal data is transferred or stored outside Uganda, Case Hospital and its clinics will take steps required by applicable Ugandan law to ensure an appropriate level of protection, use suitable contractual or organisational safeguards, or obtain consent where required.
How long information is kept
Case Hospital and its clinics retain information for as long as reasonably required for the purpose for which it was collected, for continuity of care, to meet professional or legal obligations, or under an approved records-retention schedule. Medical records may need to be retained for substantially longer periods than ordinary website enquiries. When information is no longer required, Case Hospital and its clinics securely delete, destroy or de-identify it where appropriate.
Security and confidentiality
Case Hospital and its clinics use technical and organisational measures designed to protect personal data against accidental loss, unauthorised access, disclosure, alteration or unlawful processing. These measures may include access controls, role-based permissions, confidentiality obligations, secure systems, backups, logging, staff training and incident-response procedures.
No electronic system can be guaranteed to be completely secure. If Case Hospital and its clinics become aware of a personal-data incident, they will assess and respond to the incident in accordance with applicable law and internal procedures.
Your data-protection rights
Subject to applicable law and relevant exceptions, you may ask Case Hospital and its clinics to:
- Confirm whether personal data about you is being processed and provide access to information you are entitled to receive.
- Correct personal data that is inaccurate, incomplete or out of date.
- Explain the purposes for which information is being used and, where applicable, categories of recipients.
- Consider an objection to particular processing where the law gives you that right.
- Withdraw consent for future processing where the processing relies on consent.
Withdrawing consent does not affect processing that was lawful before withdrawal and may not prevent processing that Case Hospital and its clinics must continue for another lawful reason, including necessary clinical or legal obligations.
Marketing and service communications
Receiving optional promotional communications is not a condition of receiving healthcare. Where Case Hospital and its clinics ask you to opt in to marketing, that choice is separate from clinical consent. You can ask Case Hospital and its clinics to stop optional marketing communications at any time. Essential appointment, care, billing, safety or service messages may still be sent where necessary.
Cookies, embedded media and external services
This website uses a privacy-preference control and may use cookies or similar browser technologies. Necessary technologies support website operation and remember your privacy choices. The muted homepage background video uses YouTube's privacy-enhanced embed domain as part of the site presentation. Other optional external media such as article videos or Instagram embeds is not loaded until you allow External Media through Cookie Settings.
The site may also link to WhatsApp, Google Maps and social-media services. If you follow an external link, that provider will process information under its own terms and privacy practices. See our Cookie Policy for more detail.
Questions and privacy complaints
Contact Case Hospital or the relevant Case clinic first if you have a question or complaint about how personal data has been handled. Email hospital@casemedservices.org with “Data Protection” in the subject line or call 0800 211 005.
If a data-protection concern is not resolved, you may be able to raise it with Uganda’s Personal Data Protection Office (PDPO). Visit the PDPO complaint portal ↗