Privacy Policy

Effective date: October 8, 2026
Last updated: October 9, 2026

This Privacy Policy explains how GrowthNest MEL Strategies LLC ("GrowthNest," "we," "us," or "our"), based in Castro Valley, California, collects, uses, shares, and protects information when you visit growthnestmelstrategies.net or growthnestmelstrategies.info, use our consulting services, or use AfyaHub EMR, our cloud-based electronic medical records software-as-a-service (SaaS) platform, and its related portals (together, the "Services").

1. About AfyaHub EMR and Our Role

AfyaHub EMR is a subscription SaaS platform used by healthcare facilities, clinics, and their authorized staff to manage patient records, clinical workflows, and related administration. Our role depends on the data involved:

• Customer facility data (patient and clinical data). Healthcare facilities that subscribe to AfyaHub EMR ("Customers") decide what patient information is entered and why. For this data, the Customer is the data controller (covered entity), and GrowthNest acts as a data processor (business associate) that processes the data only on the Customer's behalf and under our agreement with them.
• Account and website data. For information about the people who use our website and sign in to the platform (such as staff user accounts), GrowthNest is the data controller.

If you are a patient and want to access or correct your health record, please contact the healthcare facility that treats you. We will assist the facility in responding to your request.

2. Information We Collect

Information you provide

• Contact details such as name, email address, phone number, organization, facility, and role.
• Information you submit through forms, consultation bookings, emails, or messages.
• Order and payment information when you purchase products or services. Payments are processed by third-party payment providers; we do not store full card numbers.
• User account information for AfyaHub EMR staff users, such as name, work email, role and permissions, and login credentials.

Customer data processed through AfyaHub EMR

On behalf of Customers, the platform stores and processes information entered by authorized users, which may include patient demographics, visit and encounter records, clinical notes, diagnoses, medications, laboratory and imaging results, billing and insurance information, and uploaded documents.

Information collected automatically

• Device and usage data such as IP address, browser type, pages viewed, and referring pages.
• Security and audit logs that record sign-ins and access to records, used to protect accounts and support Customer compliance.
• Cookies and similar technologies, described in Section 9.

Information from Google

If you choose to sign in with Google or connect a Google account to the Services, we receive only the Google account information and the specific data covered by the permissions (scopes) you approve on Google's consent screen. This may include your name, email address, and profile picture. We request only the access needed to provide the feature you are using.

3. How We Use Information

• To provide, operate, secure, and support our consulting services and AfyaHub EMR.
• To authenticate users, manage roles and permissions, and prevent unauthorized access.
• To process Customer data solely to deliver the Services to that Customer, as instructed by the Customer.
• To respond to inquiries, schedule consultations, and send service-related communications.
• To process transactions and deliver digital products.
• To maintain, troubleshoot, and improve the Services, and to detect and prevent fraud or abuse.
• To comply with legal obligations.

We do not use patient or clinical data for advertising or marketing, and we do not sell it. We send marketing emails only where permitted by law, and you can unsubscribe at any time.

4. Google User Data and Limited Use

GrowthNest's use and transfer of information received from Google APIs to any other app will adhere to the Google API Services User Data Policy, including the Limited Use requirements. Specifically:

• We use Google user data only to provide or improve user-facing features that are visible in the app's interface.
• We do not sell Google user data.
• We do not use Google user data for advertising, including retargeting or interest-based advertising.
• We do not allow humans to read Google user data unless we have your affirmative consent for specific data, it is necessary for security purposes or to comply with applicable law, or the data is aggregated and anonymized for internal operations.
• We do not transfer Google user data to third parties except as necessary to provide the user-facing features, to comply with law, or as part of a merger or acquisition with notice to you.

You can revoke our access to your Google account at any time at myaccount.google.com/permissions.

5. How We Share Information

We do not sell your personal information. We share information only with:

• Service providers (subprocessors) that help us operate the Services, such as cloud hosting, storage, e-commerce, payment processing, scheduling, email, and analytics providers. They may use the information only to perform services for us and are bound by confidentiality and data protection obligations.
• AI service provider. Some optional AI-assisted features in AfyaHub EMR send clinical text to Google's Gemini service to generate a result for the user. Patient names and record numbers are removed from the text before it is sent.
• Customers. Customer data is accessible to that Customer's authorized users. We do not make one Customer's data available to another Customer.
• Legal and safety recipients when required by law, legal process, or to protect the rights, property, or safety of GrowthNest, our users, or others.
• Successors in connection with a merger, acquisition, or sale of assets, with notice to affected users.

6. Health Information and Data Protection Law

Our public website and marketing pages are not intended to collect health information. Please do not send patient health information through contact forms or general email.

Within AfyaHub EMR, health information is sensitive personal data. We process it in accordance with the Data Protection Act, 2019 of Kenya and the agreement between GrowthNest and the Customer. Where required, we enter into business associate or data processing agreements with Customers that set out the purpose of processing, confidentiality, security, and data return or deletion obligations.

Registration with the Office of the Data Protection Commissioner (Kenya)

The entities that support AfyaHub EMR are registered with the Office of the Data Protection Commissioner (ODPC) of Kenya as Data Processors, in the sector "Human health and social work activities":

• MEL GENERAL SUPPLIERS (our Kenya entity): ODPC registration number INST-593749DF642. Purpose: hosting and maintaining the EMR system, service delivery, billing, account management, and technical support for AfyaHub EMR.
• GrowthNest MEL Strategies LLC: ODPC registration number INST-411702613CE. Purpose: electronic medical record services for healthcare facilities.

7. Data Security

We use administrative, technical, and organizational safeguards designed to protect information, including:

• Encryption in transit (HTTPS with HTTP Strict Transport Security) and AES-256-GCM encryption of patient data with separate keys for each facility.
• Row-level security so that each facility can access only its own data.
• Role-based access control, and a required second authentication factor for clinical and administrative roles.
• A tamper-evident, append-only audit log of access to records.
• Secrets and credentials kept in a managed secret store, and encrypted database connections.

No method of transmission or storage is completely secure, so we cannot guarantee absolute security. If we become aware of a breach affecting your information, we will notify affected Customers and the Office of the Data Protection Commissioner as required by law.

8. Data Retention and Deletion

We keep account and website information only as long as needed for the purposes described in this policy or to meet legal, accounting, or reporting requirements. Customer data is retained for the duration of the Customer's subscription and as set out in our agreement with them, including any medical-records retention periods that apply to the Customer. After a subscription ends, we return or delete Customer data as the agreement provides, unless the law requires us to keep it. You may ask us to delete your account information by contacting us below.

9. Cookies and Analytics

We and our service providers use cookies and similar technologies to keep the Services working, remember preferences, and understand how they are used. You can control cookies through your browser settings. Where required, you can also manage your choices on our Your Privacy Choices page.

10. Your Rights and Choices

Depending on where you live, including Kenya under the Data Protection Act, 2019 and California under the CCPA/CPRA, you may have the right to be informed about how your data is used, to request access to, correction of, or deletion of your personal information, to object to or restrict certain processing, and to opt out of the sale or sharing of personal information. We do not sell personal information. For patient health records, please contact your healthcare provider. To make a request about information we control, contact us using the details below and we will respond as required by law. You also have the right to lodge a complaint with the Office of the Data Protection Commissioner of Kenya.

11. Children's Privacy

Our websites are not directed to children under 13, and we do not knowingly collect their personal information through them. Records of minor patients in AfyaHub EMR are entered and controlled by the treating Customer facility.

12. Data Location and Transfers

Patient and clinical data processed through AfyaHub EMR is hosted on Google Cloud infrastructure in South Africa (Johannesburg), and database backups are kept in the same region. Clinical text sent to the optional AI-assisted features described in Section 5 is processed by Google, with patient names and record numbers removed, and may be processed outside Kenya. Website, consulting, and account information that we control as a data controller is processed in the United States, where GrowthNest is based, and by our service providers in the countries where they operate. Where personal data is transferred outside Kenya, we apply the safeguards required by the Data Protection Act, 2019 and its Regulations.

13. Changes to This Policy

We may update this policy from time to time. The "Last updated" date above shows when it was most recently revised. Material changes will be posted on this page.

14. Contact Us

GrowthNest MEL Strategies LLC
Castro Valley, California, USA
Email: info@growthnestmelstrategies.com
Phone: +1 (510) 630-8681