Privacy Policy
This policy explains what nortixa.online is designed to collect, what it deliberately does not collect, and how privacy requests are handled in the Kenya context.
Effective: 6 October 2026 · Last updated: 6 October 2026
1. Scope and site identity
This Privacy Policy applies to nortixa.online and the server-side contact form included with this website. Nortixa publishes educational information about prostatitis, chronic pelvic pain, urinary symptoms and related lifestyle topics. Nortixa is not presented as a clinic, medical practice or telemedicine service.
No legal company name, registration number or tax identifier has been provided for this site. We do not invent those details. The public site contact details supplied for this project are: Tubman Road, off Koinange Street, Trust Mansion, Nairobi, Kenya; +254 711 925 357; [email protected].
2. Personal data the site is designed to handle
The website does not provide user accounts, patient portals or a health-record database. The main deliberate collection point is the contact form. It asks for a name, email address, non-medical subject category and a short message. The purpose is to respond to website feedback, privacy requests, editorial corrections, technical issues or partnership enquiries.
The hosting environment may also generate ordinary technical logs such as IP address, request time, requested URL, browser/user-agent information and server error records. The exact hosting provider and log-retention settings are not configured in this package, so this policy does not invent a provider name or fixed log-retention period.
When the contact form is opened, PHP may create a short-lived session identifier used for CSRF protection. That identifier is not designed to contain health information.
3. Deliberate health-data boundary
Kenya's Data Protection Act 2019 defines health information and treats health status as sensitive personal data. The Act places specific restrictions on processing health data. Nortixa is not a healthcare provider and does not offer a confidential clinical communication channel. For that reason, the form is limited to non-medical matters and includes both user confirmation and a server-side screen for common health-related terms.
No automated filter can guarantee that a person will never paste sensitive information into a general message. If clearly personal health data is received accidentally, it is not intended to be used for diagnosis, treatment, profiling or marketing. It should be handled restrictively and removed when it is no longer necessary to deal with the accidental submission or a legal/security obligation.
4. Why contact data may be used
Contact data may be used to read and answer the message, verify or correct site content, respond to privacy requests, investigate technical problems, handle a legitimate business/partnership enquiry, maintain security and prevent abuse, or keep a limited record where needed to demonstrate how a request was handled.
The site is not configured to use contact-form messages to build advertising profiles. It is not configured to sell contact-form data. It is not configured with a customer relationship management platform or advertising audience upload.
5. Kenya data-protection framework
The relevant Kenyan framework includes the Data Protection Act, 2019 and the Data Protection (General) Regulations, 2021, administered and enforced by the Office of the Data Protection Commissioner (ODPC). Those rules address principles such as lawfulness, fairness, transparency, purpose limitation, data minimisation, accuracy, storage limitation and security, and they provide rights to data subjects.
The exact lawful basis for a particular contact interaction depends on why you contact the site. For example, responding to a request you initiate may involve steps requested by you, while security logging can involve legitimate operational and security needs. Where consent is used, it should be specific and capable of withdrawal subject to applicable legal limits.
6. Recipients and service providers
The form destination is email. A submitted message therefore relies on the hosting server's mail function and the mailbox used for [email protected]. No specific hosting company or email provider has been provided in the project input, so this policy does not name one.
Data may also be disclosed where required by applicable law, a lawful court order or a valid regulatory requirement. We do not describe routine sharing with advertising networks because no advertising or analytics integration is configured in this build.
7. International transfers
The website package itself does not specify where the future hosting server or email infrastructure will be located. If personal data is transferred outside Kenya, the operator should ensure that the transfer is handled in accordance with applicable provisions of the Data Protection Act and General Regulations, including safeguards required for cross-border transfers. Deployment should be reviewed once the actual hosting and email vendors are known.
8. Retention
We do not state an invented universal number of months. Contact messages should be retained only as long as reasonably necessary to answer the request, handle follow-up, preserve required business or legal records, or address security and dispute issues. Server logs are governed by the actual hosting configuration. Once the deployment environment is selected, operational retention settings should be documented and kept no longer than necessary.
9. Your privacy rights
Kenyan data-protection law provides data subjects with rights in relation to personal data, subject to statutory conditions and exceptions. Depending on the circumstances, these can include being informed about use of personal data, accessing personal data, objecting to certain processing, correcting inaccurate information, requesting deletion where the controller is no longer authorised to retain it, and seeking restriction of processing.
To make a privacy request about data held through this site, email [email protected] with enough non-medical information to identify the relevant contact interaction. Do not send additional health information as proof of identity.
You may also contact Kenya's Office of the Data Protection Commissioner if you believe your data-protection rights have been infringed.
10. Security and data minimisation
The site uses server-side validation, CSRF protection and a honeypot field on the contact form. Inputs are length-limited and output is escaped. These are reasonable baseline controls, not a claim of perfect security. Deployment security also depends on HTTPS, server updates, mail configuration, access controls and hosting practices that sit outside this source package.
The private symptom-note tool on the site is intentionally browser-only. It does not submit entries to the server and does not persist them in localStorage or a database. Reloading or leaving the page clears them.
11. Children
The site is written for a general adult audience seeking information about male urinary and pelvic health. It is not designed as a service for children and the contact form should not be used to submit a child's health information. Kenya's data-protection rules contain specific safeguards for processing children's personal data.
12. Analytics, advertising and cookies
No GA4 ID, GTM container, Cookiebot ID, reCAPTCHA key or advertising tag was provided for this build. Accordingly, those services are not active in the supplied code. The contact page may use a necessary PHP session cookie for form security. See the Cookie Policy for details.
13. External links
Editorial pages may link to official health or legal sources. Following an external link takes you to a separate service with its own privacy practices. External source links are not medical consultations and are not treated as affiliate links unless expressly labelled as such.
14. Changes to this policy
This policy should be reviewed whenever the site adds analytics, advertising, a new form destination, affiliate tracking, a user account, a hosting change with material privacy consequences, or any tool that processes personal data. The “last updated” date should change when the substance changes.
15. Contact
Privacy questions: [email protected]
Phone: +254 711 925 357
Address: Tubman Road, off Koinange Street, Trust Mansion, Nairobi, Kenya.