Privacy Policy
This policy explains what Organlaxo collects, why it is collected, how it is handled, and the choices available to people using this site.
Last updated: 6 October 2026
1. Scope and identity
This policy applies to organlaxo.store and the forms and browser-storage features operated on it. No legal company name, company registration number or tax identifier has been supplied for the site, so this policy does not invent one. The website uses the Organlaxo brand. Contact: [email protected], +254 712 123 456, Viking House, Ground Floor, off Waiyaki Way, Nairobi, Kenya.
2. Kenya data-protection framework
Where the Kenya Data Protection Act 2019 and related rules apply, personal data should be handled lawfully, fairly and transparently, for explicit and legitimate purposes, and limited to what is necessary. The Office of the Data Protection Commissioner (ODPC) describes rights including being informed, access, objection, correction and deletion in circumstances provided by law.
3. Data you provide
The contact form asks for name, email address, subject and message. The form also uses a hidden honeypot field to reduce automated spam. We ask users not to submit detailed medical records, identification documents, financial information or emergency medical requests.
4. Why contact data is processed
Contact data is used to receive, route and respond to the message, maintain reasonable records of correspondence, protect the site against abuse, and address legal or privacy requests. The destination configured for the form is the site email inbox. It is not configured to send leads to an affiliate network.
5. Technical data
Like most websites, the hosting environment may create standard server logs such as IP address, request time, requested path, user-agent and error information for security, troubleshooting and service operation. The exact retention period is determined by the hosting configuration and should be reviewed by the deployer.
6. Cookies and local storage
The current site does not configure GA4, GTM, Cookiebot, reCAPTCHA or Google Maps. A small browser localStorage value named organlaxo-consent remembers whether the user dismissed the essential-only privacy notice. This preference is stored on the user’s device. See the Cookie Policy for more detail.
7. Analytics and advertising technology
No GA4 Measurement ID, GTM container, Cookiebot ID or advertising tag has been supplied. The code contains configuration hooks, but an empty configuration does not load those services. This policy should be reviewed before any analytics or advertising technology is activated.
8. Affiliate tracking
The declared business model is affiliate publishing, but no affiliate partner or monetised outbound URL is currently configured. Therefore this site does not currently claim that affiliate click identifiers or partner tracking are being transmitted. If monetised links are introduced, this policy and the Affiliate Disclosure should be updated before or at deployment.
9. Recipients and processors
Personal data may be handled by the site operator and by service providers necessary to host the website and email. No CRM, affiliate lead buyer, reCAPTCHA provider, maps provider or analytics vendor is configured in the supplied build. Hosting and email vendors chosen at deployment may act as processors or independent controllers according to their terms.
10. International transfers
Whether data leaves Kenya depends on the hosting and email services selected at deployment. The Kenya data-protection framework places conditions on transfers outside Kenya. The deployer should identify actual providers and document the safeguards or lawful basis used where cross-border transfers occur.
11. Retention
Contact messages should be retained only as long as reasonably necessary to answer the enquiry, manage follow-up, protect against abuse or meet applicable legal requirements. The site does not define an artificial universal retention period because the actual mailbox and hosting settings are not known.
12. Security
The supplied contact form uses server-side validation, CSRF protection and a honeypot. Security also depends on HTTPS, supported PHP, hosting permissions, mail configuration, backups and access control. No website can promise absolute security.
13. Your rights
Subject to applicable law and relevant exceptions, you may ask what personal data is held about you, request correction, object to certain processing, or request deletion. ODPC guidance also describes rights to be informed and to access personal data. Requests can be sent to [email protected].
14. Complaints
If you believe your personal data has been handled contrary to applicable Kenyan data-protection law, you may raise the issue with the site first and may also contact the Office of the Data Protection Commissioner through its official channels.
15. Children
This health-information site is intended for adults. The contact form is not designed to knowingly collect personal data from children. If information from a child is identified, it should be handled according to applicable Kenyan requirements and removed where appropriate.
16. Third-party links
The current production build contains no active affiliate destination. If future editorial references link to external websites, those sites will operate under their own privacy practices.
17. Changes
This policy may be updated when the site’s technology, hosting, partners or legal obligations change. Material changes should be reflected in the date above and, where appropriate, in the consent interface.
18. Contact
Email: [email protected]. Phone: +254 712 123 456. Address: Viking House, Ground Floor, off Waiyaki Way, Nairobi, Kenya.