Privacy Policy

1. Data Controller and Processor Roles

Ascend Wellness provides a cloud-based Software-as-a-Service platform. For business account owners (Directors and Branch Managers), Ascend Wellness acts as a Data Controller for account management and billing data. For client profiles, booking schedules, treatment records, and health notes created by wellness businesses, Ascend Wellness acts as a Data Processor under Kenya's Data Protection Act (2019).

2. Information We Collect

• Merchant Account Data: Business name, email address, mobile phone number, physical address, branch locations, and staff profiles.
• M-Pesa & Payment Transaction Data: M-Pesa phone numbers, checkout request IDs, M-Pesa receipt codes, transaction amounts, and timestamps processed via Safaricom Daraja / PayHero gateways. We do not store raw mobile banking PINs.
• Client Booking Data: Customer names, phone numbers, appointment dates, service history, and loyalty wallet balances.
• Sensitive Health & Clinical Notes (MedSpa Module): Patient consultation histories, procedure consent logs, treatment preferences, and aesthetic practitioner notes. These data categories are treated as sensitive personal data under Section 44 of the Kenya Data Protection Act.

3. Purpose of Data Processing

We process personal and financial information solely to provide software functionality, including:

• Facilitating instant appointment booking, SMS reminders, and client notifications.
• Processing M-Pesa STK Push payments, thermal receipt generation, and ledger accounting.
• Enabling branch operational management, commission calculations, and inventory tracking.
• Ensuring platform security, fraud prevention, and regulatory compliance.

4. Data Security and Confidentiality

All data transmitted to and from Ascend Wellness is encrypted using TLS 1.3 in transit and AES-256 at rest. Access to clinical notes and customer databases is governed by strict role-based access controls (RBAC) isolated per business tenant.

5. Data Sharing and Third Parties

We do not sell, rent, or trade merchant or customer data. Data is shared strictly with authorization for operational infrastructure:

• Payment Gateways: Safaricom M-Pesa Daraja and PayHero for transaction settlement.
• SMS Gateways: Licensed telecommunication providers in Kenya for dispatching automated appointment reminders.
• Legal Compliance: When required by Kenyan law enforcement or court orders under valid legal process.

6. Data Subject Rights (ODPC Kenya)

Under the Data Protection Act (2019), data subjects have the right to request access to, correction of, or erasure of their personal data. Requests can be submitted directly to our Data Protection Officer at dpo@ascendwellness.com.