Version 2026-06-13.2·Effective 12 June 2026
This Privacy Policy describes how GENO Wellness Ltd. ("GENO", "we", "us") handles your information when you use the GENO Wellness Hub — the website (genoessence.com), customer web app, and the GENO Wellness mobile app (collectively, the "Service"). GENO is incorporated in Kenya and primarily serves the East African Community (EAC).
The Short Version:
If you use the GENO Steps app or the GENO Provider app, separate per-app privacy policies apply:
| Data Controller | GENO Wellness Ltd. (Kenya) |
| Registered Office | Nairobi, Kenya |
| Primary Regulator | Office of the Data Protection Commissioner (ODPC), Kenya |
| privacy@genoessence.com | |
| Web | https://genoessence.com/privacy |
| Purpose | Lawful Basis (Kenya DPA, s. 30) |
|---|---|
| Running your account, matching you with providers, processing bookings | Performance of our contract with you |
| Charging your payment method and routing earnings to providers | Performance of our contract with you |
| Personalizing recommendations, programs, and reminders | Performance of our contract with you |
| Sending the reminders, session updates, and account notifications you opted in to | Your consent |
| Detecting and preventing fraud, abuse, or platform-rule violations | Our legitimate interest |
| Investigating bugs and security incidents | Our legitimate interest |
| Sending account emails (security alerts, password resets) | Our legitimate interest |
| Marketing emails about GENO products | Your consent (off by default) |
| Complying with tax, AML, and law-enforcement obligations | Legal obligation |
When you book a session, the provider sees your display name, photo, the service, the time, and any booking notes you wrote. They do not see your payment details, your other bookings, or your account email unless you choose to share them.
We may disclose information when required by the Kenya Revenue Authority, the Uganda Revenue Authority, the Tanzania Revenue Authority, the Rwanda Revenue Authority, a valid court order, an ODPC order, or an equivalent order from a competent authority. Where the law permits we will notify you first.
If GENO is acquired or restructured, your information may transfer to the acquirer under the same privacy commitments. We will notify you in advance.
We take the security of your personal data seriously and apply technical and organisational measures appropriate to the risk, including:
No internet service can guarantee perfect security. If we ever discover a personal-data breach that is likely to result in a risk to your rights, we will notify the ODPC and, where required, you, within the timeframe set by section 43 of the Kenya DPA.
We keep personal data only as long as we need it, or as long as the law requires.
When you delete your account we erase your profile, wellness entries, and personal identifiers within a reasonable period. Transaction records that tax law requires us to keep are isolated from the live service.
Some of the service providers we work with operate from outside the EAC, which means your personal data may be transferred outside Kenya. We only work with providers that contractually commit to data-protection standards equivalent to or better than the Kenya DPA, and we add additional safeguards as required by sections 48–49 of the Kenya DPA and equivalent provisions in Uganda, Tanzania, and Rwanda.
Under section 26 of the Kenya Data Protection Act, 2019 you have the right to be informed of, access, correct, delete, object to or restrict the processing of, and receive a copy of your personal data. Equivalent rights apply across the EAC.
You can exercise these rights inside the Service: Settings → Privacy to delete your account, Settings → Notifications to control consent, Settings → Export My Data for a JSON export. Other requests go to privacy@genoessence.com.
If you believe we have mishandled your data you can complain to the ODPC (https://www.odpc.go.ke) or the equivalent authority in your country.
The Service is not directed at children under 13. Under section 33 of the Kenya DPA, "child" means anyone under 18. If you are under 18 and resident in Kenya, Uganda, Tanzania, or Rwanda, you may use the Service only with the consent of a parent or guardian, who may at any time request access, rectification, or deletion of your data via privacy@genoessence.com.
If you use the Service from the European Union, the United Kingdom, the United States or another jurisdiction with its own data-protection law, the protections described above are extended to you under your local law (EU GDPR, UK GDPR, CCPA / CPRA or equivalent). We rely on Standard Contractual Clauses for cross-border transfers to the United States and we do not "sell" or "share" your personal information for cross-context behavioural advertising.
The web version of the Service uses only first-party cookies to keep you signed in and remember your preferences. We do not use third-party advertising cookies, behavioural-tracking pixels, or session-recording tools.
We may update this Policy. The "Effective" date is updated whenever a new version is published. For material changes we will show you the new policy inside the Service and ask you to acknowledge it before continuing, and email the address on your account in advance.
GENO Wellness Ltd. Nairobi, Kenya
This privacy policy is published in English. If you read it in another language and notice a discrepancy, the English version prevails.
Effective from the "Last updated" date shown at the top of this page.
