Privacy Policy

Last Updated: 9 August 2026

The Centre for Research in Therapeutic Sciences (CREATES) at Strathmore University respects your privacy. This notice applies to personal data collected through this website, including contact and collaboration enquiries, BRAINS impact surveys, and secure administration functions.

Who is responsible for your information

CREATES operates within Strathmore University. For information submitted through this website, CREATES and Strathmore University determine how the information is used for the stated institutional, research, communication, and administrative purposes.

Information we collect

Depending on how you use the website, we may collect your name, email address, telephone number, organization, enquiry details, survey responses, institution and mobility information, consent choices, and limited technical information such as browser details and a protected representation of your internet address used for security and submission controls. We do not intentionally collect payment information through this website.

How we use personal data

We use information to respond to enquiries; assess collaboration, training, and study requests; evaluate and improve the BRAINS programme; maintain submission integrity; protect the website from abuse; administer authorized content and survey records; meet applicable legal, ethical, contractual, and research obligations; and produce aggregated or de-identified programme insights where appropriate.

Our basis for processing

We process personal data where you have provided consent, where it is necessary to respond to a request or take steps you have asked us to take, where CREATES or Strathmore University has a legitimate institutional or research interest that does not override your rights, or where processing is required by law, research governance, or another applicable obligation.

Who may receive the information

Access is limited to authorized CREATES or Strathmore University personnel and service providers who support secure hosting, email delivery, database operations, spam prevention, and related website functions. Information may also be shared with an appropriate programme or institutional lead when needed to answer your request. We do not sell personal data.

Research and survey information

BRAINS survey responses are used to evaluate programme experience and impact. Identifiable responses are restricted to authorized administrators. Reporting should use aggregated or de-identified information unless a participant has been separately informed and an appropriate basis exists for another use. Participation is voluntary, and the consent statement presented with each survey remains part of the applicable collection notice.

Cookies and security services

The website uses strictly necessary session technology for secure administration. Public forms may use Cloudflare Turnstile to distinguish genuine submissions from automated abuse. Turnstile and infrastructure providers may process limited device and network information under their own privacy terms. The current public website does not use the visible search field to submit or store searches.

Retention and security

We keep personal data only for as long as it is needed for the purpose for which it was collected and to meet applicable legal, ethical, contractual, security, and research-record obligations. We use technical and organizational safeguards that include encrypted connections, access controls, protected administrator sessions, request validation, rate limiting, and restricted database access. No online system can be guaranteed to be completely secure.

Your rights

Subject to applicable law, you may ask to be informed about how your data is used, request access to it, ask for inaccurate or misleading data to be corrected, object to certain processing, withdraw consent where consent is the basis for processing, or request deletion where the law permits. Some records may need to be retained where a legal, ethical, contractual, or research obligation applies.

International access and service providers

Some approved partners or technology providers may process information outside Kenya. Where this occurs, CREATES and Strathmore University will apply the safeguards required by applicable data-protection law and institutional policy.

Changes to this notice

We may update this privacy notice when website functions, institutional practices, or legal requirements change. The latest revision date will be displayed on this page. Material changes will be communicated through an appropriate website or direct notice where required.