Privacy Policy

1. Who We Are

Vallerian Medical Training College is a registered educational institution located at Sobea, Nakuru, Kenya. The WhatsApp Student Assistant is a self-service channel that allows enrolled students to access their academic and financial records via WhatsApp without needing to visit the institution in person.

Our website: https://vallerianmedicaltrainingcollege.ac.ke

2. Information We Collect

We collect only the information necessary to verify your identity and deliver the self-service features of the WhatsApp Assistant.

2.1 Information you provide directly

• WhatsApp phone number – transmitted automatically when you message us.
• Admission / registration number – submitted by you to identify your student record.
• One-Time Password (OTP) – submitted by you during identity verification.
• Message content – the text of messages you send to the assistant.

2.2 Information retrieved from college records

• Student name, course, and enrollment details.
• Fee ledger entries, outstanding balance, and payment history.
• Registered academic units / subjects.
• Published exam timetable entries.
• Contact details registered at the school (phone number, email address) used solely for OTP delivery.

2.3 Technical data collected automatically

• Message timestamps and WhatsApp message identifiers.
• Conversation state, session identifiers, and OTP attempt counters.
• Server-side audit log entries recording which features were accessed and when.
• Inbound message counts used for rate-limiting.

What we do not collect: We do not collect device identifiers, IP addresses of your mobile device, location data, profile photos, or any WhatsApp message metadata beyond what Meta transmits to us via the WhatsApp Business Cloud API webhook.

3. How We Use Your Information

We use your information exclusively for the following purposes:

We do not use your data for marketing, profiling, or any purpose unrelated to providing the student self-service described above.

4. OTP and Verification Data

One-Time Passwords are generated server-side and delivered to your registered contact details on file with the School. OTPs are valid for a limited period (15 minutes) and are stored only as a cryptographic hash — never in plain text — in our secure records and temporary session cache. Once a session is verified or the OTP expires, the hash is discarded. OTP delivery is handled through the School’s approved communication channels such as SMS or email.

5. Sharing of Information

We share your information only as described below and never sell your data.

5.1 Meta Platforms / WhatsApp

The Service is built on the WhatsApp Business Cloud API operated by Meta Platforms, Inc. When you send a message to the WhatsApp number operated by the School, that message is transmitted to Meta’s servers before being forwarded to our records through a secure webhook. Meta processes this data under its own Privacy Policy and Business Data Processing Terms. We do not control Meta’s data practices and encourage you to review their policies.

5.2 The School and its Staff

Audit logs (which feature you accessed and when) may be reviewed by authorised school administrators for security and support purposes. No staff member can read the content of your WhatsApp messages via the assistant interface.

5.3 Service Providers

Your data is hosted by trusted service providers that support secure school operations. These providers act as data processors under contractual obligations and are not permitted to use your data for their own purposes.

5.4 Legal requirements

We may disclose your information when required to do so by applicable law, court order, or governmental authority, or to protect the rights, property, or safety of the School, its students, or the public.

6. Data Storage and Security

• All data is stored within secure, access-controlled records.
• Connections between your device, WhatsApp, and our servers are encrypted in transit using TLS.
• OTP values are stored as bcrypt hashes and are never recoverable in plain text.
• Session data is stored in an encrypted server-side cache with a short time-to-live (15 minutes).
• Access to sensitive records is restricted to authorised personnel through role-based controls.
• Security events are logged and monitored for anomalous activity.

While we use strong safeguards, no service is completely immune to security threats. We will notify affected users and relevant authorities in the event of a data breach as required by applicable law.

7. Data Retention

8. Your Rights

Depending on the data protection law applicable in your jurisdiction, you may have the following rights regarding your personal data:

• Right of access – request a copy of the personal data we hold about you.
• Right to rectification – request correction of inaccurate data.
• Right to erasure – request deletion of your conversation and session data. Note that academic records are governed by the School’s records policy and legal obligations.
• Right to restriction – request that we limit processing of your data in certain circumstances.
• Right to object – object to processing based on legitimate interests.
• Right to data portability – request your data in a structured, machine-readable format.

To exercise any of these rights, contact us at info@vallerianmedicaltrainingcollege.ac.ke. We will respond within 30 days.

9. Requesting Deletion of Your Data

To request deletion of your WhatsApp conversation records and session data, send an email to info@vallerianmedicaltrainingcollege.ac.ke with the subject line “WhatsApp Data Deletion Request” and include your full name and admission number so we can locate and delete your records.

Requests will be processed within 30 days. Note that we may retain certain data where required by law, legitimate audit obligations, or to prevent fraud. Deleting your WhatsApp session data does not affect your official student records, which are managed under the School’s academic records policy.

10. Cookies and Tracking

The WhatsApp Assistant itself does not use cookies. If you visit the School’s website, standard web cookies may apply as described in any separate cookie notice on that site. This Privacy Policy covers only the WhatsApp channel.

11. Minors

The Service is intended for enrolled students of Vallerian Medical Training College. Where students are under the age of 18, the School operates under its standard safeguarding and data protection obligations applicable to minors. If you believe a minor’s data has been processed inappropriately, please contact us immediately.

12. Third-Party Services

This Privacy Policy applies only to data processed through the School’s WhatsApp Assistant. The WhatsApp application itself is governed by Meta’s Privacy Policy. We are not responsible for the privacy practices of Meta or any other third party.

13. Changes to This Policy

We may update this Privacy Policy from time to time to reflect changes in our practices, technology, or legal requirements. When we make material changes, we will update the “Last updated” date at the top of this page. Continued use of the WhatsApp Assistant after changes are posted constitutes your acceptance of the revised policy.

14. Contact Us

If you have questions, concerns, or requests relating to this Privacy Policy, please contact the School’s Data Protection officer at: