Privacy policy

1. WHO THIS POLICY COVERS

This Privacy Policy explains how Mapomuden ("Mapomuden", "we", "us") collects, uses, shares, and protects personal data when you use mapomuden.com as a patient, practitioner, or other user. It applies to data we process as the data controller under Ghana's Data Protection Act, 2012 (Act 843).

2. INFORMATION WE COLLECT

Account information: your name, email address, phone number, and password.

Health and clinical information: information you or your practitioner record in connection with your care, including consultation history, clinical notes, prescriptions, diagnostic requests and results, allergies, conditions, and medications. This is sensitive personal data and is handled with the additional safeguards described in section 5.

Identity and credential documents: for practitioners, the licence, qualification, and identity documents submitted for verification. For patients, identity documents where required for a specific service (for example, a controlled prescription).

Payment information: when you pay through our payment partner, your card or mobile money details are collected and processed by that partner, not stored by Mapomuden. For manual mobile money payments, we record the transaction reference you submit and the amount, not your mobile money PIN or full account credentials.

Messages and communications: messages you send through the platform's messaging feature, and records of notifications (SMS, email, push, and in-app) sent to you.

Usage and device information: pages you visit, actions you take, your IP address, device and browser type, and similar technical data, collected to keep the platform secure and working correctly.

3. HOW WE USE YOUR INFORMATION

We use your information to: create and manage your account; let you book, manage, and pay for appointments; let practitioners record and access the clinical information needed to treat their own patients; process payments and provider payouts; send appointment reminders and other service notifications; verify practitioner credentials; investigate fraud, abuse, or security incidents; and meet our legal and regulatory obligations.

We do not use your health information for advertising, and we do not sell your personal data to third parties.

4. OUR LEGAL BASIS FOR PROCESSING

We process your personal data on the basis of: your consent, which you give when you register and which is recorded against the specific consent documents in effect at the time; the need to perform our contract with you (providing the booking, payment, and communication services you sign up for); and our legal obligations, including recordkeeping requirements that apply to financial and, where applicable, health records.

5. HOW WE PROTECT YOUR INFORMATION

Sensitive documents (including identity and credential documents) are encrypted at rest. Access to clinical records is restricted to the patient, the practitioners they have an active care relationship with, and platform staff who need it to operate the service, and is logged. Uploaded documents may be scanned for malware before being stored. Passwords are never stored in plain text, and administrative accounts are required to use two-step verification.

No system is completely secure, and we cannot guarantee absolute security, but we take these steps to reduce the risk of unauthorised access, loss, or misuse of your data.

6. WHO WE SHARE INFORMATION WITH

We share information with: the practitioner(s) you book an appointment with, to the extent needed for your care; our payment partner, to process card and mobile money payments; our SMS and email delivery providers, to send you notifications; and regulators, law enforcement, or courts, where we are legally required to. We do not share your clinical information with any practitioner you have not booked with, and we do not share it with advertisers.

7. HOW LONG WE KEEP YOUR INFORMATION

We retain account and clinical records for as long as your account is active and for a period afterward to meet legal, financial, and recordkeeping obligations, after which they are deleted or anonymised. Specific retention periods are set out in [INSERT: retention schedule once confirmed] and may differ for financial records, which are typically kept longer to meet accounting and tax obligations.

8. YOUR RIGHTS

Under Ghana's Data Protection Act, 2012, you have the right to: know what personal data we hold about you; request a copy of it; request correction of inaccurate data; request deletion of your data, subject to our legal obligation to retain certain records; withdraw consent you previously gave, where processing is based on consent; and object to certain processing. To exercise any of these rights, contact us at [INSERT CONTACT EMAIL]. You also have the right to complain to Ghana's Data Protection Commission if you believe we have not handled your data properly.

9. CHILDREN AND DEPENDANTS

The platform is intended for use by adults. A parent or guardian may create a profile on behalf of a minor or a dependant in their care and is responsible for the information submitted on that profile.

10. INTERNATIONAL TRANSFERS

Some of our service providers (including our payment partner and notification providers) may process data outside Ghana. Where this happens, we require that provider to protect your data to a standard consistent with Ghanaian data protection law.

11. COOKIES AND SIMILAR TECHNOLOGY

We use a session cookie to keep you signed in and to protect your account against unauthorised access. We do not use advertising or tracking cookies.

12. CHANGES TO THIS POLICY

We may update this Privacy Policy from time to time. A new version is published with a new version number and effective date. Material changes affecting how we use your health information will be brought to your attention, and may require renewed consent where required by law.

13. CONTACT US

For privacy questions, access requests, or complaints, contact [INSERT CONTACT EMAIL]. If you are not satisfied with our response, you may contact Ghana's Data Protection Commission.