Privacy Policy

1. Information We Collect

When you interact with our business via the WhatsApp Cloud API, we collect and process specific pieces of personal and health information:

• Account and Contact Data: Your mobile phone number, WhatsApp display name, profile picture, and WhatsApp biography.
• Message Content & Metadata: The text, media, documents, and interactive selections you send to us, along with message timestamps, delivery status, and read receipts.
• Health and Medical Records (Special Personal Data): Depending on the nature of your request, we may collect, receive, and process health-related details, medical histories, symptoms, prescriptions, or laboratory results that you voluntarily share through the chat interface to receive our services.
• Interaction History: We link your WhatsApp interactions to your service account history with us.

2. Legal Basis and How We Use Your Information

Under Sections 7, 9, and 10 of the Uganda Data Protection and Privacy Act, 2019, health data is classified as Special Personal Data. We process this data based on your explicit, written, or recorded consent to fulfill specific health-related requests. We use this data to:

• Deliver Health & Wellness Services: To review your shared medical information, process health requests, provide care updates, or manage consultations.
• Manage Customer Support: Manage inquiries, resolve technical issues, and reply to your inbound messages.
• Send Service Notifications: Transmit automated updates such as appointment reminders, booking confirmations, or care alerts.
• Send Marketing Content: Only where you have provided prior, explicit opt-in consent to receive promotional broadcasts. We never use your health or medical data for marketing or profiling purposes.

3. Special Protections for Medical Data

We treat your health records with the highest level of professional and digital confidentiality:

• Access Control: Access to your health data within our backend systems is strictly restricted to authorized medical or case-management personnel who require it to process your specific requests.
• Data Isolation: Media files (such as images of prescriptions or medical reports) sent over WhatsApp are securely transferred directly to our encrypted storage environment and protected against unauthorized viewing.
• No Secondary Use: Your medical data will never be used for any purpose other than the specific, explicitly authorized service for which you provided it.

4. Data Architecture and Cross-Border Transfers

Our App communicates directly via the WhatsApp Cloud API hosted by Meta Platforms, Inc.

• Meta’s Role: Meta acts as our Data Processor. While your messages are securely encrypted using the Signal protocol during transit to Meta's infrastructure, they are unencrypted at our backend application endpoint so that our systems can process and fulfill your requests.
• Cross-Border Data Transfer: Meta's servers are located outside of Uganda (primarily in the United States and the European Union). In accordance with Section 19 of the Uganda Data Protection and Privacy Act, 2019, by opting into our WhatsApp services and providing your data, you explicitly consent to the cross-border transfer of your communication and health data to these secure international data centers.

5. Data Sharing and Third Parties

We do not sell, rent, or trade your personal or health data. We share your information only under the following conditions:

• Trusted Service Providers: We may share message payloads with secure Customer Relationship Management (CRM) tools, specialized health software, or cloud hosting providers that maintain stringent security certificates and comply with data protection laws.
• Legal Mandates: We will disclose data to the Personal Data Protection Office (PDPO) of Uganda, public health authorities, or law enforcement if required by a court order or statutory legal obligation.

6. Consent, Opt-In, and Opt-Out

• Explicit Consent: We will never send you unsolicited promotional WhatsApp messages without your prior opt-in.
• Immediate Opt-Out: You have the right to withdraw your consent to general communications at any time. You can stop receiving automated communications from us by replying with standard keywords like STOP, UNSUBSCRIBE, or CANCEL. Our system will process this immediately.

7. Data Retention and Destruction

We retain your WhatsApp chat logs and health data only for as long as necessary to fulfill the business or medical functions listed in this policy, or to comply with statutory Ugandan medical record retention laws. Once the retention period expires, your medical data is permanently and securely deleted or completely anonymized from our databases.

8. Your Data Subject Rights in Uganda

Under the Uganda Data Protection and Privacy Act, 2019, you hold specific rights regarding your personal and sensitive data:

• Right of Access: You can request confirmation of whether we hold your medical records and ask for a copy of your logs.
• Right to Rectification: You can request the correction of inaccurate, incomplete, or outdated data fields.
• Right to Erasure (Deletion): You can request that we delete your health data from our systems, subject to legal retention hold-backs.
• Right to Object: You can object to the processing of your data or withdraw your consent.

To exercise any of these rights, or to lodge an inquiry, please contact our team using the details below. You also hold the right to escalate complaints directly to the Personal Data Protection Office (PDPO) of Uganda (co-located at the National Information Technology Authority - NITA Uganda).

9. Contact Information

If you have any questions, compliance concerns, or privacy requests regarding our integration with the Meta WhatsApp Cloud API, please contact us:

• Company Name: GIA-NET SMC LIMITED
• Email: info@gianet.xyz
• Physical Address: Kirinya - Bukasa Road, Bukasa