Privacy policy

1. Who we are

beale horton Health (full registered entity name and company type) is a health system operating in Ghana. Our registered office is at registered office address and our operational base is in Accra, Ghana.

For the purposes of the Data Protection Act, 2012 (Act 843) we are the data controller for the personal data described in this notice. Our registration with the Data Protection Commission of Ghana is registration number and status — confirm before publishing.

2. What this notice covers

This notice explains what personal data we collect when you use our website, attend one of our care locations, take part in an employer- or school-sponsored program, wear an ORTON exposure sensor, or communicate with our WhatsApp assistant. It also explains the rights you have over that data and how to exercise them.

It does not cover the separate privacy practices of organisations we work alongside, including partner clinics, employers who sponsor screening programs, and Cocoa360. Where those organisations act as data controllers in their own right, their own notices apply.

3. Personal data we collect

Information you give us

• Name, date of birth, sex and contact details, including telephone number.
• Appointment and enrollment details, including the location you attend and the program or employer through which you were referred.
• Records of the consent you have given, and of any consent you withdraw.
• Messages, questions and feedback you send us by email, telephone or WhatsApp.

Health and clinical information

• Clinical history, symptoms, examination findings, diagnoses and care plans.
• Test and screening results, and medicines prescribed or dispensed.
• Notes recorded by clinicians and by Community Care Guides.

Exposure monitoring data

Where you have been issued an ORTON sensor, the device records environmental exposure measurements associated with you. The specific measurements collected, their frequency, and whether any location data is recorded are exact sensor data fields, sampling frequency and whether location is captured.

Messages through our WhatsApp assistant

Our assistant sends reminders and check-in messages, and receives your replies. WhatsApp is operated by Meta, which processes message delivery under its own terms and privacy policy — we do not control that processing. What we retain from these conversations, and how long for, is what WhatsApp conversation content is stored on our systems and for how long.

Website information

• Server log data such as IP address, browser type, pages requested and the time of the request.
• Cookies and similar technologies. The cookies this site currently sets are cookie inventory — confirm what the site actually sets, including any analytics.

4. Why we process your data

We process personal data in order to:

• provide clinical care, and arrange and follow up appointments;
• identify and monitor exposure-related health risks;
• contact you about your care, including reminders and results;
• run screening and prevention programs sponsored by employers, schools and community partners;
• meet legal, regulatory and public-health obligations in Ghana;
• understand and improve our services, and support research where you have agreed to it or where the data has been properly de-identified.

Act 843 requires that processing be lawful, limited to a stated purpose, and carried out with your knowledge. In most cases we rely on your consent. We may also process data where it is necessary to protect your vital interests, to comply with a legal obligation, or to carry out a task in the public interest.

5. Health and other special personal data

Information about your physical or mental health is special personal data under Act 843 and attracts additional protection. We process it only where you have given explicit consent, or where the Act otherwise permits it — for example to protect your vital interests in an emergency, or for medical purposes carried out by a health professional under a duty of confidentiality.

6. Who we share data with

We share personal data only where it is necessary, and only with:

• Clinicians and care teams involved in your care, including partner clinics and referral hospitals.
• Service providers who process data on our behalf under contract, such as hosting, messaging and IT providers. The current list is list of data processors and sub-processors.
• Regulators and public authorities where we are legally required to report, for example notifiable disease reporting.

We do not sell personal data, and we do not share it for third-party advertising.

7. Processing outside Ghana

Some of the systems we use may store or process data outside Ghana. Act 843 places conditions on processing personal data originating in Ghana in a foreign jurisdiction. The countries involved, and the safeguards applied, are destination countries and the legal basis and safeguards for each transfer.

8. How long we keep data

We keep personal data only as long as necessary for the purpose it was collected, or as long as the law requires. Clinical records are subject to statutory minimum retention periods in Ghana. Our retention schedule is retention periods by record type, including clinical records, sensor data and WhatsApp messages.

9. How we protect data

We are required to take reasonable steps to protect personal data against loss, damage and unauthorised access. Our measures include access controls, staff confidentiality obligations and training, encryption of data in transit, and restrictions on who may view clinical records. Further detail, including encryption at rest and our breach-response process, is security control summary and incident response process.

No system is completely secure. If a breach occurs that is likely to affect you, we will notify you and the Data Protection Commission as required.

10. Your rights under Act 843

Subject to the conditions in the Act, you have the right to:

Be informed

Know whether we hold personal data about you, and why.

Access your data

Ask for a copy of the personal data we hold about you.

Correction and deletion

Ask us to correct data that is inaccurate, or to delete or block data that is inaccurate, irrelevant, excessive, or held without a lawful basis.

Object to processing

Object to processing that is likely to cause you unwarranted damage or distress.

Stop direct marketing

Ask us to stop using your data to send you marketing.

Automated decisions

Ask that decisions significantly affecting you are not based solely on automated processing.

Withdraw consent

Withdraw consent you have given, without affecting your access to care.

To exercise any of these rights, contact us using the details below. We will respond within response time commitment — confirm against the statutory period. We may ask you to verify your identity first. There is no charge for making a request in most cases.

11. Children and young people

Where we provide care to a child, or run a program through a school, we process the child's data with the consent of a parent or guardian, except where the law allows otherwise. Our approach to the age at which a young person may consent for themselves is age of self-consent applied, and how school-program consent is obtained and recorded.

12. Changes to this notice

We may update this notice. The date at the top shows when it was last changed. Where a change materially affects how we use your data, we will take reasonable steps to tell you directly.

13. Complaints and contact

If you have a question about this notice, or want to exercise your rights, contact us first — we would rather resolve it directly.

You also have the right to complain to Ghana's supervisory authority, the Data Protection Commission, which can investigate how we handle personal data. Its current contact details are Data Protection Commission address, telephone and website — verify before publishing.