Privacy Policy

1. Introduction

At GoodCitizen Company Limited (“we”, “our”, “us”), we take your privacy seriously. This policy outlines how we collect, use, and protect your data across our digital platforms and services — especially those integrated with Meta (e.g., WhatsApp Business).

2. Who We Are

We are a Ugandan software development firm focused on public health, governance, and community solutions since 2014.

3. Information We Collect

• Personal: Name, phone, email, organization.
• Sensitive: Health-related responses via MHPSS (with consent).
• Technical: Device info, IP, message metadata.
• Interaction: Chat logs, feedback, usage analytics.

4. How We Use Data

• Deliver health reminders, psychosocial support, surveys.
• Communicate securely via WhatsApp and SMS.
• Improve system performance and reporting.
• Meet obligations under MoH, UNICEF, and other partnerships.

5. Messaging Platforms and Third-Party Communication Tools

We use messaging platforms and third-party communication tools to deliver services and support to users. When you interact with us through these tools, we may collect basic contact information (such as your name and phone number) along with any content you voluntarily provide during the interaction.

We only use this information to provide relevant services, respond to inquiries, and improve user experience. We do not send unsolicited messages, and users must provide clear opt-in consent before receiving communications. An opt-out option is always available, allowing users to stop communications at any time.

6. MHPSS Chatbot on WhatsApp

Our MHPSS chatbot helps provide mental health support with strict privacy and consent protocols:

• Collects sensitive data only after explicit consent.
• Users can opt out anytime by sending STOP or equivalent.
• Data is encrypted in transit, stored securely, and handled with confidentiality.
• Used solely to deliver support and connect to mental health services—not for marketing.

7. Legal Basis for Processing

Our data practices align with Uganda’s Data Protection and Privacy Act, 2019, as enforced by the Personal Data Protection Office (PDPO) under the National Information Technology Authority – Uganda (NITA-U). We take all reasonable steps to ensure data subjects' rights are upheld in accordance with this legislation.

We rely on:

• Consent (especially for MHPSS).
• Public interest in health contexts.
• Contractual necessity with partners.
• Legitimate interest for system optimization and security.

8. Data Sharing

Your data may be shared with:

• Ministry of Health, UNICEF, and other health/donor partners.
• Secure cloud or technical service providers.
• Authorities when required by law.

9. Data Retention

We store personal data only as long as necessary for our services or as legally required. Health and MHPSS data follow minimal retention aligned with program guidelines.

10. Data Security

• Encryption in transit (TLS) and at rest.
• Access controls and role-based permissions.

11. Your Rights

You may also file a complaint with the Personal Data Protection Office (PDPO) under NITA-U if you believe your data rights have been violated. For more information, visit www.nita.go.ug.

You have the right to:

• Access, correct, or delete your data.
• Withdraw consent or object to processing.

To exercise these rights, contact us at gcinnovate@gmail.com.

12. Third‑Party Services

We integrate third-party platforms like RapidPro, Redash, or WhatsApp. These services have their own privacy policies. We encourage you to review them.

13. Updates to Policy

We may update this policy for legal, technical, or organizational reasons. Changes will be posted with the effective date.