Privacy Policy

NCD Multi-Collaborative App ("NCD Collab", "the App") is a healthcare referral management and research platform supporting Non-Communicable Disease (NCD) facilities in the Ashanti Region of Ghana. The App facilitates patient referrals between health facilities and supports an NCD intervention research study on community response to NCDs.

This Privacy Policy explains how we collect, use, disclose, and safeguard information when you use our mobile application and associated web services. By using the App, you agree to the practices described in this policy.

Two distinct parties are responsible for this App and the data it processes. Understanding their roles is important for your rights under Ghana's Data Protection Act, 2012 (Act 843).

Data Controller / Research Principal

The App was commissioned by and is operated under the academic authority of:

• Name: Dr. Kwaku Gyamfi Oppong
• Role: Principal Investigator & Research Lead, NCD Intervention Study
• Institution: Kwame Nkrumah University of Science and Technology (KNUST), Ghana
• Contact: kgoppong@gmail.com

Dr. Oppong determines the purpose and scope of data collection within the App and is the Data Controller for the research study data collected through the platform.

Technical Developer & Data Processor / App Publisher

The App was designed, built, and is maintained by:

• Company: Trancova Systems Ltd
• Role: IT Consultant, Software Developer & App Publisher
• Published under: Trancova Systems Ltd Google Play Developer Account (by permission)
• Contact: support@trancova.com

Trancova Systems Ltd acts as the Data Processor, managing the technical infrastructure, cloud services, and app distribution on behalf of the Data Controller.

We collect the following categories of information:

A. Facility / Account Information

• Health facility name and region/district
• User role and job title (e.g. nurse, doctor, administrator)
• Registered email address and encrypted password
• Phone number (optional, for notifications)
• Account creation and last-login timestamps

B. Patient Referral Information

• Patient name, age, sex, and NCD diagnosis categories
• Referring and receiving facility identifiers
• Clinical notes, reason for referral, urgency level
• Referral status history and timestamps
• Attached clinical documents, photos, or PDF files

C. Study Participant Information (where applicable)

• Participant ID (de-identified within study data exports)
• Baseline and follow-up health measurements
• Community-level NCD response survey responses
• Consent status and withdrawal records

D. Biometric & Health Monitoring Data

• Blood pressure readings
• Blood glucose levels
• BMI / weight measurements
• Other NCD-related biometric observations recorded during clinical visits

E. Device & Technical Information

• Expo Push Notification Token — used to deliver referral alerts
• Device type indicator — used to determine notification capability
• Network connectivity status — used to enable offline referral queuing

Because NCD Collab is a healthcare application, it accesses and collects significant amounts of health-related data. The table below comprehensively discloses each health data type, why it is collected, and how it is used, in accordance with Google Play's User Data policy.

The App requests access to your device's camera and storage for the following specific purposes:

• Camera: Health workers may photograph patient documents, test results, or clinical notes to attach to a referral. You will always be prompted before camera access is used, and you may decline. Note: The App does not record, access, or upload videos. Camera functionality is explicitly blocked from video capture and is legally restricted to still images only.
• File storage (read): Allows selecting existing images or PDF documents from your device to attach to referrals.
• File storage (write): Temporary local storage of offline referral drafts pending network connectivity.

Photos and documents captured through the App are uploaded securely to Firebase Cloud Storage and are associated with the relevant patient referral record. They are not used for any purpose other than clinical documentation.

NCD Collab is a healthcare application and does not engage in any form of advertising. Specifically:

• We do not display any third-party advertisements in the App.
• The Google Advertising ID (GAID) is only used for non-advertising purposes, such as app analytics and performance monitoring via Google Firebase, ensuring the system remains stable and responsive for healthcare workers.
• We do not share any user data or device identifiers with advertising networks or marketing external parties.
• We will be explicitly blocking the AD_ID permission in future technical updates to further enhance user privacy.

We use the collected information to:

• Authenticate and manage health facility accounts
• Process and route patient referrals between health facilities
• Support clinical decision-making by preserving medical context
• Conduct the NCD intervention research study in the Ashanti Region of Ghana
• Track longitudinal biometric and health outcomes for study participants
• Send push notifications for new referrals and inter-facility messages
• Enable offline functionality when network connectivity is unavailable
• Maintain audit trails of referral status changes for accountability
• Improve the App's performance and reliability

We share information only in the following limited circumstances:

• Between participating health facilities: Referral data is shared with the designated receiving facility as a core function of the App.
• Research team: Anonymised or pseudonymised study participant data may be reviewed by authorised research personnel for the NCD study.
• Firebase / Google: Our infrastructure provider. Data is stored on Google Firebase (Firestore, Cloud Storage, Authentication). Google's privacy practices apply: policies.google.com/privacy.
• Legal requirements: We may disclose information if required by Ghanaian law, court order, or regulatory authority.

We do not sell, rent, or trade any personal or health information to third parties.

All data is stored on Google Firebase infrastructure, which provides:

• Encryption at rest and in transit (TLS 1.2 / HTTPS)
• Role-based access control via Firebase Security Rules
• Authentication-gated access — only verified facility accounts can access data

Offline referral drafts are stored locally on your device using AsyncStorage (protected by the device OS security layer). These drafts are automatically synced and removed from local storage upon successful upload.

We retain personal and health data for as long as needed to provide referral and research functions and to comply with applicable legal and clinical recordkeeping obligations in Ghana.

• Active facility account data (profile, messages, referrals): Retained for the duration of your active account and for a minimum of 5 years after account closure, in accordance with Ghanaian health records regulations.
• NCD research study data: Retained for the duration of the study and any required post-study period, typically 5–10 years, as mandated by applicable research ethics guidelines.
• Device / technical data (push tokens, connectivity logs): Retained only while the account is active. Deleted automatically upon account deletion.

You have the right to request the deletion of your account and associated personal data. To request deletion, please use our dedicated account deletion page:

How to Submit a Deletion Request

Email support@trancova.com with the subject line "Account Deletion Request" and include:

1. Your registered email address on NCD Collab
2. The health facility name linked to your account
3. A clear written confirmation that you want your account deleted

Deletion Timeline

After identity verification, deletion is processed within 30 days. You will receive a confirmation email once your account and associated data have been removed.

What Gets Deleted

• Your login credentials (email, password hashes)
• Your facility account profile
• All messages linked to your account
• Device tokens and technical data

Under Ghana's Data Protection Act, 2012 (Act 843), you have the right to:

• Access the personal data we hold about you
• Correct inaccurate or incomplete data
• Object to processing in certain circumstances
• Request deletion of your account data (subject to legal obligations)
• Withdraw consent for research participation (study participants)

To exercise any of these rights, please contact us using the details in Section 14 below.

The NCD Collab App is designed for use by registered health facility staff and is not directed at, nor intended for use by, individuals under the age of 18. We do not knowingly collect personal data from minors as end users of the App.

Patient referral data may include minor patients where clinically relevant; this data is handled with the same security and confidentiality standards as adult patient data.

We may update this Privacy Policy from time to time. Any changes will be posted on this page with an updated effective date. Material changes will be notified via the App or email where possible.

Your continued use of the App after any change constitutes acceptance of the updated policy.

If you have questions, concerns, or requests regarding this Privacy Policy or your data, please contact the relevant party below:

Research / Study Enquiries — Data Controller

• Name: Dr. Kwaku Gyamfi Oppong
• Institution: KNUST, Ghana
• Role: Principal Investigator & Data Controller
• Email: kgoppong@gmail.com

Technical, Account & App Support — Developer

• Company: Trancova Systems Ltd
• Role: IT Consultant, Developer & App Publisher
• Email: support@trancova.com
• Address: Hse No. 73, PawPaw Street, East Legon, Accra, Ghana

You also have the right to lodge a complaint with the Data Protection Commission of Ghana.