PRIVACY POLICY FOR SnAPP

1. Data Controller and Contact Information

The data controller responsible for your personal information is:

2. Information We Collect

We collect information to provide and improve the services offered by SnAPP, which focuses on nutrition assessment, child health monitoring, and VHT capacity building.

A. Information You Provide Directly

When you register for or use the App, you voluntarily provide us with the following personal data:

VHT Account Registration Data:

• Full Name
• Email Address
• Phone Number
• Assigned Village/Community
• Assigned Health Center
• Password (stored securely using one-way cryptographic hashing)

Child Registration Data:

• Child's Name
• Date of Birth
• Gender
• Parent/Caregiver Name and Contact Information
• Village/Community Location

Nutrition Assessment Data:

• Mid-Upper Arm Circumference (MUAC) measurements
• Weight and Height measurements
• Edema assessment results
• Nutrition status classifications (SAM/MAM/Normal)
• Growth chart data over time
• Photos of child's arm for AI-based MUAC measurement (processed locally and not stored permanently unless you choose to save them)

Referral Data:

• Referral notes and recommendations
• Selected health center for referral
• Follow-up status and outcomes

B. Information Collected Automatically

When you access and use the App, we automatically collect certain technical and usage data:

• Usage Data: Information about how you use the App, such as features accessed, assessment frequency, training modules completed, time and date of activity, and duration of sessions.
• Device Data: Information about the device you use to access the App, including device model, operating system version, unique device identifiers, mobile network information, and camera access permissions.

3. How We Use Your Information

We use the collected information for the following purposes:

1. Service Provision: To create and manage your VHT account, verify your identity, register children in your care, and provide you with access to the nutrition assessment tools, training modules, and other features of the App.
2. Nutrition Assessment and Child Health Monitoring:
   • To process the assessment data you submit through the App to generate nutrition status reports, growth charts, and health insights.
   • To improve the accuracy and performance of the AI-based MUAC measurement feature. Note: Any photos used for model training will be anonymized and stripped of identifying information.
3. Decision Support and Referrals: To provide automated recommendations based on WHO nutrition standards, identify nearby health centers, generate referral notes, and send SMS alerts to caregivers and health facilities.
4. VHT Training and Education: To deliver microlearning modules, track your certification progress, and provide culturally adapted nutrition education resources.
5. Communication: To send you technical notices, updates, security alerts, support messages, and training notifications. We may also send promotional communications about new features or training content (where you have opted in).
6. Public Health Analytics and Research: To monitor malnutrition trends, identify geographic hotspots, forecast nutritional crises, and generate insights for district health officers and public health planning. This helps optimize resource allocation and improve community health outcomes.
7. Security and Fraud Prevention: To protect the App, our users, children's data, and Empacode Africa Limited from fraudulent or illegal activities.
8. App Improvement: To analyze usage patterns, enhance functionality, and improve user experience for VHTs.

4. Legal Basis for Processing

We process personal data only when we have a valid legal basis, including:

• Contractual Necessity: The processing is necessary for the performance of the contract to provide the SnAPP services to you as a VHT.
• Legitimate Interests: The processing is necessary for our legitimate interests (e.g., child safety, public health monitoring, security, fraud prevention, improving services), provided these interests do not override the rights of individuals.
• Public Health Interest: Processing health data for public health purposes, including monitoring malnutrition, preventing health crises, and protecting vulnerable populations (children under 5).
• Consent: Where required by law, we will rely on your consent or the consent of parents/caregivers for children's data, which can be withdrawn at any time.

5. Disclosure of Your Information

We may share your information only in the following limited circumstances:

• Health System Partners: We share relevant child assessment data with district health officers, assigned health centers, and Ministry of Health officials to facilitate referrals, coordinate care, and support public health surveillance.
• Service Providers: We engage third-party companies to facilitate our services (e.g., cloud hosting, database management, SMS delivery, AI model training). These providers only have access to the information necessary to perform their functions and are bound by contractual confidentiality obligations.
• NGO and Development Partners: With your organization's permission, we may share aggregated program data with partners like UNICEF, WFP, or other implementing organizations for monitoring and evaluation purposes.
• Legal Compliance and Protection: We may disclose information if required to do so by law or in good faith belief that such action is necessary to comply with legal obligations, protect and defend the rights or property of Empacode Africa Limited, protect child safety, or protect the personal safety of users or the public.
• Business Transfers: In the event of a merger, acquisition, or sale of assets, your personal information may be transferred to the acquiring entity, subject to the same privacy protections.
• Anonymized Data: We may share aggregated or de-identified data (which cannot be linked back to individuals) with third parties for research, public health analysis, agricultural planning, or nutrition program improvement. This data helps inform better interventions but cannot identify specific children or VHTs.

6. Data Security

We implement appropriate technical and organizational measures designed to protect your personal data and children's health information from accidental loss and unauthorized access, use, alteration, or disclosure. These measures include:

• Data Encryption: Encrypting sensitive data both in transit (using SSL/TLS) and at rest (using industry-standard encryption).
• Offline-First Security: Data is stored securely on your device when offline and encrypted before syncing to our servers when internet is available.
• Access Control: Limiting access to personal and health data to authorized employees, VHTs, health officials, and contractors who need that information to operate, develop, or improve our services.
• Password Hashing: Storing passwords using secure, non-reversible cryptographic hashing algorithms.
• Photo Processing: Photos taken for MUAC measurement are processed locally on your device using AI. They are not automatically uploaded to our servers unless you explicitly choose to save them for record-keeping.

7. Data Retention

We retain personal information and child health data only for as long as necessary to fulfill the purposes for which it was collected, including:

• VHT Account Data: Retained while your account is active and for a reasonable period afterward to comply with legal, accounting, or reporting requirements.
• Child Health Records: Retained for up to 5 years after the last assessment or until the child reaches age 6, whichever comes first, to support longitudinal health monitoring and research. Parents/caregivers can request earlier deletion.
• Anonymized Research Data: May be retained indefinitely as it cannot be linked back to individuals.

If you delete your VHT account, your personal data will be deleted or anonymized within a reasonable period, except where retention is required by law or for child protection purposes.

8. Your Data Protection Rights

Depending on your jurisdiction, you and parents/caregivers may have the following rights regarding personal data:

• Right to Access: The right to request copies of personal data or child health records.
• Right to Rectification: The right to request correction of inaccurate or incomplete information (you can update child records directly in the App).
• Right to Erasure ('Right to be Forgotten'): The right to request deletion of personal data under certain conditions. Note: We may retain anonymized data for public health research.
• Right to Restrict Processing: The right to request that we limit the processing of personal data under certain conditions.
• Right to Object to Processing: The right to object to our processing of personal data under certain conditions.
• Right to Data Portability: The right to request a copy of child health records in a structured, commonly used format.

To exercise any of these rights, please contact us using the information provided in Section 1.

9. Children's Privacy and Protection

• Parental Consent: VHTs are required to obtain verbal or documented consent from parents/caregivers before registering children and conducting assessments.
• Minimal Data Collection: We collect only the health information necessary to assess nutrition status and provide appropriate care.
• Secure Storage: All child health data is encrypted and accessible only to authorized VHTs and health officials.
• Parent/Caregiver Rights: Parents and caregivers can request access to, correction of, or deletion of their child's data by contacting the VHT or our support team.

If you are a parent or guardian and have concerns about your child's data in SnAPP, please contact us immediately so we can address your concerns.

10. International Data Transfers

Your data may be transferred to and processed in countries outside of Uganda, including for cloud storage and AI model training. We ensure that adequate safeguards are in place to protect your data in accordance with applicable data protection laws.

11. Third-Party Services

The App may integrate with third-party services such as:

• SMS gateways for sending alerts to caregivers and health centers
• Mapping services for location-based referrals
• Cloud storage providers for data backup

These third-party services have their own privacy policies. We encourage you to review them. We are not responsible for the privacy practices of third-party services.

12. Changes to This Privacy Policy

We may update our Privacy Policy from time to time to reflect changes in our practices, technology, legal requirements, or other factors. We will notify you of any material changes by posting the new Privacy Policy in the App and updating the "Effective Date" at the top of this policy. For significant changes, we may also send you a notification via the App or email. You are advised to review this Privacy Policy periodically.

13. Your Consent

By using SnAPP, you consent to this Privacy Policy and agree to its terms. If you do not agree with this policy, please do not use the App.

14. Governing Law

This Privacy Policy is governed by the laws of Uganda. Any disputes arising from this policy will be subject to the exclusive jurisdiction of the courts of Uganda.

15. Contact Us

If you have any questions, concerns, or requests regarding this Privacy Policy or our data practices, please contact us at: