1. INTRODUCTION

Mpontuo Health Technologies Ltd ("MHT," "we," "us," or "our") is committed to protecting the privacy and security of your personal information. This Privacy Policy explains how we collect, use, disclose, and safeguard your information when you use our digital platforms, including AhotoCare (medicine and healthcare delivery), AhotoEats (food delivery), AhotoAgents (agent platform), AhotoRiders (rider platform), and our website at mhtechghana.com (collectively, the "Services").

This Privacy Policy is designed to comply with the Data Protection Act, 2012 (Act 843) of the Republic of Ghana and other applicable data protection laws and regulations.

By accessing or using our Services, you acknowledge that you have read, understood, and agree to be bound by this Privacy Policy. If you do not agree with our policies and practices, please do not use our Services.

2. DATA CONTROLLER

The data controller responsible for your personal data is:

3. INFORMATION WE COLLECT

3.1 Personal Information You Provide

We collect personal information that you voluntarily provide when you:

• Register for an account on any Ahoto Platform
• Place orders through AhotoEats or AhotoCare
• Book consultations or order medicines through AhotoCare
• Register as an Agent on AhotoAgents
• Register as a Rider on AhotoRiders
• Register as a Vendor on any platform
• Contact our customer support or participate in surveys

This information may include: full name, email address, phone number, physical address, date of birth, Ghana Card number, profile photographs, payment information (mobile money account, card details), driver's license (for Riders), business registration documents (for Vendors), and emergency contact information.

3.2 Health Information (AhotoCare)

When you use AhotoCare, we may collect sensitive personal data including:

• Medical history and health conditions
• Symptoms and health concerns
• Prescription information
• Consultation records and notes
• Laboratory results and blood bank records
• Insurance information

Health information is treated as sensitive personal data under the Data Protection Act and is processed with enhanced security measures and strict confidentiality.

3.3 Information Collected Automatically

When you access our Services, we automatically collect:

• Device information (device type, operating system, unique device identifiers)
• IP address and browser type
• Location data (GPS coordinates, with your consent)
• Usage data (pages visited, features used, time spent)
• Cookies and similar tracking technologies

4. HOW WE USE YOUR INFORMATION

4.1 Service Delivery

• Process and fulfill your orders and service requests
• Facilitate communication between customers, Vendors, Riders, Agents, and Healthcare Providers
• Process payments and prevent fraud
• Enable Agents to process orders and onboard Vendors/Riders
• Provide customer support and respond to inquiries

4.2 Safety and Security

• Verify identity of users, Vendors, Riders, and Agents
• Detect and prevent fraud, abuse, and security threats
• Monitor and enforce compliance with our Terms of Use

5. LEGAL BASIS FOR PROCESSING

Under the Data Protection Act, 2012 (Act 843), we process your personal data based on:

• Consent: Where you have given explicit consent for specific purposes
• Contract Performance: Where processing is necessary to perform our services
• Legal Obligation: Where processing is required by Ghanaian law
• Vital Interests: Where processing is necessary to protect someone's life
• Legitimate Interests: Where processing is necessary for our legitimate business interests

6. DISCLOSURE OF YOUR INFORMATION

We may share your personal information with:

• Service Providers: Vendors, Riders, Agents, Healthcare Providers, pharmacies, blood banks, laboratories, and insurance companies as needed to fulfill your orders and requests
• Payment Processors: Mobile money providers and financial institutions for payment processing
• Technology Partners: Cloud hosting and data storage providers
• Legal Authorities: Government authorities, law enforcement, or regulatory bodies when required by law
• Business Transfers: In connection with any merger, acquisition, or sale of assets

7. DATA RETENTION

We retain your personal information for:

• Active account information: Duration of your account plus a reasonable period thereafter
• Transaction records: Seven (7) years as required by Ghanaian tax law
• Health records (AhotoCare): Minimum ten (10) years in accordance with medical records requirements
• Agent and Rider records: Duration of contractor relationship plus five (5) years
• Marketing preferences: Until you withdraw consent

8. YOUR RIGHTS

Under the Data Protection Act, 2012 (Act 843), you have the right to:

• Access: Request a copy of the personal data we hold about you
• Rectification: Request correction of inaccurate or incomplete data
• Erasure: Request deletion of your personal data, subject to legal requirements
• Object: Object to processing for direct marketing purposes
• Withdraw Consent: Withdraw consent where processing is based on consent
• Complaint: Lodge a complaint with the Data Protection Commission of Ghana

9. DATA SECURITY

We implement appropriate technical and organizational measures to protect your data, including:

• Encryption of data in transit and at rest (SSL/TLS)
• Secure cloud hosting with redundancy and backup systems
• Access controls and authentication mechanisms
• Regular security assessments and employee training
• Incident response procedures for data breaches

10. COOKIES AND TRACKING

We use cookies and similar technologies to:

• Remember your preferences and settings
• Authenticate your identity and maintain session security
• Analyze usage patterns and improve our Services
• Deliver relevant content and measure effectiveness

11. INTERNATIONAL DATA TRANSFERS

Your personal information may be transferred to and processed in countries outside Ghana where our service providers are located. We ensure appropriate safeguards are in place to protect your information in accordance with the Data Protection Act.

12. CHILDREN'S PRIVACY

Our Services are not intended for children under eighteen (18). We do not knowingly collect personal information from children. If you believe a child has provided us with personal information, please contact us immediately.

13. CHANGES TO THIS POLICY

We may update this Privacy Policy from time to time. We will notify you of material changes by posting the updated Policy on our Platform and updating the Effective Date. Your continued use constitutes acceptance of the updated Policy.

14. CONTACT US

For questions about this Privacy Policy, contact us: