Privacy Policy

This Privacy Policy is the single canonical privacy and data protection notice for godsway-sackey.org, direct professional communications with Godsway Sackey, and the public software applications published directly by Godsway Sackey. It explains clearly what information is processed, where data resides across static webpages and applications, and what choices and rights apply.

1. Identity of Operator and Scope

This website and its published portfolio applications are operated by Godsway Sackey, practising as an independent consultant and software developer based in the Republic of Ghana across digital health and health informatics, monitoring, evaluation and programme reporting, data analytics and business intelligence, research and digital data systems, software development, and implementation consultancy.

Godsway Sackey operates as an individual independent professional and is not a large software corporation, law firm, licensed healthcare facility, bank, deposit-taking financial institution, pension trustee, or regulatory authority.

This policy applies to:

• The personal professional profile, applications catalogue, site principles, and application information pages hosted on https://godsway-sackey.org;
• Direct professional inquiries, scoping discussions, and email correspondence sent to info@godsway-sackey.org; and
• Public Progressive Web Applications (PWAs) published and operated directly by Godsway Sackey under *.godsway-sackey.org subdomains (including church.godsway-sackey.org, store.godsway-sackey.org, qualicode.godsway-sackey.org, extract.godsway-sackey.org, emr.godsway-sackey.org, and wealth.godsway-sackey.org), except to the extent supplemented or superseded by a specific in-app notice or a separate written client contract.

This policy does not govern third-party websites, independent external institutions, mobile money networks, regulated pension trustees, or software installations deployed and controlled independently by client organisations.

2. Categories of Information Collected and Processed

Depending on how you interact with the website, consultancy practice, or published applications, the following categories of information may be processed:

• Professional Inquiries and Email Correspondence: Your name, email address, organisation, role, telephone number (if volunteered), and the content of messages sent to info@godsway-sackey.org.
• Consultancy and Contract Information: Contact details, project scoping records, statements of work, deliverables, invoicing details, and professional communications arising from formal advisory, training, analytics, or custom software engagements.
• Technical Connection and Security Metadata: When your browser requests pages, fonts, or application assets, hosting and content-delivery infrastructure processes standard network data including IP addresses, request timestamps, requested URLs, HTTP status codes, browser and operating-system User-Agent strings, referrer headers, and network security/bot-mitigation signals. IP addresses and connection logs can constitute personal data or online identifiers under applicable data protection laws and are not treated as automatically anonymous.
• Functional Browser Storage and Cookies: Local browser mechanisms (such as localStorage, IndexedDB, Service Worker caches, and strictly necessary edge security headers or cookies) described in Section 8.
• Application Setup and Operational Data: Information entered into published software applications, which differs markedly between local operational records and initial onboarding/account metadata as detailed in Section 5.

3. Processing Purposes and Legal Bases

Personal information is processed only for defined, proportionate purposes:

• Responding to Inquiries and Pre-Contractual Scoping: Replying to emails, evaluating consultancy requests, and preparing proposals (lawful basis: taking steps at your request prior to entering into a contract, consent, or legitimate professional interests).
• Performing Contracted Engagements: Delivering agreed consultancy, analytics, M&E, training, or custom software services and managing client administration (lawful basis: performance of a contract).
• Website Delivery, Security, and Abuse Prevention: Serving static pages and PWAs reliably, mitigating denial-of-service or unauthorized access attempts, and diagnosing technical faults (lawful basis: legitimate interests in system security and availability).
• Application Setup, Product Improvement, and Consented Follow-Up: Recording Terms/Privacy acknowledgement during initial application setup, understanding aggregate software adoption to improve functionality, and — solely where a user in Ghana explicitly ticks consent during setup — providing advisory or referral follow-up (lawful basis: explicit consent where applicable, and legitimate interests in maintaining functional software).
• Authenticated Access and Entitlements: Verifying user identity, facility membership, or licence entitlements in applications that incorporate remote sign-in or optional encrypted backup (lawful basis: performance of a requested service or institutional contract).
• Legal and Regulatory Obligations: Retaining necessary tax, accounting, or compliance records and responding to lawful requests by competent authorities (lawful basis: compliance with legal obligations).

These bases correspond to the conditions for lawful processing under Section 20 of Ghana's Data Protection Act, 2012 (Act 843) and, where European Union or United Kingdom data protection law applies to cross-border interactions, Article 6(1)(a), (b), (c), and (f) of the EU/UK General Data Protection Regulation (GDPR).

4. Data Minimisation and Security Safeguards

Information collection is intentionally minimised to what is reasonably necessary for communication, professional service delivery, or application functionality. Technical and organisational safeguards proportionate to an independent consultancy include HTTPS/TLS encryption in transit, restrictive HTTP security headers (X-Content-Type-Options, X-Frame-Options, Referrer-Policy, and Permissions-Policy), local 6-digit PIN workstation lock screens within portfolio applications, cryptographic envelope utilities where implemented (such as AES-256-GCM routines for portable backups or vaults), and restricted access to administrative accounts.

No internet transmission, web browser storage layer, or personal device can be guaranteed to be completely immune from compromise, malware, physical theft, or accidental data loss. Users remain responsible for securing the devices and browsers on which they run applications.

5. Published Applications and User Data Architecture

Because different pages and applications operate differently, data handling depends on which service you use:

5.1 Static Portfolio Webpages

The profile homepage (/), applications catalogue (/products/), site principles (/about/), and individual application overview pages are static informational webpages. They do not require user registration and do not host public comment or upload forms.

5.2 Locally Stored and Session-Based Application Records

Public portfolio PWAs (Church, Store, QualiCode, Extract, EMR, and Wealth) are designed around local-first operation so day-to-day domain records — such as congregation directories, retail inventory and receipts, qualitative project structures, document transcriptions, clinical register entries, and savings scenarios — are processed directly within your browser or device memory rather than uploaded to a central multi-tenant cloud database during ordinary offline use.

Storage persistence and export capabilities vary by application and current release milestone:

• Some applications (such as Church) persist operational state locally on your device (using browser localStorage or local device files) across browser restarts and provide structured CSV exports and encrypted JSON backup/restore utilities.
• Other applications or preview/foundation modules currently hold operational records in active browser session memory or local storage according to their development stage, or gate unfinished modules (for example, guarded transcript/coding workspaces in QualiCode or direct manual text transcription in Extract where embedded on-device OCR is not bundled). Not every application currently provides permanent disk persistence, anonymous zero-setup access, or full CSV/JSON export across all screens.

5.3 Initial Device Setup and Optional Advisory Consent

When initializing public portfolio PWAs, users complete a local 6-digit PIN setup screen requiring confirmation of these legal terms and region selection (Ghana active market or International evaluation). Where network connectivity and the onboarding intake service are active, the application may transmit limited setup metadata — specifically the application identifier, chosen administrator display username, region flag, Terms/Privacy acceptance indicator, explicit marketing/advisory consent status, and (in Wealth, if selected) the chosen pension trustee name — to support functional improvements and, for consenting users in Ghana, advisory or referral follow-up. Underlying operational records (such as church member lists, shop sales, clinical entries, or research notes) are not included in onboarding metadata.

5.4 Applications with Accounts, Remote Authentication, or Synchronisation

Certain specialised clinical or multi-user editions (such as facility-enrolled health systems) and optional paid cloud services (such as licence activation or opt-in encrypted cloud backup, where enabled) require verified accounts, identity tokens (for example, via Firebase Authentication / OIDC), facility invitation verification, or remote API communication. Those features cannot be used anonymously or purely offline during account verification, enrollment, or cloud synchronisation.

5.5 Client-Managed Installations

Where an organisation engages Godsway Sackey to customise, deploy, or configure software on the client's own servers, cloud accounts, or institutional devices, the client organisation determines the purposes and means of processing its operational data and acts as the data controller under applicable law.

5.6 Separately Operated Third-Party Services

External resources referenced inside an application — such as Mobile Money USSD shortcodes dialled directly on your mobile network, National Pensions Regulatory Authority (NPRA) licensed corporate trustees, or external websites — are operated by independent third parties under their own terms and privacy policies.

6. Regulatory Framework and International Privacy Rights

Data protection practices are guided primarily by the laws of the Republic of Ghana, specifically the Data Protection Act, 2012 (Act 843) overseen by the Data Protection Commission (DPC) of Ghana.

Where visitors or users interact from outside Ghana and foreign privacy laws apply by operation of law — such as the European Union General Data Protection Regulation (EU GDPR), the United Kingdom GDPR and Data Protection Act 2018, the California Consumer Privacy Act as amended by the California Privacy Rights Act (CCPA/CPRA), or comparable national laws — core principles of transparency, purpose limitation, data minimisation, and individual rights are respected proportionately. Publishing this notice provides transparent disclosure of actual practices; it does not constitute a representation or legal certification of formal registration or compliance under every foreign statutory regime worldwide.

Subject to applicable statutory conditions, exemptions, and identity verification, individuals may have the right to:

• Confirm and Access: Request confirmation of whether Godsway Sackey holds personal data about you and obtain access to a copy or description of that data (Act 843, ss. 32 & 35; GDPR Art. 15);
• Correction / Rectification: Request correction or updating of inaccurate, incomplete, or out-of-date personal data (Act 843, s. 33; GDPR Art. 16);
• Deletion / Erasure or Blocking: Request deletion, erasure, or restriction of personal data where retention is no longer necessary or processing is unlawful (Act 843, ss. 33 & 44; GDPR Arts. 17–18);
• Objection and Direct-Marketing Opt-Out: Object to processing likely to cause unwarranted substantial damage or distress (Act 843, s. 39; GDPR Art. 21) and exercise an unconditional right at any time to stop processing for direct marketing or advisory follow-up (Act 843, s. 40);
• Withdraw Consent & Data Portability: Withdraw previously given consent at any time without affecting prior lawful processing, and request structured portability where legally applicable (GDPR Arts. 7 & 20); and
• Supervisory Complaints: Lodge a complaint with the Data Protection Commission of Ghana (dpc.gov.gh) or, where applicable, the competent data protection supervisory authority in your habitual jurisdiction.

California Notice: Godsway Sackey does not "sell" personal information or "share" personal information for cross-context behavioral advertising as defined under the CCPA/CPRA.

Local-Device Limitation: Where application records are stored exclusively in your own device's browser storage or local files, Godsway Sackey has no remote technical access to inspect, correct, export, or delete those records on your behalf; you exercise direct control over them on your device.

7. Hosting, Service Providers, and International Transfers

To deliver a fast, resilient website and web applications, verified third-party infrastructure providers are used:

• Cloudflare, Inc.: Static website and PWA hosting (Cloudflare Pages), DNS, TLS encryption, content delivery network (CDN) caching, and DDoS/edge security mitigation;
• Google Fonts (Google LLC): Delivery of web font files (IBM Plex Sans) requested directly by visitors' browsers on static webpages;
• Google Firebase Authentication: Identity and email verification services used solely within specific applications or portals that require authenticated user sign-in; and
• Email Hosting Infrastructure: Standard mail servers handling correspondence sent to and from info@godsway-sackey.org.

Because Cloudflare, Google, and email infrastructure operate globally distributed servers located outside Ghana (including in Europe, North America, and other regions), technical connection metadata, authentication requests, and emails may be routed and processed internationally. Data does not remain exclusively within physical servers in Ghana. Reputable infrastructure providers and encrypted HTTPS transport are used to protect data during cross-border transmission.

8. Cookies, Browser Storage, and Analytics

Godsway Sackey uses website hosting and edge security services that may process technical connection and security information to defend against automated abuse, DDoS attacks, and unauthorized access. Google Search Console is used at domain level to understand how public pages appear in Google Search, including search impressions, search clicks, crawl indexing, and technical performance; Search Console domain verification is performed via DNS and does not itself require or deploy Google Analytics visitor-tracking code.

The public profile and application showcase pages (godsway-sackey.org) do not use Google Analytics 4 (GA4), Google Tag Manager, Meta Pixel, or commercial advertising-tracking technologies. For aggregate page performance and privacy-preserving visitor counts, Cloudflare Web Analytics is enabled at the hosting edge; this service operates without client-side cookies, does not profile visitors across external websites, and measures strictly aggregated metrics.

Standalone applications in the portfolio operate on an offline-first architecture and utilize client-side browser storage technologies according to each application's specific capabilities:

• Service Workers & Cache Storage: Used to precache application shells, fonts, and scripts so installed Progressive Web Apps (PWAs) can reliably open and function offline without internet access;
• IndexedDB & Local Storage (localStorage): Used as the primary local data vault (with AES-256-GCM encryption on sensitive databases such as Church, Store, and EMR) to persist user records, transactions, rosters, and configuration on your device; and
• Firebase Authentication Browser Storage: Used only when you choose to sign in to an optional cloud account, securely holding session tokens locally in application-isolated storage to authenticate optional encrypted cloud sync.

Non-essential analytics, cross-site trackers, or commercial advertising technologies will not be introduced without appropriate prior disclosure and any legally required visitor consent controls.

9. Storage, Retention, and Deletion

• Email Inquiries and Consultancy Records: Retained for the duration needed to respond to your inquiry, manage an ongoing professional relationship or contract, and meet applicable statutory, tax, accounting, or legal-claim limitation periods, after which records are securely deleted or archived.
• Onboarding and Advisory Consent Records: Where transmitted, setup and consent records are kept only while relevant to software administration, consent verification, or requested advisory follow-up, and are removed or suppressed from follow-up promptly upon opt-out or deletion request.
• Infrastructure Security Logs: Retained temporarily by Cloudflare and mail infrastructure in accordance with their standard security log rotation schedules.
• Local Browser and Device Data: Remains on your device until you delete records inside the application, clear your browser's site data/storage, close an ephemeral/private browsing session, or uninstall the PWA. Clearing browser storage or closing non-persistent sessions permanently erases unexported local data.

10. Sensitive, Research, and Clinical Information

Digital health workflows (EMR and clinical editions), congregation registries (Church, which may reflect religious affiliation), and qualitative research workspaces (QualiCode) can involve special or sensitive categories of personal data under Section 37 of Ghana's Data Protection Act, 2012 (Act 843) and international laws.

Publicly accessible web builds are provided for evaluation, educational review, or local user-managed operation. Using any software for real clinical care, Ghana Health Service / DHIMS2 reporting, or human-subjects research requires appropriate institutional authorisation, ethical/IRB clearance where applicable, physical device security, and compliance with sector regulations. This general portfolio Privacy Policy does not replace a healthcare facility's patient privacy notice, institutional clinical governance, or a formal written Data Processing Agreement (DPA) where Godsway Sackey is contracted to support an institution.

11. Exercising Your Rights and Contacting the Operator

To ask a question about this Privacy Policy, withdraw marketing or advisory follow-up consent, or submit a request to access, correct, or delete personal information held directly by Godsway Sackey, please email info@godsway-sackey.org with the subject line Privacy Request.

Please describe your request clearly and include only the minimum contact information (such as the email address or application display username used) needed to locate relevant records and verify your identity. Verified requests are addressed promptly in accordance with applicable statutory timelines under Ghana's Act 843 and other relevant laws.

12. Changes to This Privacy Policy

This policy may be updated periodically to reflect changes in published applications, infrastructure, or legal requirements. Any updated version will be published at https://godsway-sackey.org/privacy-policy/ with a revised "Last Updated" date. Where a change materially alters how personal data under Godsway Sackey's control is processed, prominent notice will be posted on the website or within affected applications prior to or upon the change taking effect.