Privacy Policy

1. Information We Collect

1.1 Information You Provide Directly

When you create an account or use our features, you may provide:

• •Account information: first name, last name, email address, phone number, and password.
• •Profile information: gender, date of birth, and profile picture.
• •Mental health assessment responses: answers to PHQ-9, GAD-7, and other validated screening questionnaires administered through the Platform.
• •Bullying reports: details about incidents including descriptions, locations, dates, voice recordings, and your role in the incident (victim, witness, or offender).
• •Chat messages: conversations with our AI-powered wellness assistant.
• •Expert consultations: information shared during sessions with licensed mental health professionals.
• •Mood tracking data: daily mood entries and wellness check-in responses.

1.2 Information Collected Automatically

When you use the Platform, we may automatically collect:

• •Device information: device model, operating system, unique device identifiers, and app version.
• •Usage data: features accessed, session duration, interaction patterns, and navigation paths.
• •Network information: IP address and general location data (country/region level only).
• •Performance data: crash reports, error logs, and diagnostics to improve app stability.

1.3 Information from Third Parties

We may receive limited information from authentication providers if you choose to sign in through a third-party service. We do not purchase data from data brokers or other commercial sources.

2. How We Use Your Information

We use the information we collect to:

• •Provide and maintain the Platform, including account creation, authentication, and core features.
• •Deliver mental health assessments and generate personalised wellness insights and recommendations.
• •Facilitate bullying reporting and connect reports with appropriate administrative responses.
• •Power our AI wellness assistant with contextual, safe, and helpful responses.
• •Enable communication between users and licensed mental health experts.
• •Track mood patterns and provide longitudinal wellness analytics.
• •Send important notifications about your account, appointments, and safety alerts.
• •Conduct anonymised and aggregated research to improve mental health outcomes for students in Ghana.
• •Detect, prevent, and address technical issues, fraud, and security threats.
• •Comply with legal obligations and respond to lawful requests from authorities.

3. Data Storage and Security

We implement industry-standard technical and organisational security measures to protect your personal data:

• •Encryption: All data is encrypted in transit using TLS 1.3 and at rest using AES-256 encryption.
• •Authentication: Session tokens are stored as encrypted, HttpOnly, Secure cookies with SameSite protections.
• •Access controls: Role-based access control (RBAC) ensures only authorised personnel can access sensitive data.
• •Infrastructure: Our servers are hosted on Google Cloud Platform (GCP) in secure, SOC 2-compliant environments.
• •Monitoring: Continuous security monitoring and regular vulnerability assessments protect against threats.

4. Data Sharing and Disclosure

We do not sell, rent, or trade your personal information. We may share data only in the following limited circumstances:

• •Licensed experts: When you book a session with a mental health professional, relevant information is shared to facilitate your consultation.
• •University administrators: Aggregated and de-identified reports may be shared with the University of Cape Coast for institutional safety and wellness programme planning.
• •Service providers: Trusted third-party vendors (cloud hosting, analytics) that process data on our behalf under strict contractual obligations.
• •Legal requirements: When required by law, court order, or to protect the rights, safety, or property of BRAVE Ghana or its users.
• •Emergency situations: If we believe in good faith that disclosure is necessary to prevent imminent harm, self-harm, or danger to others.

5. Children's Privacy

BRAVE Ghana is designed to serve students, including those under the age of 18. We take additional care when processing the personal data of minors:

• •We collect only information that is necessary for the Platform's core mental health and anti-bullying functions.
• •Bullying reports may be submitted anonymously to protect the reporter's identity.
• •We do not display personal information of minors publicly.
• •Parents and guardians may contact us at any time to enquire about or request deletion of their child's data.

6. Your Rights

Depending on your jurisdiction, you may have the following rights regarding your personal data:

• •Right of access: Request a copy of the personal data we hold about you.
• •Right to rectification: Request correction of inaccurate or incomplete data.
• •Right to erasure: Request deletion of your personal data, subject to legal retention requirements.
• •Right to restriction: Request that we limit the processing of your data in certain circumstances.
• •Right to data portability: Request your data in a structured, commonly used, machine-readable format.
• •Right to withdraw consent: Withdraw your consent at any time where processing is based on consent.

To exercise any of these rights, please contact us using the details provided below. We will respond to your request within 30 days.

7. Data Retention

We retain your personal data only for as long as necessary to fulfil the purposes described in this Policy:

• •Account data is retained for as long as your account is active.
• •Assessment data and mood logs are retained to provide longitudinal insights and may be anonymised for research after 3 years.
• •Bullying reports are retained in accordance with university and institutional policies.
• •Upon account deletion, personal data is permanently removed within 90 days, except where retention is required by law.

8. Cookies and Tracking Technologies

Our mobile application uses essential session cookies for authentication purposes only. We do not use advertising cookies, tracking pixels, or third-party analytics cookies. Our website may use minimal analytics cookies (which do not track individual users) to understand general traffic patterns.

9. International Data Transfers

Your data may be processed on servers located outside Ghana (specifically within Google Cloud Platform's Europe West region). We ensure that any international transfer of personal data is protected by appropriate safeguards, including standard contractual clauses and the security measures described in Section 3.

10. Changes to This Privacy Policy

We may update this Privacy Policy from time to time to reflect changes in our practices, technology, or legal requirements. We will notify you of material changes by posting a notice within the app or sending a notification to your registered email address. Your continued use of the Platform after changes are posted constitutes acceptance of the updated Policy.

11. Governing Law

This Privacy Policy shall be governed by and construed in accordance with the Data Protection Act, 2012 (Act 843) of the Republic of Ghana and other applicable Ghanaian laws. Any disputes arising from this Policy shall be subject to the exclusive jurisdiction of the courts of Ghana.