Privacy & Data Sovereignty

THEME processes personal data in line with the Uganda Data Protection and Privacy Act 2019. Sensitive application data is never indexed by public search engines. Zero third-party monetization of client records.

1. Data we collect

Account identifiers (email, phone), authentication events, and consent records.
CWD demographics and supporting files you or your consultant upload.
Assessment responses, scores, remarks, triage tags, and wellness assignments.
Technical logs for security and reliability (without placing full NIN/TIN in application logs).

2. How we use data

Data is used to deliver consultancy workflows, scoring, reports, notifications, content assignment, and audit of privileged access. Public website analytics cover traffic and approved non-sensitive events only.

3. Security controls

TLS in transit; encryption of sensitive data at rest.
Least-privilege role-based access across website, web app, and mobile.
No secrets stored in web/mobile clients; no hidden recording or clipboard monitoring.
Audit of access to NIN, TIN, property/will information, medical flags, and report publication.

4. Sharing and retention

Client records are shared only with authorised THEME roles (assigned consultant, supervisor, administrator) as required for service delivery. Retention follows operational and legal requirements; withdrawal and export requests are handled under the Client Consent Covenant.

5. Your rights

Subject to lawful restrictions, you may request access, correction, export, or withdrawal of consent. Contact privacy@themewellness.ug.