Privacy Policy

DrDoGood Technologies Ltd. is the entity responsible for the personal data described in this policy.

• Registered address: Allotei Bulley, Asylum Down, Accra, Ghana
• Operating base: Allotei Bulley, Asylum Down, Accra, Ghana
• Other locations: Pilot Crescent, Lagos, Nigeria

For privacy questions, data access requests, or complaints, contact us at privacy@drdogood.health (Subject: "Privacy Request").

Where required by applicable law in a given country, we will designate a local privacy contact or representative and publish their details here.

DrDoGood is a healthcare access and payment platform. It connects you with independent, licensed healthcare providers and facilities in our network for virtual consultations (via video, audio, or chat) and in-person appointments, and it lets you pay for that care, order medications, and track health metrics you choose to log.

DrDoGood is not an insurer, and the Services are not a substitute for emergency care. If you are experiencing a medical emergency, contact your local emergency services immediately.

Our in-app AI health assistant, AIDA, and our voice assistant, Ama, provide general health information, triage-style guidance, appointment support, and answers to your questions. They are not a doctor, do not issue diagnoses or prescriptions, and any output they generate is informational only and is not a substitute for a consultation with a licensed provider. Diagnosis, treatment decisions, and prescriptions are made only by the licensed healthcare providers in our network.

Account and identity data

Name, date of birth, gender, phone number, email address, password (stored hashed/encrypted), profile photo, and language preference, collected when you register for an account as a patient, provider, facility administrator, or employer/HR representative.

Health data

This is the category most central to our Services, and we want to be specific about it. Depending on how you use DrDoGood, we may collect and process:

• Symptoms, medical history, allergies, and medications you enter into the app or describe to AIDA, Ama, or a provider
• Consultation records, including video/audio call metadata, chat transcripts, and clinical notes created by your provider during a virtual or in-person visit
• Diagnoses, treatment plans, prescriptions, and referrals issued by providers in our network
• Lab and diagnostic test orders and results, where a facility or lab submits these through the platform
• Vitals and health metrics you choose to log or connect (e.g., blood pressure, weight, blood glucose, heart rate)
• Insurance, NHIS, or employer health-plan information relevant to a visit or claim
• Pharmacy and medication order history
• Voice recordings and transcripts generated when you use the Ama voice assistant over phone, WhatsApp, or USSD
• Any other health-related information you voluntarily share with AIDA, Ama, a provider, or our support team

We collect this data because it is necessary to provide the care coordination, telemedicine, and payment functionality you're asking for — never for advertising, and never sold to third parties.

Payment and financial data

Payment card details (processed by our payment processor, not stored by us in full), mobile money account details (e.g., MTN MoMo), transaction history, billing address, and, for facilities, settlement and payout information.

Technical and usage data

IP address, device identifiers, device model and OS, app version, browser type, general location derived from IP address, crash logs, and in-app usage/interaction data (e.g., which features you use).

Communications data

Messages you send through in-app chat, SMS, WhatsApp, USSD, or our support channels, and the content of any calls placed through the Ama voice assistant.

Provider, facility, and employer data

For healthcare providers: license and credential information, specialty, practice details, and patient interaction records. For facilities: registration, staff, and dashboard usage data. For employer/wellness-pass partners: employee eligibility lists and aggregate utilization data (not individual clinical detail, unless the employee separately consents).

• Directly from you — when you register, book an appointment, complete an intake form, chat with AIDA, speak with Ama, message a provider, or make a payment.
• From your interactions with the platform — automatically, through app and website analytics, and technical logs.
• From healthcare providers and facilities in our network — who upload consultation notes, prescriptions, and results tied to your visit.
• From connected third parties — such as your mobile money provider (for payment confirmation) or, where you enable it, a wearable/health-tracking integration.
• From your employer or wellness-pass sponsor — limited to eligibility and enrollment data, if your access to DrDoGood is provided through a workplace benefit.

We use personal data, including health data, to:

• Create and manage your account and authenticate you
• Match you with a provider or facility and facilitate virtual or in-person appointments
• Enable providers to review your history, deliver care, and document consultations
• Process payments, mobile money transactions, and facility payouts
• Power AIDA and Ama so they can answer your questions, help you navigate care, and pass relevant context to your provider with your permission
• Send appointment reminders, medication reminders, and service notifications by app, SMS, WhatsApp, or USSD
• Maintain platform security, detect fraud, and prevent abuse
• Analyze aggregated, de-identified data to improve the Services and understand utilization trends for facility and employer partners
• Meet legal, regulatory, and record-keeping obligations applicable to healthcare and payment services in Ghana, Nigeria, and Kenya

We do not use your health data for advertising, and we do not sell personal data to third parties.

Because AIDA and Ama process health information directly, we hold them to the following standards:

• Optional and disclosed. AI-assisted features are presented clearly in the app; you can see when you are interacting with AIDA or Ama rather than a human provider.
• Data minimization. AIDA and Ama process only the health context needed to respond to your query or to support your visit (e.g., recent symptoms, chat history relevant to the current conversation).
• Human oversight. Any clinical decision — diagnosis, prescription, treatment plan, or referral — is made by a licensed human provider, not by AIDA or Ama. AI outputs offered directly to you are informational and always carry a reminder to confirm with a provider.
• Where processing happens. AIDA's underlying model is deployed on our own cloud infrastructure and third-party AI/ML hosting we contract with (see Data Storage, Security, and Subprocessors below). Ama's voice interactions are processed through our telephony and AI voice providers to convert speech to text and generate a response.
• Retention of AI conversation logs. Chat and voice transcripts with AIDA/Ama are retained as part of your health record for continuity of care and are subject to the same retention and deletion rights as the rest of your account data.
• Not used to train public models. Your conversations and health data are not used to train AI models that are made available to other users or the public, and are not shared with AI providers for their own independent purposes.

We process personal data on the following bases, as applicable under the data protection laws of Ghana (Data Protection Act, 2012, Act 843), Nigeria (Nigeria Data Protection Act, 2023), Kenya (Data Protection Act, 2019), and, where relevant, the laws of other jurisdictions where our users or partners are located:

• Performance of a contract — to create your account and deliver the core Services you request (booking, consultations, payments).
• Consent — for health data processing, AI-assisted features, marketing communications, and any optional integrations. You may withdraw consent at any time, without affecting processing carried out before withdrawal.
• Legal obligation — to comply with healthcare recordkeeping, tax, anti-money-laundering, and payment regulations.
• Legitimate interests — for security, fraud prevention, and service improvement, balanced against your rights and reasonable expectations.

Where local law classifies health data as a "special" or "sensitive" category requiring explicit consent, we obtain that consent before processing.

Storage and security

Personal and health data is stored on secure cloud infrastructure with encryption in transit (TLS) and at rest where supported, access controls limited to authorized personnel on a need-to-know basis, and logging of access to health records. We conduct periodic security reviews. No system is completely secure, and we encourage you to use a strong, unique password and keep your login credentials confidential.

Subprocessors and service providers

We share personal data only as necessary to operate the Services, with providers bound by written agreements requiring confidentiality and appropriate security. This includes, among others:

We may also disclose personal data where required by law, court order, or governmental request, or to protect the rights, safety, or security of DrDoGood, our users, or the public. If DrDoGood is involved in a merger, acquisition, or sale of assets, personal data may transfer as part of that transaction, subject to continued protection consistent with this policy.

Because DrDoGood operates across Ghana, Nigeria, and Kenya and uses cloud infrastructure and service providers that may be located outside your home country, your data may be transferred to and processed in other countries. Where we do this, we use appropriate safeguards (such as contractual data protection commitments with our processors) to ensure your data continues to receive an adequate level of protection.

We retain personal and health data for as long as your account is active and as needed to provide the Services, plus any additional period required by healthcare recordkeeping or financial regulations in the relevant country.

When you request account deletion, we delete or irreversibly anonymize your personal data within 30 days, except where we are required to retain certain records (e.g., clinical or financial records) for a longer period under applicable law. You can request deletion at any time by contacting privacy@drdogood.health or through in-app account settings.

Subject to applicable law in your country, you have the right to:

• Access the personal data we hold about you
• Correct inaccurate or incomplete data
• Delete your account and associated personal data, subject to legal retention requirements
• Withdraw consent for optional processing (e.g., AI features, marketing) at any time
• Object to or restrict certain processing
• Request a copy of your data in a portable format
• Lodge a complaint with your national data protection authority (e.g., Ghana's Data Protection Commission, Nigeria's Data Protection Commission, or Kenya's Office of the Data Protection Commissioner)

To exercise any of these rights, contact privacy@drdogood.health. We may need to verify your identity before acting on a request.

The Services are not directed at children under the age of 13, except where a minor's care is being managed by a parent or legal guardian through their own DrDoGood account (e.g., booking a pediatric consultation). We do not knowingly collect personal data directly from children outside that context. If we learn we have done so, we will delete it promptly.

Our website uses cookies and similar technologies to operate core functionality, remember preferences, and understand aggregate usage. You can control cookies through your browser settings. This does not affect data collected through the DrDoGood app, which is governed by the sections above.

We may update this Privacy Policy as our Services, technology, or legal obligations evolve. We will update the "Last updated" date above and, for material changes affecting how we handle health data, notify you in-app or by email before the change takes effect.

DrDoGood Technologies Ltd.

Email: privacy@drdogood.health

Subject line: "Privacy Request"

Continued use of the Services after an update to this policy constitutes your acknowledgment of the revised terms.