Privacy and Security Policy

We collect information you provide, information created while services are delivered, and limited technical information needed to operate and secure WALA. The information collected depends on whether you use WALA as a patient, prescriber, hospital, pharmacy, insurer, logistics provider or administrator.

Where information is required by law, for patient safety, or to provide a requested service, choosing not to provide it may prevent us from completing that service.

We process information only for defined and legitimate purposes, including to:

• create and secure accounts, verify identities, professional credentials and organisation authority;
• receive prescriptions, match availability, support patient choice, dispensing, payment or insurance decisions, delivery and settlement;
• communicate service updates, respond to support requests and maintain continuity of care;
• detect fraud, investigate misuse, manage risk, resolve disputes and preserve accurate audit records;
• meet healthcare, pharmacy, financial, tax, safety and data-protection obligations; and
• improve reliability and performance using appropriately limited or de-identified information where possible.

Depending on the activity, processing may be based on consent, performance of a service you request, compliance with law, protection of vital interests, or WALA’s legitimate interests where those interests do not override your rights.

WALA applies a minimum-information approach. Each participant receives only the information reasonably required for its role in a transaction. For example, a pharmacy may receive the clinical details needed to assess and dispense a prescription, while a rider receives pickup, delivery and chain-of-custody details without diagnosis or unnecessary medicine information.

• Hospitals and authorised prescribers can access records connected to care they provide.
• Selected licensed pharmacies receive the information required for safe fulfilment and dispensing.
• Insurers receive eligibility, authorisation and claim information relevant to requested cover.
• Logistics providers receive only the operational information needed for secure delivery.
• Approved service providers may process information under confidentiality, security and purpose restrictions.
• Information may be disclosed when required by law, a valid regulatory request, or to protect patients and the public.

WALA does not sell personal or health information for advertising.

We use layered administrative and technical safeguards proportionate to the sensitivity of healthcare information. These include role-based permissions, organisation-level separation, server-side authorisation, encrypted connections, protected credentials, session controls, validation, monitoring and audit records.

No digital service can guarantee absolute security. WALA reviews access and incidents, limits unnecessary exposure, and takes containment, investigation and notification steps when required. Users must protect their credentials, avoid sharing access, and report suspected misuse promptly.

WALA manages information through its lifecycle: collection, classification, controlled access, use, correction, archival and secure deletion or de-identification. We seek to keep active information accurate and relevant and restrict access when it is no longer needed for ordinary operations.

Retention periods depend on the record and the reason it was created. Prescription, dispensing, payment, insurance, delivery, consent, fraud-prevention and audit records may be retained after an account closes when healthcare, tax, financial, contractual, dispute-resolution or regulatory obligations require it. When there is no continuing lawful or operational need, information is securely deleted or de-identified in line with WALA’s retention procedures.

Subject to applicable law and necessary identity checks, you may ask WALA to explain its use of your information, provide access to it, correct inaccurate or incomplete data, supply an available copy, restrict or object to certain processing, withdraw consent for future consent-based processing, or consider deletion.

Some rights are not absolute. We may decline or limit a request where another person’s rights, patient safety, legal privilege, fraud prevention, healthcare recordkeeping or a binding legal obligation applies. We will explain the applicable reason where permitted. You may also raise a concern with Ghana’s Data Protection Commission.

1. 1. Verification. We verify your identity and authority before acting to prevent an unauthorised person from closing your account.
2. 2. Review. We identify active orders, prescriptions, claims, disputes, settlements and records subject to required retention.
3. 3. Closure. Account access is disabled after applicable open matters are resolved. This may end access to order history and connected services.
4. 4. Deletion or restriction. Information not required for a continuing lawful purpose is deleted or de-identified. Retained records are restricted and kept only for the applicable purpose and period.
5. 5. Completion. We confirm the outcome or explain any information that cannot yet be deleted and the reason, where permitted.

Deleting the WALA application from a device does not delete an account. Requests made by an organisation administrator affect organisational access only unless the individual account holder also requests personal account closure.

Children’s privacy

WALA is not intended for independent use by children. Where a child’s information is processed for care, an authorised parent, guardian or healthcare professional must act in accordance with applicable law and the child’s best interests.

Service providers and international processing

Some approved technology or operational providers may process information on WALA’s behalf. Where information is processed outside Ghana, we apply contractual and security safeguards intended to maintain protection consistent with applicable requirements.

Policy updates

We may update this policy as services, law or regulatory guidance changes. A revised effective date will appear on this page, and material changes may also be communicated through WALA or by email where appropriate.