Legal - Privacy Policy

01 — Information We Collect. At SESA, we collect and process personal data based on explicit consent provided during account registration. We only collect what is necessary to deliver the platform’s services safely and effectively.

• Registration Data: Name, username, email address, date of birth, gender, and school details.
• Health & Assessment Data: Responses to psychological assessments and the AI-generated or counsellor-provided clinical feedback associated with your scores.
• Professional Data (Counsellors only): National ID numbers (Ghana Card) and professional certification details.
• Technical Data: IP addresses and browser session metadata collected automatically to maintain platform security.

02 — Functional Usage. The information collected is strictly used for the following core purposes: operating and maintaining the SESA platform; calculating mental health assessment scores to provide context-aware, personalised clinical feedback; enabling authorised school administrators and verified counsellors to support students identified at elevated or clinical risk; ensuring secure communication channels between counsellors and students; and maintaining audit trails of authorised data access for accountability.

03 — Security Standards. We implement robust, industry-standard security safeguards at every layer:

• Encryption at Rest: Highly sensitive health data and National IDs are encrypted at rest using Fernet symmetric encryption.
• Password Hashing: All passwords are irreversibly hashed using PBKDF2 — they are never stored in plain text.
• Audit Logging: All system and clinical events are securely logged to maintain accountability without exposing sensitive payload content.
• Access Controls: Data is accessible only to the specific role authorised to view it.

04 — Retention Policy. We only retain your personal data for as long as necessary to fulfil the operational purposes outlined in this policy. Inactive accounts that have not been accessed for five (5) consecutive years are automatically and permanently purged. You may also request deletion at any time through your Account Settings.

05 — Data Subject Rights. Under Ghana’s Data Protection Act, you retain full control over your personal data, exercisable at any time through your Account Settings:

• Right to Access: Review your assessment history and results at any time from your personal dashboard.
• Right to Portability: Export a full, machine-readable JSON copy of your personal data and complete assessment history.
• Right to Rectification: Contact your school administrator or our team to correct inaccurate data held on your account.
• Right to Erasure: Permanently delete your account and withdraw consent for further processing at any time.