Privacy policy

K. Yebo Foundation (“we”, “us”) operates this community marketplace in the Western North Region of Ghana. Our contact address is Town Centre, Sefwi Wiawso, Western North Region. For privacy requests, email support@kyebofoundation.com.

This policy explains what personal data we collect, why we collect it, how we protect it and the choices you have. It is written with Ghana's Data Protection Act, 2012 (Act 843) in mind. Before commercial launch it should be reviewed for full regulatory compliance.

Account data: name, email address, phone number and password hash. We never store your password in plain text.

Transaction data: bookings, food orders, medicine requests, ticket purchases, deliveries, payment references and statuses.

Location and service data: your selected community, delivery addresses, landmarks and pickup and drop-off details.

Health-related data: a medicine name, notes and any prescription image or PDF you choose to upload.

Communications: support messages, reviews, enquiries and notifications.

Technical data: session cookies, IP-derived security logs and rate-limiting records used to protect the platform.

To create and secure your account, and to show relevant businesses in your selected community.

To pass your order, booking, enquiry or request to the relevant business (and, for delivery orders, the assigned rider) so it can be fulfilled.

To process payments and refunds through approved providers when real payments are enabled, and to keep financial records.

To provide support, investigate disputes, prevent fraud and enforce our terms.

To send service notifications about your orders, bookings and tickets. Marketing messages are only sent where permitted and can be opted out of.

Prescription files are stored outside the public web directory with randomised filenames. They are intended to be accessed only by the approved pharmacy handling your request and authorised administrators where necessary for support or compliance.

We do not use prescriptions for marketing, do not sell them, and do not automatically approve restricted medicines. Do not upload a prescription for someone else unless you are authorised to act for them.

You should avoid including unnecessary medical information in free-text notes. Ask your pharmacist directly if you have clinical questions.

With the relevant business: the details needed to fulfil your order or request, such as your name, contact number, order items and delivery address.

With assigned riders: pickup and drop-off details, receiver name and phone number, and any delivery notes. Your platform password and payment credentials are never shared.

With service providers who support hosting, payments, email or SMS delivery, under appropriate confidentiality and security terms.

With authorities where required by law, or to protect users, the public or our legal rights.

We use a small number of essential cookies. A secure, httpOnly session cookie keeps you signed in. A preferences cookie stores your selected community. The installable web app uses a service worker cache to load pages faster and work offline.

We do not use advertising cookies in this build.

Passwords are hashed with bcrypt. Session tokens are random, stored only as hashes in our database and sent in httpOnly cookies. Sensitive actions are restricted by role and recorded in audit logs.

Access to prescriptions is limited, uploads are validated and size-limited, and payment webhooks are designed to be independently verified when real providers are connected.

No system is perfectly secure. If you believe your account has been compromised, contact support immediately.

We keep account and transaction records for as long as needed to provide the service and meet legal, tax and dispute-resolution obligations.

Prescription files are retained only as long as needed for the request, pharmacy obligations and audit purposes, then deleted or anonymised according to our retention schedule.

Support tickets and reviews may be retained for service quality and dispute handling.

You may request access to the personal data we hold about you, ask us to correct inaccurate data, or request deletion where there is no legal obligation to retain it.

You may object to certain processing or withdraw consent where processing is based on consent. You can also ask us to restrict processing.

To exercise any right, email us. We may need to verify your identity. If you are not satisfied with our response, you may contact Ghana's Data Protection Commission.

The platform is not directed at children under 18. If a minor uses the platform, they must do so with the consent and supervision of a parent or guardian. We do not knowingly collect data from children without such consent.

We may update this policy and will publish the revised version with a new effective date. Material changes will be communicated to account holders where appropriate.

This policy is a working template for the prototype and should be reviewed before commercial launch.