Privacy Policy

This policy explains what personal data VetConnect Rwanda collects, why we collect it, who we share it with, and what rights you have. It is written to meet our obligations under Law N° 058/2021 of 13/10/2021 relating to the protection of personal data and privacy.

1. Who we are

VetConnect Rwanda is operated by Digital Solutions, which is the data controller for the personal data described in this policy. The platform is currently operating a pilot in Nyagatare District, Eastern Province.

2. What we collect

Account information, from everyone:

• Full name, email address, phone number and preferred language.
• Your role on the platform: farmer, veterinarian or administrator.
• A password, which we store only as an Argon2id hash and can never read back.

If you are a farmer:

• Farm name, and your district, sector and village.
• Your national identity document number, if you choose to supply it.
• Farm coordinates, used to order veterinarians by distance from you.
• Your livestock: species, group sizes, head counts and any photographs you upload.
• Symptom checklists, free-text notes and severity results from the AI triage assistant.
• Bookings, consultation records, prescriptions issued to you, and payment history.

If you are a veterinarian:

• Your veterinary licence number, specialisations, years of experience and biography.
• The certificate document you upload for credential verification.
• Your service district, working coordinates and weekly availability.
• Consultation records you author, prescriptions you issue, earnings and payout requests.

Payment information:

• The mobile money number used for a payment, the amount, currency and status.
• Our own transaction reference and the reference returned by our payment provider.
• We never see, receive or store your mobile money PIN. You enter it on your own handset.

Technical information:

• A session cookie that keeps you signed in, and a cookie recording your language choice. We do not use advertising or tracking cookies.
• Server logs containing IP addresses and request times, kept for security and debugging.

3. Why we process it, and on what basis

We process your data to perform the contract you enter into when you register: matching you with a veterinarian, running consultations, issuing prescriptions, taking payment and paying veterinarians. Some processing rests instead on your consent, on our legal obligations, or on our legitimate interest in keeping the platform secure.

We do not sell your personal data, and we do not use it to build advertising profiles.

4. Who can see your data

• A veterinarian sees your name, contact details, location and the livestock and symptom information relevant to a booking only once you have booked them. Veterinarians cannot browse farmers they have no appointment with.
• A farmer sees a veterinarian's professional profile: name, licence number, specialisations, experience and service area. Uploaded certificate documents are visible only to administrators.
• Administrators can access accounts and records where necessary to verify credentials, resolve payment disputes and investigate misuse. Administrative overrides of phone verification are logged with a written reason.
• Nobody else on the platform can see your livestock records, consultation notes or prescriptions.

5. The AI triage assistant

When you use the symptom checker, we send the following to Google's Gemini API: the animal species, the number of animals in the group, how many show signs, how long signs have been present, the symptoms you ticked, and any note you typed in your own words.

We do not send your name, phone number, email address, national identity number, farm name, coordinates or account identifier. The assessment that comes back is stored against your account so you and any veterinarian you subsequently book can see it. Please avoid typing personal details into the free-text note, because that box is forwarded as written.

6. Service providers and transfers outside Rwanda

We rely on the following providers, some of which process data outside Rwanda:

• Paypack, for mobile money collections and disbursements through MTN MoMo and Airtel Money.
• Africa's Talking, for SMS delivery, which receives your phone number and message content.
• Resend, for transactional email delivery.
• Google, for the Gemini model behind the triage assistant.
• Cloudflare R2, for storing uploaded documents and photographs.
• Railway, for application hosting and the platform database.

Rwandan law requires personal data to be stored in Rwanda unless the National Cyber Security Authority has authorised the transfer. Where our providers store data abroad, we rely on that authorisation and on the contractual safeguards those providers offer. You can ask us for the current position at any time.

7. Disease surveillance

We analyse symptom submissions at district level to detect possible livestock disease outbreaks, and may report those patterns to agricultural authorities such as the Rwanda Agriculture and Animal Resources Development Board. These reports describe clusters of symptoms in an area. They do not identify you, your farm or your animals individually.

8. How long we keep it

• Consultation records and prescriptions are kept as a clinical and legal record for as long as your account exists, and afterwards where a veterinarian's professional obligations require it.
• Payment records are kept for as long as tax and accounting law requires, and are not deleted on request while that period runs.
• One-time verification codes are stored only as a hash, expire quickly, and are discarded once used.
• Server logs are retained for a limited operational period and then rotated out.

9. How we protect it

• Passwords are hashed with Argon2id at parameters recommended by OWASP.
• All traffic is served over HTTPS, with secure, HTTP-only session cookies in production.
• Veterinary certificates and livestock photographs live in a private storage bucket and are served through links that expire, so a copied link stops working.
• Changing your phone number requires your password and a code sent to the new number before anything changes.
• Payment notifications from our provider are signature-checked and independently confirmed before any account is credited.

10. Your rights

Under Law N° 058/2021 you may ask us to give you a copy of your data, correct it, delete it, restrict or object to how we use it, or withdraw consent you previously gave. You may also complain to the National Cyber Security Authority.

You can edit most of your details yourself from your profile. Deleting an account is not yet self-service: email us and we will action it, subject to the retention periods in section 8. We aim to respond within thirty days.

11. Children

VetConnect Rwanda is intended for adults. We do not knowingly create accounts for anyone under 18. If you believe a child has registered, contact us and we will remove the account.

12. Changes to this policy

We will update this page when our processing changes and revise the date at the top. If a change materially affects your rights we will notify you by email or SMS.

13. Contact us

For any privacy question, or to exercise the rights in section 10, write to [email protected].