Privacy Policy

GraitCare is committed to protecting the privacy of the healthcare professionals who use our platform. This Privacy Policy explains how we collect, use, store, and protect your information, in accordance with Ghana's Data Protection Act, 2012 (Act 843) and applicable data protection principles.

By using GraitCare, you consent to the practices described in this policy.

When you create and use a GraitCare account, we collect:

• Full name and professional role
• Email address
• Clinic or practice name and contact number
• Subscription tier and payment reference (not card details — these are handled by Paystack)
• Usage logs: number of AI queries, timestamps, and which tools were used
• Content voluntarily entered into clinical tools, such as patient name, age, and sex in patient folders and AI tools

We use the information we collect to:

• Create and manage your account
• Provide access to GraitCare's clinical decision support tools
• Track and enforce monthly query usage limits based on your subscription tier
• Process subscription payments and renewals via Paystack
• Send transactional communications (account confirmations, subscription receipts)
• Improve the reliability and performance of our platform

We do not sell, rent, or share your personal data with third parties for marketing purposes.

Clinical queries entered into GraitCare's AI tools (Symptoms & Tests, Results & Management, Plan Evaluator, and Clinical Notes Assistant) are processed by Anthropic's Claude AI models via the Anthropic API.

• Anthropic does not retain API inputs or outputs to train its models, per its API data usage policies.
• Queries are transmitted securely over HTTPS and are not stored by Anthropic beyond the duration of the API call.

All GraitCare data is stored using Supabase, a managed database and authentication platform. Data is protected by:

• Encryption at rest using AES-256
• Encryption in transit via TLS/HTTPS
• Row-level security (RLS) policies ensuring each user can only access their own data
• Authentication enforced via Supabase Auth with session-based JWT tokens

Access to your stored data is restricted to your authenticated account. GraitCare staff do not have routine access to your clinical tool inputs or outputs.

Your data is retained for as long as your account remains active. You may request deletion of your account and all associated data at any time by:

• Using the Account Deletion feature in Settings within the app, or
• Contacting us at privacy@graitcare.com

Upon account deletion, all personal data, clinical tool history, and patient folder data associated with your account will be permanently removed within 30 days.

GraitCare uses the following third-party processors. Each operates under its own privacy policy:

Under Ghana's Data Protection Act, 2012 (Act 843), you have the right to:

• Access — request a copy of the personal data we hold about you
• Correction — request that inaccurate or incomplete data be corrected
• Deletion — request erasure of your personal data
• Objection — object to processing of your personal data in certain circumstances
• Complaint — lodge a complaint with the Data Protection Commission of Ghana if you believe your rights have been infringed

To exercise any of these rights, contact us at privacy@graitcare.com.

GraitCare may update this Privacy Policy from time to time to reflect changes in our practices or applicable law. We will notify users of material changes by email or by displaying a prominent notice within the platform. The “Last updated” date at the top of this page indicates when the policy was most recently revised. Continued use of GraitCare after a material change constitutes acceptance of the updated policy.

For privacy enquiries, data access requests, or concerns about how we handle your information, please contact us at: privacy@graitcare.com