Privacy Policy
Patient Navigation and Care Continuity System — how we collect, use, and protect identifiable personal and health information.
Published by the Ghana Health Service. Last reviewed: 2nd September, 2026.
The Ghana Health Service ("GHS", "we", "us") has developed the Patient Navigation and Care Continuity System mobile application ("PNCCS", "the app") to support community-based health workers in registering households, following up on clients, recording home and facility visits, and making referrals between levels of care.
Unlike our general-purpose applications, PNCCS is a clinical system. It holds identifiable personal and health information about members of the public. We therefore treat every record in it as confidential health information.
This policy explains what information the app collects, why it is collected, how it is stored and protected, who it may be shared with, and the rights available to the people whose information it holds. It should be read together with the GHS Data Protection Policy and the patient confidentiality obligations that already bind all GHS staff.
The Ghana Health Service is the data controller for all information processed through PNCCS.
2. Who This Policy Applies To
This policy covers two distinct groups:
- App users — health workers, community health officers, nurses, navigators, supervisors and administrators who are issued PNCCS accounts by the Ghana Health Service. The app is not available to the general public and cannot be used without a GHS-issued account.
- Data subjects — clients, household heads and household members whose personal and health information is recorded in the app by those health workers.
3. Information We Collect
3.1 Health worker account information
When a health worker is issued an account and signs in, we process:
- staff number, name and any other names on the staff record;
- work telephone number, e-mail address and staff photograph where these are on file;
- assigned facility, district, region and posting details, including cadre, grade, position and unit;
- the roles and permissions granted to the account;
- sign-in activity, session records and password-recovery answers.
3.2 Device information
To secure sign-in and to associate offline records with the handset that created them, the app generates and transmits:
- a random device identifier created on first launch, which is unique to that installation and is not derived from the phone number, IMEI, SIM or any hardware serial number;
- the device platform (Android or iOS) and the app version.
The app does not collect an advertising identifier, browsing history, contacts, photo library, call logs or SMS messages.
3.3 Client and household information
Health workers record the following about the households and clients they serve:
- Client identity — first name, surname, other names, sex, date of birth (and whether that date is exact or estimated), National Health Insurance number where provided, and the PNCCS reference code and access code issued to the client;
- Household details — household name, name of the household head, a contact telephone number, address, nearest landmark, Ghana Post GPS digital address, community and facility of registration, declared household size and the number of members in each age group;
- Household composition — each member's relationship to the household head, and the dates on which membership began or ended.
3.4 Clinical and service information
Where a client receives a service, the app records:
- visits — the type of visit, the date, the time it began and ended, the health worker and facility responsible;
- answers to clinical and screening forms completed during a visit;
- nursing assessments and diagnoses;
- referrals made to other facilities or levels of care;
- alerts and findings raised by the app's clinical decision support rules.
3.5 Location information
The app requests permission to access the device's location for one purpose: to record the position of a household or a visit when the health worker chooses to capture it. Location is read only while the app is open and only when the health worker taps to use it. PNCCS does not track health workers, does not read location in the background, and does not read location when the app is closed. Permission may be declined or withdrawn in the device settings at any time; the app remains usable, and the location may be entered manually as a Ghana Post GPS address instead.
3.6 What the app does not do
PNCCS contains no advertising, no third-party analytics, no social-media software development kits and no behavioural tracking of any kind. No information collected by the app is used for marketing, and none is sold, rented or traded.
4. How We Use Information
Information collected through PNCCS is used only to:
- authenticate health workers and confine each account to the facilities and clients within its remit;
- register households and clients and maintain an accurate community register;
- plan, deliver, document and follow up on care, including home visits, screening, nursing care and referrals;
- maintain continuity of care when a client moves between health workers, facilities or levels of care;
- support clinical decision-making through in-app guidance and alerts;
- produce aggregated, de-identified statistics for service monitoring, planning and reporting, in which no individual can be identified;
- maintain audit trails of who created or amended a record, as required for clinical governance;
- meet the statutory reporting and public health obligations of the Ghana Health Service.
Information held in PNCCS is not used for any purpose incompatible with the delivery and administration of health care.
5. Legal Basis
The Ghana Health Service processes this information under:
- the Data Protection Act, 2012 (Act 843), principally for the performance of a task carried out in the public interest and in the exercise of official authority, and for the purposes of preventive medicine, medical diagnosis and the provision of care and treatment;
- the Public Health Act, 2012 (Act 851) and the statutory mandate of the Ghana Health Service under the Ghana Health Service and Teaching Hospitals Act, 1996 (Act 525);
- the professional confidentiality obligations of the health workers who use the app.
6. Consent and Client Awareness
Health workers are required to inform every household head and client, in a language they understand, that their details are being recorded in a Ghana Health Service system, what the information will be used for, and that they may ask questions or object.
Certain records — including referrals and nursing diagnoses — cannot be created in PNCCS unless a record of the client's consent to care is already held on the Ghana Health Service servers. The system refuses these actions where consent is absent.
Where care is provided in an emergency or under a statutory public health duty, processing may proceed on the legal basis set out in section 5 above.
7. Data Storage and Security
On the device. PNCCS is designed for use in communities where there is often no network. Records are therefore held on the handset until they can be transmitted. All clinical and personal data held on the device is stored in an encrypted database (SQLCipher). The encryption key is generated on the device and held in the platform's hardware-backed secure store — the Android Keystore or the iOS Keychain — so that the database cannot be read by another app, by another user of the phone, or by anyone who extracts the file from the device. Session tokens are held in the same secure store.
In transit. All communication between the app and Ghana Health Service servers is encrypted using industry-standard transport layer security (HTTPS).
On our servers. Ghana Health Service servers are protected by technical, physical and administrative safeguards against unauthorised access, alteration, disclosure, loss or misuse. Access is granted on a least-privilege basis and is logged.
Access control. Each account can see only the clients and facilities within its assigned scope. Signing out immediately clears the signed-in worker's profile, facility assignment and cached account details from the device so that they are not visible to the next person to use the handset.
Hosting. Data collected through PNCCS is stored on servers located in Ghana and managed by the Ghana Health Service. Where any processing takes place outside Ghana, it is carried out only under a written agreement that meets the requirements of sections 18 and 47 of the Data Protection Act, 2012 (Act 843).
8. Data Sharing and Disclosure
The Ghana Health Service does not sell or rent any information collected through PNCCS, and does not share it for advertising or commercial purposes.
Information may be shared only:
- with other authorised health workers and facilities involved in the care of the same client, so that care is continuous;
- with the relevant district, regional and national directorates of the Ghana Health Service and the Ministry of Health, in aggregated or de-identified form for planning, monitoring and reporting;
- with the National Health Insurance Authority or other agencies, where this is necessary for a claim or entitlement and is permitted by law;
- with technical service providers engaged to host or maintain the system, who act only on our documented instructions, are bound by written confidentiality and data-protection terms, and may not use the information for their own purposes;
- where disclosure is required by law, by a court order, or by a lawful request from a competent authority;
- where necessary to protect the life, health or safety of an individual.
9. Data Retention
Personal information is kept only for as long as it is needed for the purposes set out in this policy.
- Clinical and client records are retained in accordance with the Ghana Health Service health records retention schedule, for a minimum period after the last contact and longer for the records of children and for maternal records, after which they are securely archived or destroyed.
- Health worker account and sign-in records are retained for up to five (5) years in active storage and a further five (5) years in archive, after which they are securely deleted, in line with the Data Protection Act, 2012.
- Copies held on a device are removed once they have been synchronised to the Ghana Health Service servers and are no longer required for offline work. Uninstalling the app removes the encrypted database from the handset.
10. Your Rights
Under the Data Protection Act, 2012 (Act 843), any person whose information is held in PNCCS has the right to:
- be told whether we hold information about them, and to be given a copy of it;
- have inaccurate or incomplete information corrected or completed;
- request the deletion or blocking of information that is irrelevant, excessive or unlawfully held;
- object to processing that causes or is likely to cause unwarranted damage or distress;
- withdraw a consent previously given, without affecting care already provided or processing required by law;
- complain to the Ghana Health Service and to the Data Protection Commission.
Requests may be made to the health facility where the client is registered, or to the contacts in section 14 below. We will respond within the period required by law. We may ask for proof of identity before acting on a request, and some rights may be limited where the information forms part of a medical record that must be retained.
11. Responsibilities of App Users
Health workers issued with PNCCS accounts must:
- keep their password and recovery answers confidential and never share an account;
- use a device with a screen lock, and sign out when the device is out of their control;
- access only the records of clients in their care, and only for the purpose of providing or administering that care;
- inform clients that their details are being recorded, as set out in section 6;
- never photograph, copy, export or forward client information into a personal device, messaging application or storage service;
- report a lost or stolen device, or any suspected unauthorised access, immediately (see section 13).
Misuse of client information is a breach of the Data Protection Act, 2012, of professional confidentiality obligations, and of Ghana Health Service disciplinary rules.
12. Children and Vulnerable Persons
PNCCS is not intended for use by children; accounts are issued only to Ghana Health Service staff.
The app does, however, hold records about children, because children are members of the households it registers and are recipients of the care it documents. Information about a child is recorded through, and with the awareness of, a parent, guardian or household head, and is subject to the same protections and the same rights of access and correction set out in this policy, exercisable by the parent or guardian on the child's behalf.
The same applies to any adult who is unable to give consent on their own behalf, whose rights may be exercised by a lawfully appointed representative.
13. Data Breaches
Where a breach of security affects personal information held in PNCCS, the Ghana Health Service will act promptly to contain it, will notify the Data Protection Commission, and will inform the individuals affected where the breach is likely to result in harm, in accordance with section 31 of the Data Protection Act, 2012.
Suspected breaches, lost or stolen devices, and suspected unauthorised access should be reported immediately to the facility in-charge and the GHS ICT service desk, and to the contacts in section 14.
14. Contact Us
For questions about this policy, to exercise any of the rights in section 10, or to report a concern:
15. Changes to This Policy
This policy may be updated from time to time to reflect changes in the app, in our practices, or in the law. The current version will always be published on the Ghana Health Service website, and material changes will be communicated through the app and through official Ghana Health Service channels. The "Effective Date" at the top of this page shows when it was last changed.