Privacy notice.
How CORA collects, uses and protects your personal and health information.
1. In short
- We collect what CORA needs to give you health information and to connect you with a clinic.
- Health information is sensitive. We protect it and share it only with the people involved in your care, or when the law requires.
- We do not sell your information or use it for advertising.
- You can see, correct or delete your information. You can delete your account at any time.
2. Who we are
CORA is provided by [Publishing entity legal name], Government of Guyana (“we”, “us”). For the purposes of the Data Protection Act 2023 (Act No. 18 of 2023), we are the data controller for the personal information collected through CORA.
Address: [Street address, city].
Data protection officer: [Title], privacy@cora.gov.gy.
[Legal review: confirm the controller, any joint controllers (for example the Ministry of Health for clinical records), and which provisions of the Act are in force.]
3. What this notice covers
This notice covers the CORA apps for iPhone and Android, CORA on the web at [app.cora.gov.gy], and this website, cora.gov.gy.
When a health facility gives you care, the records it makes are part of the national health record managed through CORTEX. [Link to the relevant notice]
4. Information we collect
Your account
Your name, email address, password (stored in a form we cannot read), phone number, and whether you can be contacted on WhatsApp.
Your identity
If you scan an ID card, passport or driver’s licence, we use the image to read your name, date of birth and ID number. [Confirm whether the image is kept, for how long, and where it is processed]
Your health profile
Your region, community and usual health facility, and any conditions, allergies, medicines or home readings you choose to add. Information you add yourself is labelled as self-reported.
Your questions and messages
The questions you ask CORA, including voice notes, and CORA’s answers.
Your appointments
The care you request, the facility you choose, your preferred times, and the status of each request.
Technical information
Device type, app version, and logs needed to keep CORA working and secure. [List any crash-reporting or analytics tools, or state that none are used]
5. How we use it
- To answer your health questions with general information.
- To show clinics that offer the care you need, and to send your appointment requests to them.
- To tell you about your requests and appointments, by the contact method you chose.
- To keep CORA secure and working properly.
- To measure, in anonymised totals, where people cannot get the care they need, so the health system can improve services. These totals never identify you.
6. How CORA uses AI
CORA’s answers are produced by an AI system, using health information approved by [the Ministry of Health clinical team]. CORA does not diagnose illness or change your medicines, and a person makes every clinical decision.
To produce an answer, your question is processed by [AI service provider and location]. [Confirm whether questions are used to train or improve any AI model; the recommended position is that they are not.]
7. Legal basis
Health information is sensitive personal data under the Data Protection Act 2023. [Legal review: state the lawful basis for each purpose in section 5, and the condition relied on for processing sensitive health data, for example explicit consent or the provision of health care.]
9. Where it is stored
[State where CORA data is stored and processed, including any country outside Guyana, and the safeguards used for transfers, as required by the Act.]
10. How long we keep it
- Account and profile: while your account is open, then deleted within [number] days of closing it.
- Questions and voice notes: [period].
- Appointment requests: [period, and the health records rule it follows].
- Security logs: [number] days.
11. How we protect it
Information is encrypted when it travels between your device and CORA. Access is limited by role, and every access to health information is logged. [Summarise other measures: encryption at rest, backups, incident response.]
If a breach puts your rights at risk, we will tell you and the Data Protection Commissioner as the Act requires.
12. Your rights
Under the Data Protection Act 2023 you have the right to:
- ask for a copy of the personal information we hold about you
- ask us to correct information that is wrong or incomplete
- ask us to delete your information
- ask us to restrict how we use it
- receive your information in a format you can take elsewhere
- object to how we use it, and withdraw consent where we rely on it.
Email privacy@cora.gov.gy. We will reply within [time period required by the Act]. [Legal review: confirm the full list of rights, exemptions for health records, and identity checks.]
13. Deleting your account
You can delete your CORA account in the app, on the web, or by email. See how to delete your account.
14. Children, family and carers
[Legal review: minimum age to hold an account, how parents and guardians act for children, and how a person can authorise a carer. Record who acted for whom.]
15. Cookies and your device
This website, cora.gov.gy, does not set cookies or use analytics. The CORA app and web app store a sign-in token on your device to keep you signed in. [Confirm against the live configuration, and list any other cookies or device storage.]
16. Contact and complaints
Contact our data protection officer at privacy@cora.gov.gy or write to [postal address].
If you are not satisfied with our response, you can complain to the Data Protection Commissioner: [contact details].
17. Changes to this notice
We will update this notice when the way we handle information changes, and tell you in CORA before important changes take effect.