Privacy Policy

PHAS (Platform Health Accountability System) is a public-interest monitoring platform operated in Rwanda. It tracks the real-time health of citizen-facing government and private digital services and allows the public to report issues they experience.

When you sign in with Google to submit a report, we receive:

• Your Google account name and email address
• Your Google profile picture URL
• A unique Google account identifier

When you submit a report, we record:

• The platform you are reporting on
• Whether you are affected or not
• Any free-text description you choose to provide
• Your anonymity preference (anonymous to operator or not)
• The date and time of submission

We do not collect raw GPS coordinates. If location data is submitted via the mobile app, it is coarsened to district level before storage.

• To aggregate crowd-sourced signals and detect platform outages
• To allow operators and regulators to investigate reported issues
• To prevent spam and abuse via rate limiting
• To contact you (only if you opt in to share your identity with the operator)

We do not sell your data. We do not use it for advertising.

When submitting a report, you may choose to remain anonymous to operators and regulators. In that case, your name and email are never shown to platform operators. Only PHAS system administrators can see your identity for anti-abuse purposes.

Your data may be shared with:

• Platform operators and regulators — only if you choose not to be anonymous
• PHAS system administrators — for platform operation and abuse investigation

We do not share your data with third parties outside of the above, except as required by Rwandan law.

Your citizen account and associated reports are retained for as long as your account exists. You may request deletion of your account and all associated data by emailing us (see Section 9). Reports that have been incorporated into aggregated statistics may remain in anonymised form.

We use HTTPS for all data in transit. Account credentials are managed by Google OAuth — we never store your Google password. Access to the database is restricted to authorised personnel and automated PHAS services.

Under Rwanda's Law n° 058/2021 on the Protection of Personal Data and Privacy, you have the right to:

• Access the personal data we hold about you
• Request correction of inaccurate data
• Request deletion of your account and data
• Object to processing in certain circumstances

For privacy-related requests or questions, contact: julesntare@gmail.com