Privacy Policy

Effective Date: January 5, 2022
Last Updated: December 5, 2025

Introduction

Welcome to Gasobu Technologies Limited ("Gasobu," "we," "us," or "our"). We are committed to protecting your privacy and ensuring the security of your personal information. This Privacy Policy explains how we collect, use, disclose, and safeguard your information when you visit our website, use our products and services, or interact with us.

By accessing or using our services, you agree to the terms of this Privacy Policy. If you do not agree with our practices, please do not use our services.

About Gasobu Technologies

Gasobu Technologies Limited is a Ugandan technology company based in Kampala, founded in 2020. We specialize in:

• Artificial Intelligence research and development (Gasobu AI Labs)
• Telehealth solutions (Labcome, Medufy, Dwaliro)
• Financial technology platforms (Bankroll)
• Logistics and e-commerce solutions (Wakelo Express)
• Medical devices and diagnostics
• Custom software development and technology consulting

Information We Collect

1. Personal Information You Provide

We collect information that you voluntarily provide to us when you:

• Contact Us: Name, email address, phone number, company name, and message content through our contact forms
• Apply for Jobs: Resume/CV, educational background, work history, references, and other application materials
• Use Our Services: Account information, profile data, payment information, and service-specific data
• Subscribe to Updates: Email address and communication preferences
• Attend Events: Name, company, job title, and contact information for webinars, workshops, or conferences

2. Information Automatically Collected

When you visit our website or use our services, we may automatically collect:

• Device Information: IP address, browser type and version, operating system, device identifiers
• Usage Data: Pages visited, time spent on pages, click patterns, referral sources
• Location Data: General geographic location based on IP address
• Cookies and Similar Technologies: Session data, preferences, and analytics information

3. Service-Specific Information

Depending on which Gasobu products or services you use:

AI Labs: Training data, model inputs/outputs, API usage statistics
Telehealth (Labcome, Medufy, Dwaliro): Health records, patient identification data, diagnostic results, medical history
Fintech (Bankroll): Financial information, transaction data, account balances, payment methods
Logistics (Wakelo Express): Delivery addresses, order history, tracking information
Medical Devices: Diagnostic test results, device usage data

How We Use Your Information

We use the collected information for the following purposes:

Service Delivery

• Provide, maintain, and improve our products and services
• Process transactions and fulfill orders
• Deliver customer support and respond to inquiries
• Send service-related communications and updates

Business Operations

• Analyze usage patterns to improve user experience
• Develop new features and services
• Conduct research and development, particularly for AI models
• Monitor and analyze trends, usage, and activities
• Detect, prevent, and address technical issues and security threats

Communications

• Send newsletters, marketing materials, and promotional offers (with your consent)
• Respond to your questions, comments, and requests
• Notify you about changes to our services or policies
• Process job applications and communicate with candidates

Legal and Compliance

• Comply with legal obligations and regulatory requirements
• Enforce our terms and conditions
• Protect our rights, privacy, safety, or property
• Resolve disputes and troubleshoot problems

Legal Basis for Processing (GDPR Compliance)

For users in the European Economic Area (EEA), we process personal data based on:

• Consent: When you have given explicit consent for specific purposes
• Contract Performance: To fulfill our contractual obligations to you
• Legal Obligation: To comply with applicable laws and regulations
• Legitimate Interests: For our business interests that do not override your privacy rights

How We Share Your Information

We do not sell your personal information. We may share your information in the following circumstances:

Service Providers and Partners

We may share information with trusted third-party service providers who assist us in:

• Cloud hosting and data storage
• Payment processing
• Email delivery and communications
• Analytics and performance monitoring
• Customer support services
• Marketing and advertising

These providers are contractually obligated to protect your information and use it only for specified purposes.

Business Transfers

In the event of a merger, acquisition, reorganization, or sale of assets, your information may be transferred as part of that transaction. We will notify you of any such change.

Legal Requirements

We may disclose your information if required by law, court order, or governmental authority, or to:

• Comply with legal processes
• Enforce our agreements and policies
• Protect our rights, property, or safety
• Prevent fraud or security issues
• Respond to emergencies

Healthcare Data Sharing (Telehealth Services)

For our healthcare products (Labcome, Medufy, Dwaliro), we may share medical information with:

• Healthcare providers involved in your care
• Insurance companies (with your authorization)
• Public health authorities (as required by law)
• Medical laboratories and diagnostic facilities

All healthcare data sharing complies with applicable health privacy laws.

With Your Consent

We may share information with third parties when you explicitly consent to such sharing.

Data Security

We implement appropriate technical and organizational security measures to protect your personal information, including:

• Encryption: Data encryption in transit (TLS/SSL) and at rest
• Access Controls: Role-based access and authentication systems
• Network Security: Firewalls, intrusion detection, and monitoring
• Regular Audits: Security assessments and vulnerability testing
• Employee Training: Staff education on data protection and privacy
• Incident Response: Procedures for detecting and responding to security breaches

For healthcare and financial services, we implement additional security measures to meet regulatory requirements (e.g., HIPAA, PCI DSS).

However, no system is 100% secure. While we strive to protect your information, we cannot guarantee absolute security.

Data Retention

We retain your personal information only as long as necessary for the purposes outlined in this Privacy Policy, unless a longer retention period is required or permitted by law.

General Data: Retained while you use our services and for a reasonable period afterward
Healthcare Records: Retained according to medical record retention laws (typically 7-10 years)
Financial Data: Retained according to financial regulations (typically 7 years)
Marketing Data: Retained until you opt out or request deletion
Legal Records: Retained as required for legal compliance

When information is no longer needed, we securely delete or anonymize it.

Your Privacy Rights

Depending on your location, you may have the following rights:

Right to Access

Request a copy of the personal information we hold about you.

Right to Rectification

Request correction of inaccurate or incomplete information.

Right to Erasure ("Right to be Forgotten")

Request deletion of your personal information, subject to legal obligations.

Right to Restrict Processing

Request limitation of how we process your information.

Right to Data Portability

Receive your personal information in a structured, commonly used format.

Right to Object

Object to processing based on legitimate interests or for direct marketing.

Right to Withdraw Consent

Withdraw consent for processing at any time (without affecting prior processing).

Right to Lodge a Complaint

File a complaint with your local data protection authority.

To exercise your rights, contact us at privacy@gasobu.com or go@gasobu.com.

International Data Transfers

Gasobu Technologies is based in Uganda, East Africa. If you are accessing our services from outside Uganda, your information may be transferred to, stored, and processed in Uganda or other countries where we or our service providers operate.

We ensure appropriate safeguards are in place for international transfers, including:

• Standard contractual clauses
• Adequacy decisions by relevant authorities
• Your explicit consent where required

Children's Privacy

Our services are not intended for children under 13 years of age (or the applicable age of consent in your jurisdiction). We do not knowingly collect personal information from children. If we discover that we have collected information from a child, we will promptly delete it.

If you are a parent or guardian and believe your child has provided us with personal information, please contact us immediately.

Cookies and Tracking Technologies

We use cookies and similar tracking technologies to enhance your experience. Types of cookies we use:

Essential Cookies: Necessary for website functionality
Analytics Cookies: Help us understand how visitors use our site (Google Analytics)
Preference Cookies: Remember your settings and preferences
Marketing Cookies: Track visits across websites for advertising purposes

You can control cookies through your browser settings. Note that disabling cookies may affect website functionality.

For more details, see our Cookie Policy (link in footer).

Third-Party Links

Our website may contain links to third-party websites, plugins, or applications. We are not responsible for the privacy practices of these third parties. We encourage you to review their privacy policies.

Changes to This Privacy Policy

We may update this Privacy Policy from time to time to reflect changes in our practices, technology, legal requirements, or other factors. We will notify you of material changes by:

• Posting the updated policy on our website
• Updating the "Last Updated" date
• Sending email notifications for significant changes

Your continued use of our services after changes constitutes acceptance of the updated policy.

Uganda Data Protection Compliance

Gasobu Technologies complies with the Uganda Data Protection and Privacy Act, 2019, and regulations issued by the Personal Data Protection Office (PDPO). We are committed to:

• Lawful and fair processing of personal data
• Transparency in data collection and use
• Data minimization and purpose limitation
• Accuracy and data integrity
• Storage limitation
• Security of processing

Sector-Specific Privacy Practices

Healthcare Services (Labcome, Medufy, Dwaliro)

We comply with health privacy regulations and maintain patient confidentiality. Protected Health Information (PHI) is subject to additional safeguards and is only disclosed for treatment, payment, healthcare operations, or as required by law.

Financial Services (Bankroll)

We comply with financial privacy regulations and implement measures to protect financial information. We do not share your financial data with third parties for marketing purposes without your consent.

AI and Machine Learning

Data used to train AI models is anonymized and aggregated where possible. We do not use personal data to train publicly available models without explicit consent. Users have the right to opt out of data use for AI training.

Contact Information

For questions, concerns, or requests regarding this Privacy Policy or our privacy practices:

Gasobu Technologies Limited
Email: privacy@gasobu.com or go@gasobu.com
Phone: +256 393 001 650
Address: Kampala, Uganda
Website: www.gasobu.com

Data Protection Officer: Available upon request

Consent

By using our website or services, you acknowledge that you have read, understood, and agree to this Privacy Policy. For certain processing activities, we may request your explicit consent, which you can withdraw at any time.

Document Version: 1.0
Approved By: Gasobu Technologies Legal & Compliance Team
Review Schedule: Annually or as needed