How we look after your information

Haven Eye is operated by Haven Eye Limited, Valco Trust House, adjacent to the Bank of Ghana, Ridge, Accra, Ghana. We are the “data controller” for the personal information described in this notice, which means we decide how and why it is used and are responsible for protecting it.

This notice covers information collected through this website. Care you receive at the clinic is also covered by the confidentiality duties that apply to all eye-care professionals.

When you request an appointment:

• Your name, phone number and email address.
• The type of appointment and your preferred date and time.
• Anything you choose to write in the message box. This may include information about your eyes or general health, which the law treats as sensitive. Please only share what you are comfortable with; we can discuss the rest at your visit.

When you pay an invoice:

• The invoice details: your name, contact details, the services and amounts.
• Payment status and limited payment details from Paystack: the amount, payment method, and for cards the card type and last four digits. You enter your card or mobile money details on Paystack’s secure page, not ours, and we never see or store your full card number or PIN.

When you use the website:

• Your IP address, used briefly to protect our forms from spam and abuse. We store it only in a scrambled (hashed) form.
• Standard technical records kept by our hosting provider, such as the pages requested and the time of the request.

• To review your appointment request and contact you to confirm a time.
• To send you an email confirming we received your request.
• To prepare your care before your visit.
• To issue invoices, take payment and keep financial records.
• To keep the website secure and prevent spam, fraud and misuse.
• To meet our legal and regulatory obligations.

We do not use your information for marketing, and we do not make decisions about you by automated means alone.

Under Act 843 we rely on:

• Your consent for appointment requests, including any health information you include and storing it with our providers outside Ghana. You give this when you tick the consent box on the booking form, and you can withdraw it at any time (see “Your rights”).
• Providing a service you asked for, when we invoice you and take payment.
• Legal obligations, such as keeping financial records for tax purposes.
• Legitimate interests in keeping our website and services secure, in ways that do not override your rights.

We never sell your information. Only authorised Haven Eye staff can see it. We use these trusted service providers, who process it only on our instructions and for the purposes above:

• Netlify, which hosts this website.
• Neon, which hosts our secure database.
• Resend, which delivers our appointment emails.
• Paystack, which processes payments. Paystack handles your payment details under its own privacy policy and security standards.

If you choose to contact us on WhatsApp, your messages are also handled by WhatsApp under its own terms. We may disclose information where the law requires it, for example to a court or regulator.

Our hosting, database and email providers may store or process your information on servers outside Ghana. We choose providers with strong security, including encryption, and we only transfer what is needed. By giving consent on the booking form, you agree to this storage. Information about patients from outside Ghana is handled in line with the data protection law of their home country where it applies.

We keep information only for as long as we need it, then delete it or make it anonymous.

• Appointment requests: 2 years from your request if it does not lead to a visit. If you become a patient, your request becomes part of your clinical record and is kept for as long as professional and legal record-keeping rules require.
• Invoices and payments: 6 years from the end of the financial year in which the payment was made, to meet tax and accounting requirements.
• Emails: Appointment emails are kept with the related appointment request and deleted with it.
• Security records: Rate-limit records, which hold a scrambled (hashed) form of your IP address, are deleted within a day of expiring. Hosting logs are kept by our providers for a short period only, typically up to 30 days.

• All information is encrypted in transit between your browser and our website (HTTPS).
• Our database and hosting providers encrypt stored data.
• Our staff systems are password-protected, with repeated wrong passwords blocked.
• Only staff who need your information to care for you can see it.

If a security breach affects your information, we will tell you and the Data Protection Commission as soon as reasonably practicable, with steps you can take to protect yourself.

Under Act 843, you have the right to:

• Know whether we hold information about you, and get a copy of it.
• Have inaccurate, incomplete or out-of-date information corrected.
• Have information deleted where we no longer have a reason to keep it.
• Object to, or ask us to stop, using your information, including where it may cause you damage or distress.
• Withdraw your consent at any time. This doesn’t affect anything we did before you withdrew it.
• Not be subject to decisions made solely by automated means.
• Not have your information used for direct marketing.
• Seek compensation if you suffer damage or distress because we break the law.

To use any of these rights, email info@haveneyeltd.com with the subject “Privacy request”, or call +233 55 776 7766. We may need to confirm your identity before acting. There is no charge, and we will respond within 30 days. Some information, such as clinical and financial records, may have to be kept for a minimum period by law even if you ask us to delete it; if so, we will explain why.

Appointments for children under 18 should be requested by a parent or guardian, who provides the child’s information on their behalf and can exercise the child’s rights described here.

This website does not use advertising, analytics or tracking cookies. When you pay, you are taken to Paystack’s secure checkout, which uses its own cookies to process your payment safely. Links to other websites, such as WhatsApp or eye-health resources, are covered by those websites’ own privacy policies.

We will update this notice if our practices or the law change, and show the new date at the top. Where a change is significant, we will make it clear on this website.

For any question about your information, contact Haven Eye Limited at info@haveneyeltd.com, on +233 55 776 7766, or at Valco Trust House, adjacent to the Bank of Ghana, Ridge, Accra, Ghana.

If you are unhappy with how we have handled your information, please tell us first so we can put it right. You also have the right to complain to the Data Protection Commission: dataprotection.org.gh, info@dataprotection.org.gh, +233 25 630 1533.