Privacy Policy

Purpose

This Privacy Policy describes how Living Goods ("LG", "we", "us", "our") collects, uses, processes, shares, stores, and protects personal data in the course of its operations, including through the SmartHealth Application and related digital systems.

This Policy establishes LG's commitment to lawful, transparent, and responsible data handling across all countries of operation, including but not limited to:

• Public health programs (including SmartHealth)
• Human resources and recruitment
• Finance and grant management
• Donor engagement and fundraising
• Vendor and consultant management
• Governance and Board operations
• Investigations and safeguarding
• IT systems and digital platforms
• Research, monitoring and evaluation
• Communications and outreach

Scope

This Policy applies to personal data relating to the following individuals across all jurisdictions in which LG operates:

• Beneficiaries and households
• Community Health Workers
• Employees (current and former)
• Job applicants
• Consultants and contractors
• Board members and volunteers
• Donors and funding partners
• Government counterparts
• Vendors and service providers
• Website and digital platform users

Data Controller & Processor Roles

Living Goods acts as:

• Data Controller where LG determines the purpose and means of processing personal data.
• Data Processor where LG processes data on behalf of government partners or donors under formal agreements.

Where required, formal Data Processing Agreements (DPAs) are executed.

Legal Basis for Processing

LG processes personal data under one or more of the following lawful bases:

• Compliance with legal or regulatory obligations
• Performance of contractual obligations
• Legitimate organizational interests
• Consent (where required)
• Public interest or public health mandate
• Protection of vital interests

Sensitive personal data — including health data, safeguarding data, or disciplinary records — is processed only where legally permitted and with enhanced safeguards.

Categories of Data Processed

Depending on the context, LG may process the following categories of personal data:

Purposes of Processing

LG processes personal data to:

• Deliver and improve public health services
• Administer employment and HR functions
• Manage grants and donor relationships
• Conduct procurement and vendor management
• Ensure financial accountability and audit compliance
• Support safeguarding and investigations
• Maintain secure IT systems
• Conduct monitoring, evaluation, and reporting
• Protect organizational integrity
• Fulfill legal and regulatory obligations

Data is not used for unrelated commercial exploitation.

Data Sharing

LG may share personal data:

• With government authorities (where required)
• With service providers under contract
• With auditors and legal advisors
• With donors (primarily aggregated or anonymized data)
• With regulators
• In the context of mergers, restructuring, or asset transfer
• Where legally compelled

All third parties are bound by confidentiality and data protection obligations.

Cross-Border Transfers

Where personal data is transferred internationally:

• Appropriate safeguards are implemented.
• Transfers comply with applicable national data protection laws.
• Contractual and technical controls are applied.

Data Retention

Personal data is retained only for as long as necessary to:

• Fulfill contractual or programmatic purposes
• Meet statutory retention obligations
• Support audit and compliance requirements
• Resolve disputes

Retention schedules are governed by LG's Records Management framework. Data is securely deleted or anonymized when no longer required.

Data Subject Rights

Where applicable under law, individuals have the right to:

• Access personal data held about them
• Correct inaccurate data
• Request deletion (subject to legal limitations)
• Object to certain processing activities
• Withdraw consent
• Lodge complaints with supervisory authorities

Requests should be directed to the designated data protection contact listed below.

Security & Safeguards

LG implements appropriate safeguards proportionate to data sensitivity, including:

• Administrative controls
• Technical safeguards
• Encryption (where applicable)
• Role-based access controls
• Confidentiality agreements
• Monitoring and audit logging
• Vendor due diligence

Incident Response

In the event of a personal data breach, LG will:

• Investigate promptly
• Assess the risk to affected individuals
• Make notifications where legally required
• Implement corrective measures

Children & Vulnerable Persons

Where data relates to minors or vulnerable individuals:

• Enhanced safeguards apply.
• Processing aligns with public health mandates and safeguarding obligations.
• Ethical and legal standards are upheld.

Governance & Accountability

LG maintains internal oversight mechanisms including:

• Assigned data protection responsibility
• Periodic policy reviews
• Risk assessments
• Internal compliance monitoring
• Alignment with national data protection laws in all jurisdictions of operation

This Policy is reviewed regularly or as required by changes in law, operations, or risk.

Contact Information

For privacy-related inquiries, requests, or complaints: