Anonymization and pseudonymization
All personal identifiers (names, national IDs, contact details, precise locations) are removed or pseudonymized before analysis. Individual-level data is used only for legitimate public health purposes and is never retained in identifiable form longer than necessary.
Data minimization
AHI collects only the data necessary for specific public health purposes. We do not engage in bulk data collection “just in case” it might be useful. Data fields are justified, documented, and limited.
Legal compliance
All data processing complies with:
- GDPR (General Data Protection Regulation) — applicable where data involves European partners or citizens
- HIPAA-style protections for health data handling and security
- The African Union Malabo Convention and relevant national data protection laws
- Specific national health data regulations in each country of operation
Informed consent and transparency
Where individual-level data is collected directly, informed consent is obtained in clear, accessible language. Individuals understand how their data will be used, who will have access, and what rights they have.
Strict access controls
Access to identifiable health data is limited to authorized personnel with a legitimate need, documented, audited, and subject to regular review. No external party has direct access to identifiable data without explicit authorization.
Data security
All health data is encrypted at rest and in transit. Security controls are audited regularly. Breach notification procedures are in place and tested.
Privacy impact assessments
All new data integrations, systems, or significant changes undergo privacy impact assessments to identify and mitigate risks before implementation.
Individual rights
Where applicable, individuals have rights to:
- Access their personal data
- Correct inaccurate data
- Object to processing
- Request deletion (subject to public health and legal limitations)
- Data portability
No unauthorized secondary use
Data collected for public health surveillance is not used for law enforcement, immigration control, employment decisions, or any purpose outside the scope of the original collection.
Independent oversight
Privacy protections are monitored by independent data protection officers and, where appropriate, external auditors. Complaints and concerns can be raised confidentially.
Training and culture
All AHI personnel and partners receive regular training on data protection and privacy. We cultivate a culture that values privacy as a right, not a compliance burden.