Privacy policy

This policy explains how the Ministry of Health and Health Infrastructure of the Republic of Equatorial Guinea processes the personal data of people who visit and use the Ministerio de Sanidad e Infraestructuras Sanitarias portal (guineasalud.com), its forms, the alert notifications and the installable app (PWA).

The portal is designed to collect as little data as possible. You can read news, alerts, the hospital directory, health data and publications without registering and without giving us any personal data. We do not sell data, we do not show advertising and we do not profile users.

1. Data controller

• Controller: Ministry of Health and Health Infrastructure of the Republic of Equatorial Guinea.

• Address: Calle Abilio Balboa, Malabo.

• Email: contacto@guineasalud.com (write "Data protection" in the subject line).

• Website: palegoldenrod-weasel-945596.hostingersite.com.

The Ministry is the controller of the data processed through this portal. Data about the healthcare you receive in hospitals and health centres (medical records, tests, prescriptions) is not processed on this portal. Each centre manages that data under its own rules.

2. Our principles

• Lawfulness and transparency: we only process data on a legitimate basis, and we explain how.

• Purpose limitation: we only use data for the purpose it was collected for.

• Data minimisation: we only ask for what is essential. For example, alerts need neither a name nor a phone number.

• Accuracy: you can ask us to correct your data at any time.

• Storage limitation: we keep data only for as long as needed, and then delete it.

• Security and confidentiality: we apply technical and organisational measures to protect data, with particular care for health data.

3. What data we process and why

3.1. Browsing the portal

When you visit any page, the server automatically receives technical data sent by your browser: IP address, date and time, requested page, referring page, browser type and operating system. This data is recorded in the server's technical logs.

• Why: to run the portal, detect errors and protect the service against abuse and attacks.

• What we don't do: we don't use it to identify you, we don't run visitor analytics with third-party tools and we don't build profiles.

• Usage limits: to prevent abuse, the portal temporarily counts, in server memory, how many requests arrive from the same IP on forms and subscriptions. This count deletes itself after minutes or hours.

• Errors: if a page fails, we keep a technical error record (page, date and technical description). It does not include your IP or anything else that identifies you.

3.2. Contact form

If you write to us through the contact page, we process your name, email address, phone number (optional), subject and message, plus the date and the IP address it was sent from.

• Why: to answer your enquiry and, where necessary, forward it to the relevant department of the Ministry. The IP is kept only for security and to prevent bulk or fraudulent submissions.

• Legal basis: your request and your consent, which you give by ticking the acceptance box when you submit the form.

• Who sees it: only authorised Ministry staff who handle messages.

3.3. Complaints (ODEPAC)

The Patient Ombudsman's Office (ODEPAC) receives complaints and reports about healthcare. If you use this channel, we process the same data as in the contact form, plus any information you choose to include about your case. This may include health data about you or another person.

• Why: to examine and handle your complaint, ask the centre or service involved for information and reply to you.

• Legal basis: the Ministry's public-interest task of protecting patients' rights and the quality of care, and your consent to the processing of any health data you provide.

• Confidentiality: only the staff handling the complaint have access. Where essential to resolve it, we share the necessary information with the healthcare centre or service concerned.

• Third-party data: if the complaint concerns another person, make sure you have their permission or are legally acting on their behalf.

3.4. Health alert notifications

If you tap "Turn on alerts" and grant your browser's permission, we store your browser's technical notification subscription: an address at the notification service and some encryption keys. We also store the regions and alert levels you choose, the language and the sign-up date. We do not store your name, phone number or location.

• Why: to send you official public-health alerts for the regions and levels you selected.

• Legal basis: your consent, given when you turn on alerts and grant the browser permission.

• How to unsubscribe: open "Turn on alerts" and tap "Turn off alerts", or withdraw the notification permission in your browser or phone settings. If the notification service tells us a subscription is no longer valid, we delete it automatically.

• Notification services: notifications are delivered through your browser's notification service, run by its maker (Google, Apple, Mozilla or Microsoft, depending on the browser). The content of each alert is encrypted in transit.

3.5. "Near me" in the hospital directory

If you use "Near me", your browser asks for permission to access your location. Your position is used only on your device to work out the distance to each centre and sort them. It is not sent to the server or stored. You can withdraw the permission in your browser settings.

3.6. Searches

What you type in the search box is sent to the server to show the results. We don't keep a search history linked to any person. The address of the results page may, however, appear in the server's technical logs described in section 3.1.

3.7. Maps

The maps in the hospital directory and on the contact page use OpenStreetMap imagery. When you view a map, your browser downloads those images directly from OpenStreetMap's servers, which receive your IP address and technical browser data under their own privacy policy. The "Directions" button opens Google Maps or another maps app only when you tap it.

3.8. Videos

Some news items include YouTube videos. We show them in privacy-enhanced mode (youtube-nocookie.com), so YouTube stores nothing on your device until you choose to play the video. Once you play it, Google may process data under its own privacy policy.

3.9. Sharing content

The "WhatsApp", "Facebook" and "X" buttons are plain links. They load no code from those networks on our pages and send them no data while you browse. Only when you tap one does the chosen network open, and it then processes data under its own policy.

3.10. Offline use and the installable app

So that you can check alerts, hospitals and emergency numbers without a signal, the portal stores a copy of the pages and images you have visited on your device (cache). This copy stays on your device, is not sent to the Ministry, and is refreshed or removed automatically. The Cookie policy has the details.

3.11. Ministry staff using the management panel

For authorised staff who publish content, we process their name, work email, role and encrypted password (never stored in readable form), plus the date of their last sign-in and any failed sign-in attempts. We also keep an audit log recording what changes each person makes, when, and from which IP.

• Why: to manage access to the panel, keep it secure and keep changes to official information accountable.

• Session cookie: a technical cookie that expires after 8 hours, set only for people who sign in to the panel.

3.12. Published health data and statistics

The figures and charts in the "Data" section are aggregated, anonymous data (for example, cases per region and month) and cannot identify anyone. If a dataset could make someone identifiable, it is either not published or aggregated before publication.

4. Health data: important advice

• This portal is not an emergency channel. In a medical emergency, call the emergency number or go to the nearest health centre. See the Emergencies page.

• Do not include medical details that aren't needed for your enquiry in the contact form.

• The portal does not provide diagnoses or personal medical consultations, and we don't answer them by email.

5. Legal basis for processing

We process data under the personal data protection rules in force in the Republic of Equatorial Guinea, on these grounds:

• Public-interest task and the Ministry's official powers: informing the public about health, issuing health alerts, keeping the directory of centres, handling patient complaints and keeping the portal secure.

• Consent: the contact form, alert notifications, any health data you choose to give us, and the use of your location in "Near me". You can withdraw consent at any time; this does not affect anything done before.

• Legal obligation: where a rule requires us to keep or disclose certain data.

6. Who we share data with

We do not sell data or share it with third parties for commercial purposes. Only the following may have access:

• Authorised Ministry staff, limited to what their role needs.

• Healthcare centres and services or other public bodies, where needed to handle your enquiry or complaint, or where the law requires it.

• Technical providers that serve the Ministry (portal hosting, email delivery). They may only process data on our instructions and are bound by confidentiality.

• Browser notification services, only to deliver alerts (section 3.4).

• Judicial and administrative authorities, where there is a legal obligation.

7. International transfers

Some services involved in running the portal may process data outside Equatorial Guinea: browser makers' notification services, OpenStreetMap's map servers, and YouTube if you play a video. In those cases only the minimal technical data described in this policy is transmitted.

8. How long we keep data

9. Security

Our measures include:

• Encrypted connections (HTTPS) across the whole portal.

• Staff passwords stored with one-way encryption, and accounts locked after repeated failed sign-ins.

• Role-based access to the panel: each person only sees and changes what they need to.

• An audit log of every change.

• No data is stored in any folder that is reachable from the Internet.

• Daily backups.

No system is completely invulnerable. If we detect a security incident affecting your data, we will act to limit its effects and inform you where appropriate.

10. Your rights

You can exercise the following rights at any time, free of charge:

• Access: find out whether we process your data and get a copy.

• Rectification: correct inaccurate or incomplete data.

• Erasure: ask us to delete your data when it is no longer needed.

• Objection and restriction: ask us to stop processing it, or to keep it without using it, in the cases provided for by law.

• Portability: receive the data you gave us in electronic form.

• Withdraw consent, without affecting anything done before.

The portal makes no automated decisions that have legal effects on you.

How to exercise them: email contacto@guineasalud.com with the subject "Data protection", or come in person to Calle Abilio Balboa, Malabo. Say which right you want to exercise and include a way to verify your identity; don't send more documents than necessary. We will reply within the period set by the applicable rules. If you disagree with our answer, you can go to the competent authorities or courts of the Republic of Equatorial Guinea.

11. Minors

The portal's information is open to people of all ages. If you are a minor and want to send us a message or a complaint, ask your mother, father or legal guardian for help. If we find we have received a minor's data without proper authorisation, we will delete it, unless it is needed to protect their health or rights.

12. Links to other websites

The portal links to websites of other organisations (for example, the World Health Organization), to social networks and to external documents. Their own privacy policies apply when you visit them.

13. Changes to this policy

We may update this policy when the portal or the law changes. The current version, with its update date, will always be published on this page. We will flag important changes visibly on the portal.

14. Contact

For any question about this policy or how your data is processed, email contacto@guineasalud.com with "Data protection" in the subject line.