Beginner’s Mind Lab (“we”, “our”, or “us”) is a tech-startup that develops digital products and solutions, primarily in healthcare, while also exploring other sectors where technology can improve how people work and access services.

We respect your privacy and are committed to protecting the personal information entrusted to us. This Privacy Policy explains how we collect, use, store, disclose, and protect personal information when you visit our website, communicate with us, or use our digital products and services.

We handle personal information in accordance with applicable laws, including Uganda’s Data Protection and Privacy Act, 2019, and the Data Protection and Privacy Regulations, 2021, where applicable.

This policy applies to personal information processed through:

• Our corporate website and its contact forms.
• Communications with us by email, telephone, or other channels.
• Our digital products and services, where this policy is expressly applicable.
• Other interactions in which we collect personal information in our capacity as a data controller.

Some products and services may have their own privacy notices explaining how specific categories of information are processed. Where a separate notice applies, it should be read together with this policy.

When we process personal information on behalf of a client or another organisation, that organisation may determine the purposes and means of processing and may be responsible for providing the relevant privacy information to individuals.

The information we collect depends on how you interact with us and which services you use. It may include:

3.1 Information you provide

• Contact details, such as your name, email address, telephone number, and organisation.
• Information you include in enquiries, feedback, applications, or other communications.
• Account information you provide when registering for a product or service, where applicable.
• Any other information you voluntarily submit through our website or digital platforms.

3.2 Technical and usage information

Depending on the website or service you use, we may collect technical information such as your IP address, browser type, device information, pages visited, access times, and diagnostic or security logs.

3.3 Information from other sources

Where lawful and necessary, we may receive information from organisations or individuals who interact with us on your behalf, or from other sources relevant to the service being provided.

We aim to collect only information that is relevant and necessary for the stated purpose.

We may use personal information to:

• Respond to enquiries and communicate with you.
• Provide, operate, maintain, and improve our products and services.
• Create and manage user accounts, where applicable.
• Understand how our website and services are used.
• Identify, investigate, and prevent fraud, misuse, and security incidents.
• Meet legal, regulatory, contractual, and accountability obligations.
• Send service-related updates or other communications where appropriate and lawful.
• Conduct research, analytics, or product development where we have an appropriate legal basis and apply suitable safeguards.

We will not use personal information for purposes that are incompatible with the purposes for which it was collected unless permitted by applicable law.

We process personal information only where an appropriate legal basis applies. Depending on the circumstances, this may include:

• Consent: where you have freely agreed to a particular use of your information.
• Contract: where processing is necessary to provide a service or take steps you have requested before entering into a contract.
• Legal obligations: where processing is necessary to comply with applicable law.
• Legitimate interests: where recognised by applicable law and where those interests do not override your rights and freedoms.
• Other lawful grounds: where processing is authorised or required by applicable law.

Where processing relies on consent, you may withdraw your consent subject to applicable legal requirements. Withdrawal does not affect processing that was lawful before the withdrawal.

Some of our digital solutions may support healthcare delivery or involve other sensitive categories of personal information. Such information requires additional care and safeguards.

We process health information and other sensitive personal data only where the processing is permitted by applicable law and the necessary legal conditions and safeguards have been satisfied.

Where a product handles patient information, its applicable privacy notice should explain the information collected, the purposes of processing, who may access it, how long it is retained, and how individuals can exercise their rights.

Please do not submit patient records, medical details, or other sensitive information through general website contact forms unless the relevant service specifically requests it and provides an appropriate secure channel.

We recognise the importance of protecting children’s personal information. Where our products or services are intended for, or may involve, children, we will apply the requirements and safeguards prescribed by applicable law.

Depending on the circumstances, this may include obtaining appropriate authorisation from a parent, guardian, or other legally authorised person, where required.

If you believe a child’s personal information has been provided to us improperly, please contact us using the details below so that we can assess the matter and take appropriate action.

Our website or digital services may use cookies and similar technologies to support functionality, maintain security, remember preferences, and understand website usage.

The types of cookies used, their purposes, and the choices available to you will depend on the technologies actually implemented on the relevant website or service. Where required by law, we will obtain consent before using non-essential cookies or similar technologies.

You may be able to manage cookies through your browser settings. Disabling certain cookies may affect the operation of some website features.

We do not treat personal information as a commodity to be sold. We may share it where necessary and lawful with:

• Service providers: organisations that support hosting, infrastructure, communications, maintenance, analytics, security, or other business operations.
• Clients and partners: where necessary to provide an agreed service or where you have been appropriately informed.
• Professional advisers: such as legal, accounting, or security advisers who require the information for their work.
• Public authorities: where disclosure is required or authorised by law, or is otherwise lawfully necessary.
• Business transactions: where information must be considered in connection with a merger, acquisition, restructuring, or transfer of business assets, subject to applicable legal requirements.

Where appropriate, we take steps to ensure that recipients are subject to suitable confidentiality, security, and data protection obligations.

Some of our service providers or technology infrastructure may be located outside Uganda. Consequently, personal information may be processed or stored in another country, depending on the service being used.

Where personal information is transferred across borders, we will take the measures required by applicable law to ensure that the transfer is lawful and that appropriate protection is provided.

Information about the countries involved and the applicable safeguards can be provided where appropriate and required.

We retain personal information only for as long as necessary to fulfil the purpose for which it was collected, meet applicable legal or contractual obligations, resolve disputes, and protect our legitimate interests where permitted by law.

Retention periods vary depending on the type of information, the service involved, applicable legal requirements, and operational needs.

When information is no longer required, we will take appropriate steps to delete it, securely destroy it, or irreversibly anonymise it, subject to applicable legal obligations and any necessary preservation requirements.

We implement appropriate technical and organisational measures intended to protect personal information against unauthorised access, disclosure, alteration, loss, destruction, and other forms of unlawful processing.

Depending on the service and the risks involved, these measures may include:

• Access controls and appropriate user permissions.
• Authentication and secure account-management practices.
• Encryption and secure communication protocols where appropriate.
• Software updates, backups, monitoring, and security testing.
• Staff guidance, confidentiality requirements, and internal procedures for handling personal information.
• Procedures for identifying and responding to security incidents.

No method of transmitting or storing information can be guaranteed to be completely secure. We therefore work to maintain and improve our safeguards as our systems, services, and risks evolve.

Subject to applicable law and any relevant conditions or exemptions, you may have the right to:

• Request access to personal information we hold about you.
• Request correction of inaccurate or incomplete information.
• Request deletion or destruction of personal information where legally applicable.
• Object to certain processing or request that processing be restricted.
• Withdraw consent where consent is the basis for processing.
• Raise a complaint with the relevant data protection authority.

To exercise a right, please contact us using the details in the Contact Us section. We may need to verify your identity before responding. We will handle requests in accordance with applicable law and explain where a request cannot be fulfilled.

Our website or products may contain links to websites, applications, or services operated by third parties. Those services may have their own privacy policies and data-handling practices.

Unless we expressly state otherwise, we do not control the privacy practices of independent third parties. We encourage you to review their privacy notices before providing them with personal information.

Some of our services may enable organisations to collect or manage information about their own users, employees, patients, customers, or other individuals.

Where we process personal information on behalf of a client, our responsibilities will be governed by the applicable agreement, instructions, and legal requirements. The client may be responsible for determining the purposes of processing and for informing affected individuals about how their information is used.

If you have questions about information processed by an organisation using one of our platforms, you may need to contact that organisation directly. We will provide reasonable assistance where required by law or contract.

We may update this Privacy Policy to reflect changes in our services, technologies, business practices, or applicable legal requirements. When we make changes, we will update the revision date shown on this page. Where required by law, we will provide additional notice or obtain consent before implementing changes that require it.