Privacy Policy

1. Who We Are

This website is operated by the Global Health and Artificial Intelligence Foundation (also known as GHAI Foundation / Open AI Foundation), a public-interest foundation dedicated to independent evaluation of artificial intelligence in healthcare. We are the data controller for the purposes of this policy.

Contact: privacy@ghaifoundation.org

2. Data We Collect

We collect personal information only when you actively provide it — primarily through our contact form. We do not use advertising trackers, third-party analytics that share data externally, or behavioural profiling.

3. How We Use Your Data

We use the information you provide solely for the following purposes:

• Responding to your enquiry or request
• Routing your message internally to the appropriate team
• Sending a one-time confirmation of receipt where relevant
• Maintaining records of correspondence for accountability and audit purposes

We do not use your data for marketing, profiling, automated decision-making, or any commercial purpose.

4. Data Sharing

We do not sell, rent, or trade your personal data. We may share data with the following categories of processors, strictly for the purposes above:

• Email delivery infrastructure — to send automated acknowledgements and route messages
• Hosting and infrastructure providers — to operate and secure this website
• Legal advisers or regulators — only where required by law or to protect legitimate legal interests

All third-party processors are bound by data processing agreements and are required to implement appropriate technical and organisational safeguards.

5. Retention

Contact form submissions and associated personal data are retained for a maximum of 24 months from the date of receipt, unless a longer retention period is required by law or necessary for ongoing correspondence. Server logs are retained for a maximum of 90 days.

6. Your Rights

Depending on your jurisdiction, you may have the following rights regarding your personal data:

• Access — request a copy of the personal data we hold about you
• Rectification — request correction of inaccurate or incomplete data
• Erasure — request deletion of your data where there is no compelling reason for continued processing
• Restriction — request that we limit how we process your data
• Portability — request your data in a commonly-used, machine-readable format
• Objection — object to processing based on legitimate interest

To exercise any of these rights, email us at the address below. We will respond within 30 days. If you believe your rights have not been respected, you have the right to lodge a complaint with your national data protection authority.

7. Cookies & Analytics

This website may use strictly necessary cookies required for the site to function (e.g. session state, CSRF protection). We do not use advertising cookies, cross-site tracking cookies, or any cookies that identify you across third-party websites.

If we introduce optional analytics in the future, we will update this policy and obtain appropriate consent before doing so.

8. Security

We implement appropriate technical and organisational measures to protect your personal data against accidental loss, unauthorised access, disclosure, alteration, or destruction. Data in transit is protected by TLS encryption. Access to submitted data is limited to authorised personnel.

9. Changes to This Policy

We may update this policy from time to time. Material changes will be noted at the top of this page with a revised effective date. Continued use of the website after changes are posted constitutes acceptance of the updated policy.

10. Contact

For any questions, requests, or concerns regarding this Privacy Policy or how we handle your data, please contact our Privacy Lead: